Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Get Many Comments

AI-generated

Overview

This node operation retrieves multiple comments associated with a specific incident in Microsoft Sentinel. It is useful for scenarios where users need to review or process all comments related to an incident, such as in security investigations or incident management workflows. For example, a security analyst might use this operation to fetch all comments on a particular incident to understand the context and actions taken so far.

Use Case Examples

  1. Fetching all comments for an incident to display in a dashboard.
  2. Automating the extraction of incident comments for reporting or auditing purposes.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Incident ID The UUID of the incident for which to retrieve comments.
Options Additional options to customize the response, including whether to simplify the response data and whether to split the results into individual items.
Debug Enable debug mode for the node to log request and response details for troubleshooting.
Request Options Settings for request batching, SSL certificate validation, proxy configuration, and request timeout.

Output

JSON

  • comments - Array of comments retrieved for the specified incident.

Dependencies

  • Requires Microsoft Sentinel API access with OAuth2 authentication.

Troubleshooting

  • Ensure the Incident ID is a valid UUID; invalid IDs will cause request failures.
  • Verify the Sentinel Instance details are correctly formatted and accessible.
  • If using URL mode for Sentinel Instance, ensure the URL contains the required subscription, resource group, and workspace information.
  • Enable debug mode to capture detailed request and response logs for troubleshooting.

Discussion