Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Update

AI-generated

Overview

This node operation updates an existing incident in Microsoft Sentinel. It is useful for security analysts or automation workflows that need to modify incident details such as status, severity, classification, labels, owner, and timestamps. For example, updating an incident's status to 'Closed' with a classification and comment after investigation.

Use Case Examples

  1. Updating the status and severity of a security incident after review.
  2. Adding labels and owner information to an incident for better tracking.
  3. Modifying the description and activity timestamps of an incident to reflect new findings.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by URL or selection from a list.
Incident ID The UUID of the incident to update, required to identify the specific incident.
Additional Fields Optional fields to update on the incident, including classification, classification comment, description, first and last activity times, label mode, labels, owner, severity, status, and title.
Options Additional options for the update operation, such as forcing the update, providing custom properties in JSON format, and whether to simplify the response.

Output

JSON

  • id - The unique identifier of the updated incident.
  • name - The name of the updated incident.
  • type - The type of the resource, typically an incident.
  • properties
    • status - The updated status of the incident.
    • severity - The updated severity level of the incident.
    • classification - The classification and reason for the incident.
    • classificationComment - The comment explaining the classification.
    • description - The updated description of the incident.
    • firstActivityTimeUtc - The updated first activity time in UTC.
    • lastActivityTimeUtc - The updated last activity time in UTC.
    • owner - The updated owner UPN/email address.
    • labels - The updated labels associated with the incident.
    • title - The updated title of the incident.

Dependencies

  • An API key credential for Microsoft Sentinel OAuth2 authentication

Troubleshooting

  • Ensure the Incident ID is a valid UUID; otherwise, the update will fail.
  • Verify that the Sentinel Instance is correctly specified in one of the accepted formats (Path, URL, or List).
  • If the update fails due to etag validation, consider enabling the 'Force Update' option to bypass it.
  • Check that the additional fields conform to expected formats, especially date-time fields and JSON for custom properties.
  • If the node returns raw data and it's difficult to parse, enable the 'Simplify' option to get a simplified response.

Links

Discussion