vw_incident_relations

Creates, updates, deletes, gets or lists a vw_incident_relations resource.

Overview

Name	vw_incident_relations
Type	View
Id	azure.sentinel.vw_incident_relations

Fields

See the SQL Definition (view DDL) for fields returned by this view.

SQL Definition

Sqlite3

SELECT
etag as etag,
JSON_EXTRACT(properties, '$.relatedResourceId') as "related_resource_id",
JSON_EXTRACT(properties, '$.relatedResourceName') as "related_resource_name",
JSON_EXTRACT(properties, '$.relatedResourceType') as "related_resource_type",
JSON_EXTRACT(properties, '$.relatedResourceKind') as "related_resource_kind",
subscriptionId,
resourceGroupName,
workspaceName,
incidentId,
relationName
FROM azure.sentinel.incident_relations
WHERE subscriptionId = 'replace-me' AND resourceGroupName = 'replace-me' AND workspaceName = 'replace-me' AND incidentId = 'replace-me';

Postgres

SELECT
etag as etag,
json_extract_path_text(properties, '$.relatedResourceId') as "related_resource_id",
json_extract_path_text(properties, '$.relatedResourceName') as "related_resource_name",
json_extract_path_text(properties, '$.relatedResourceType') as "related_resource_type",
json_extract_path_text(properties, '$.relatedResourceKind') as "related_resource_kind",
subscriptionId,
resourceGroupName,
workspaceName,
incidentId,
relationName
FROM azure.sentinel.incident_relations
WHERE subscriptionId = 'replace-me' AND resourceGroupName = 'replace-me' AND workspaceName = 'replace-me' AND incidentId = 'replace-me';