Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Instance → Get Instances

AI-generated

Overview

This node interacts with Microsoft Sentinel to retrieve Sentinel instances. Specifically, the 'Get Instances' operation fetches a list of Sentinel instances using the Microsoft Resource Graph API. This is useful for users who want to programmatically access and manage their Sentinel instances within Azure, for example, to list available Sentinel workspaces for monitoring or automation purposes.

Use Case Examples

  1. A security analyst wants to list all Sentinel instances in their Azure subscription to monitor security alerts.
  2. An automation workflow needs to dynamically select a Sentinel instance to run queries or manage incidents.

Properties

Name Meaning
Sentinel Instance The Sentinel instance to use. It can be selected from a list, entered as a path in the format {subscriptionId}/{resourceGroupName}/{workspaceName}, or provided as a valid Azure Portal/Management URL.
Debug Enable or disable debug mode for the node to log request and response details.
Request Options Settings to control batching, SSL certificate validation, proxy usage, and request timeout for API calls.

Output

JSON

  • data - The list of Sentinel instances returned by the Microsoft Resource Graph API.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate API requests.

Troubleshooting

  • Ensure the Sentinel instance input is correctly formatted as a path, URL, or selected from the list to avoid validation errors.
  • If API requests fail, check the OAuth2 credentials and network settings such as proxy and SSL options.
  • Timeout errors can occur if the server does not respond within the configured timeout period; increase the timeout if necessary.

Links

Discussion