Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Get Many

AI-generated

Overview

This node operation retrieves multiple incidents from a specified Microsoft Sentinel instance. It is useful for security analysts or IT professionals who want to fetch a list of security incidents for monitoring, investigation, or reporting purposes. The operation supports filtering, sorting, and including related data such as alerts, comments, and entities associated with each incident.

Use Case Examples

  1. Fetch all incidents created after a specific date to review recent security events.
  2. Retrieve incidents with a specific severity level and include related alerts for detailed analysis.
  3. Get a limited number of incidents sorted by their last modified time to prioritize investigation.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to query, specified by subscription ID, resource group, and workspace name, or selected from a list or URL.
Return All Whether to return all matching incidents or limit the number of results.
Limit Maximum number of incidents to return when not returning all.
Options Additional options to customize the response, such as including related alerts, comments, entities, simplifying the response, and sorting.
Filters Filters to narrow down the incidents by creation date, modification date, incident ID, severity, status, title, or a raw OData filter query.

Output

JSON

  • id - Unique identifier of the incident.
  • title - Title or name of the incident.
  • severity - Severity level of the incident.
  • status - Current status of the incident.
  • createdTimeUtc - UTC timestamp when the incident was created.
  • lastModifiedTimeUtc - UTC timestamp when the incident was last modified.
  • alerts - Related alerts included with the incident if requested.
  • comments - Comments associated with the incident if requested.
  • entities - Related entities such as IPs, hosts, or accounts if requested.

Dependencies

  • Microsoft Sentinel API
  • An OAuth2 API credential for Microsoft Sentinel

Troubleshooting

  • Ensure the Sentinel instance identifier is correctly formatted as subscriptionId/resourceGroupName/workspaceName or a valid Azure URL.
  • Check that the OAuth2 credentials for Microsoft Sentinel API are correctly configured and have necessary permissions.
  • If filtering by date or other parameters, ensure the values are in the correct format (e.g., ISO 8601 for date-time).
  • If the node returns no incidents, verify that the filters are not too restrictive or that incidents exist in the specified Sentinel instance.

Links

Discussion