Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident → Remove Label
AI-generatedOverview
This node operation removes specified labels from a Microsoft Sentinel incident. It is useful for managing and updating incident metadata by cleaning up or correcting labels associated with incidents. For example, if an incident was incorrectly tagged with certain labels, this operation can remove those labels to maintain accurate incident categorization.
Use Case Examples
- Removing outdated or incorrect labels from a security incident to ensure accurate tracking and reporting.
- Automating the cleanup of incident labels as part of an incident response workflow.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL. |
| Incident ID | The UUID of the incident from which labels will be removed. |
| Labels | Comma-separated labels or a JSON array of labels to remove from the incident. |
| Options | Additional options for the operation. |
Output
JSON
incidentId- The unique identifier of the incident.removedLabels- The labels that were removed from the incident.status- The status of the label removal operation, indicating success or failure.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Incident ID is a valid UUID; invalid IDs will cause errors.
- Labels must be provided in a correct format (comma-separated string or JSON array); malformed input may cause the operation to fail.
- If 'Force Update' is not enabled, etag validation may prevent updates if the incident has changed since last retrieval.