incidents

Creates, updates, deletes, gets or lists an incidents resource.

Overview

Name	incidents
Type	Resource
Id	azure.security_insight.incidents

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
additionalData	object	Additional data on the incident.
classification	string	The reason the incident was closed. Known values are: "Undetermined", "TruePositive", "BenignPositive", and "FalsePositive". (Undetermined, TruePositive, BenignPositive, FalsePositive)
classificationComment	string	Describes the reason the incident was closed.
classificationReason	string	The classification reason the incident was closed with. Known values are: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", and "InaccurateData". (SuspiciousActivity, SuspiciousButExpected, IncorrectAlertLogic, InaccurateData)
createdTimeUtc	string (date-time)	The time the incident was created.
description	string	The description of the incident.
etag	string	Etag of the azure resource.
firstActivityTimeUtc	string (date-time)	The time of the first activity in the incident.
incidentNumber	integer	A sequential number.
incidentUrl	string	The deep-link url to the incident in Azure portal.
labels	array	List of labels relevant to this incident.
lastActivityTimeUtc	string (date-time)	The time of the last activity in the incident.
lastModifiedTimeUtc	string (date-time)	The last time the incident was updated.
owner	object	Describes a user that the incident is assigned to.
providerIncidentId	string	The incident ID assigned by the incident provider.
providerName	string	The name of the source provider that generated the incident.
relatedAnalyticRuleIds	array	List of resource ids of Analytic rules related to the incident.
severity	string	The severity of the incident. Required. Known values are: "High", "Medium", "Low", and "Informational". (High, Medium, Low, Informational)
status	string	The status of the incident. Required. Known values are: "New", "Active", and "Closed". (New, Active, Closed)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
teamInformation	object	Describes a team for the incident.
title	string	The title of the incident. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
additionalData	object	Additional data on the incident.
classification	string	The reason the incident was closed. Known values are: "Undetermined", "TruePositive", "BenignPositive", and "FalsePositive". (Undetermined, TruePositive, BenignPositive, FalsePositive)
classificationComment	string	Describes the reason the incident was closed.
classificationReason	string	The classification reason the incident was closed with. Known values are: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", and "InaccurateData". (SuspiciousActivity, SuspiciousButExpected, IncorrectAlertLogic, InaccurateData)
createdTimeUtc	string (date-time)	The time the incident was created.
description	string	The description of the incident.
etag	string	Etag of the azure resource.
firstActivityTimeUtc	string (date-time)	The time of the first activity in the incident.
incidentNumber	integer	A sequential number.
incidentUrl	string	The deep-link url to the incident in Azure portal.
labels	array	List of labels relevant to this incident.
lastActivityTimeUtc	string (date-time)	The time of the last activity in the incident.
lastModifiedTimeUtc	string (date-time)	The last time the incident was updated.
owner	object	Describes a user that the incident is assigned to.
providerIncidentId	string	The incident ID assigned by the incident provider.
providerName	string	The name of the source provider that generated the incident.
relatedAnalyticRuleIds	array	List of resource ids of Analytic rules related to the incident.
severity	string	The severity of the incident. Required. Known values are: "High", "Medium", "Low", and "Informational". (High, Medium, Low, Informational)
status	string	The status of the incident. Required. Known values are: "New", "Active", and "Closed". (New, Active, Closed)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
teamInformation	object	Describes a team for the incident.
title	string	The title of the incident. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, incident_id, subscription_id		Gets a given incident.
list	select	resource_group_name, workspace_name, subscription_id	$filter, $orderby, $top, $skipToken	Gets all incidents.
create_or_update	insert	resource_group_name, workspace_name, incident_id, subscription_id		Creates or updates an incident.
create_or_update	replace	resource_group_name, workspace_name, incident_id, subscription_id		Creates or updates an incident.
delete	delete	resource_group_name, workspace_name, incident_id, subscription_id		Deletes a given incident.
list_alerts	exec	resource_group_name, workspace_name, incident_id, subscription_id		Gets all alerts for an incident.
list_bookmarks	exec	resource_group_name, workspace_name, incident_id, subscription_id		Gets all bookmarks for an incident.
list_entities	exec	resource_group_name, workspace_name, incident_id, subscription_id		Gets all entities for an incident.
run_playbook	exec	resource_group_name, workspace_name, incident_identifier, subscription_id, logicAppsResourceId		Triggers playbook on a specific incident.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
incident_id	string	Incident ID. Required.
incident_identifier	string	The incident identifier. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
workspace_name	string	The name of the workspace. Required.
$filter	string	Filters the results, based on a Boolean condition. Optional. Default value is None.
$orderby	string	Sorts the results. Optional. Default value is None.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. Default value is None.
$top	integer	Returns only the first n results. Optional. Default value is None.

