Incident → Update
AI-generatedSummary
Update a Microsoft Defender XDR incident by its ID, modifying specified fields such as assignment, classification, comments, determination, and status.
Inputs
- Incident ID (required) — The ID of the incident to update.
- Update Fields — Optional fields to update on the incident, including 'Assigned To' (user), 'Classification' (False Positive, True Positive, Informational Expected Activity), 'Comment' (text to add), 'Determination' (dependent on classification with dynamic options), and 'Status' (Active, In Progress, Resolved, Redirected).
Output shape
a single updated incident record as returned from the Microsoft Defender XDR API after PATCH request
The update sends a PATCH request to /api/incidents/{incidentId} with the specified fields in the request body. Unspecified fields remain unchanged. The operation requires the incident ID and any fields to update. The node returns the updated incident data in the output.
Examples
Example 1: Update incident status and add a comment
Set 'Incident ID' to target incident and under 'Update Fields' set 'Status' to 'Resolved' and provide a 'Comment'.