SELECT examples

get

Gets a given incident.

SELECT
id,
name,
additionalData,
classification,
classificationComment,
classificationReason,
createdTimeUtc,
description,
etag,
firstActivityTimeUtc,
incidentNumber,
incidentUrl,
labels,
lastActivityTimeUtc,
lastModifiedTimeUtc,
owner,
providerIncidentId,
providerName,
relatedAnalyticRuleIds,
severity,
status,
systemData,
teamInformation,
title,
type
FROM azure.security_insight.incidents
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND incident_id = '{{ incident_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Gets all incidents.

SELECT
id,
name,
additionalData,
classification,
classificationComment,
classificationReason,
createdTimeUtc,
description,
etag,
firstActivityTimeUtc,
incidentNumber,
incidentUrl,
labels,
lastActivityTimeUtc,
lastModifiedTimeUtc,
owner,
providerIncidentId,
providerName,
relatedAnalyticRuleIds,
severity,
status,
systemData,
teamInformation,
title,
type
FROM azure.security_insight.incidents
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
AND $orderby = '{{ $orderby }}'
AND $top = '{{ $top }}'
AND $skipToken = '{{ $skipToken }}'
;

INSERT examples

create_or_update

Creates or updates an incident.

INSERT INTO azure.security_insight.incidents (
properties,
etag,
resource_group_name,
workspace_name,
incident_id,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ incident_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: incidents
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the incidents resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the incidents resource.
  - name: incident_id
    value: "{{ incident_id }}"
    description: Required parameter for the incidents resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the incidents resource.
  - name: properties
    description: |
      Incident properties.
    value:
      title: "{{ title }}"
      description: "{{ description }}"
      severity: "{{ severity }}"
      status: "{{ status }}"
      classification: "{{ classification }}"
      classificationReason: "{{ classificationReason }}"
      classificationComment: "{{ classificationComment }}"
      owner:
        email: "{{ email }}"
        assignedTo: "{{ assignedTo }}"
        objectId: "{{ objectId }}"
        userPrincipalName: "{{ userPrincipalName }}"
        ownerType: "{{ ownerType }}"
      labels:
        - labelName: "{{ labelName }}"
          labelType: "{{ labelType }}"
      firstActivityTimeUtc: "{{ firstActivityTimeUtc }}"
      lastActivityTimeUtc: "{{ lastActivityTimeUtc }}"
      lastModifiedTimeUtc: "{{ lastModifiedTimeUtc }}"
      createdTimeUtc: "{{ createdTimeUtc }}"
      incidentNumber: {{ incidentNumber }}
      additionalData:
        alertsCount: {{ alertsCount }}
        bookmarksCount: {{ bookmarksCount }}
        commentsCount: {{ commentsCount }}
        alertProductNames:
          - "{{ alertProductNames }}"
        tactics:
          - "{{ tactics }}"
        techniques:
          - "{{ techniques }}"
        providerIncidentUrl: "{{ providerIncidentUrl }}"
        mergedIncidentNumber: "{{ mergedIncidentNumber }}"
        mergedIncidentUrl: "{{ mergedIncidentUrl }}"
      relatedAnalyticRuleIds:
        - "{{ relatedAnalyticRuleIds }}"
      incidentUrl: "{{ incidentUrl }}"
      providerName: "{{ providerName }}"
      providerIncidentId: "{{ providerIncidentId }}"
      teamInformation:
        teamId: "{{ teamId }}"
        primaryChannelUrl: "{{ primaryChannelUrl }}"
        teamCreationTimeUtc: "{{ teamCreationTimeUtc }}"
        name: "{{ name }}"
        description: "{{ description }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Creates or updates an incident.

REPLACE azure.security_insight.incidents
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND incident_id = '{{ incident_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Deletes a given incident.

DELETE FROM azure.security_insight.incidents
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND incident_id = '{{ incident_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

list_alerts

Gets all alerts for an incident.

EXEC azure.security_insight.incidents.list_alerts 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@incident_id='{{ incident_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;

list_bookmarks

Gets all bookmarks for an incident.

EXEC azure.security_insight.incidents.list_bookmarks 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@incident_id='{{ incident_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;

list_entities

Gets all entities for an incident.

EXEC azure.security_insight.incidents.list_entities 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@incident_id='{{ incident_id }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;

run_playbook

Triggers playbook on a specific incident.

EXEC azure.security_insight.incidents.run_playbook 
@resource_group_name='{{ resource_group_name }}' --required, 
@workspace_name='{{ workspace_name }}' --required, 
@incident_identifier='{{ incident_identifier }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"tenantId": "{{ tenantId }}", 
"logicAppsResourceId": "{{ logicAppsResourceId }}"
}'
;