Incidents - Create Or Update
Creates or updates an incident.
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}?api-version=2024-03-01
URI Parameters
Name | In | Required | Type | Description |
---|---|---|---|---|
incident
|
path | True |
string |
Incident ID |
resource
|
path | True |
string |
The name of the resource group. The name is case insensitive. |
subscription
|
path | True |
string uuid |
The ID of the target subscription. The value must be an UUID. |
workspace
|
path | True |
string |
The name of the workspace. Regex pattern: |
api-version
|
query | True |
string |
The API version to use for this operation. |
Request Body
Name | Required | Type | Description |
---|---|---|---|
properties.severity | True |
The severity of the incident |
|
properties.status | True |
The status of the incident |
|
properties.title | True |
string |
The title of the incident |
etag |
string |
Etag of the azure resource |
|
properties.classification |
The reason the incident was closed |
||
properties.classificationComment |
string |
Describes the reason the incident was closed |
|
properties.classificationReason |
The classification reason the incident was closed with |
||
properties.description |
string |
The description of the incident |
|
properties.firstActivityTimeUtc |
string |
The time of the first activity in the incident |
|
properties.labels |
List of labels relevant to this incident |
||
properties.lastActivityTimeUtc |
string |
The time of the last activity in the incident |
|
properties.owner |
Describes a user that the incident is assigned to |
Responses
Name | Type | Description |
---|---|---|
200 OK |
OK, Operation successfully completed |
|
201 Created |
Created |
|
Other Status Codes |
Error response describing why the operation failed. |
Security
azure_auth
Azure Active Directory OAuth2 Flow
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
Name | Description |
---|---|
user_impersonation | impersonate your user account |
Examples
Creates or updates an incident.
Sample request
PUT https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-03-01
{
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
"description": "This is a demo incident",
"title": "My incident",
"owner": {
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
},
"severity": "High",
"classification": "FalsePositive",
"classificationComment": "Not a malicious activity",
"classificationReason": "IncorrectAlertLogic",
"status": "Closed"
}
}
Sample response
{
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/incidents",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
"properties": {
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
"createdTimeUtc": "2019-01-01T13:15:30Z",
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
"description": "This is a demo incident",
"title": "My incident",
"owner": {
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
"email": "john.doe@contoso.com",
"userPrincipalName": "john@contoso.com",
"assignedTo": "john doe"
},
"severity": "High",
"classification": "FalsePositive",
"classificationComment": "Not a malicious activity",
"classificationReason": "IncorrectAlertLogic",
"status": "Closed",
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"incidentNumber": 3177,
"labels": [],
"providerName": "Azure Sentinel",
"providerIncidentId": "3177",
"relatedAnalyticRuleIds": [],
"additionalData": {
"alertsCount": 0,
"bookmarksCount": 0,
"commentsCount": 3,
"alertProductNames": [],
"tactics": []
}
}
}
{
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"type": "Microsoft.SecurityInsights/incidents",
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
"properties": {
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
"createdTimeUtc": "2019-01-01T13:15:30Z",
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
"description": "This is a demo incident",
"title": "My incident",
"owner": {
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
"email": "john.doe@contoso.com",
"userPrincipalName": "john@contoso.com",
"assignedTo": "john doe"
},
"severity": "High",
"classification": "FalsePositive",
"classificationComment": "Not a malicious activity",
"classificationReason": "IncorrectAlertLogic",
"status": "Closed",
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
"incidentNumber": 3177,
"labels": [],
"providerName": "Azure Sentinel",
"providerIncidentId": "3177",
"relatedAnalyticRuleIds": [],
"additionalData": {
"alertsCount": 0,
"bookmarksCount": 0,
"commentsCount": 3,
"alertProductNames": [],
"tactics": []
}
}
}
Definitions
Name | Description |
---|---|
Attack |
The severity for alerts created by this alert rule. |
Cloud |
Error response structure. |
Cloud |
Error details. |
created |
The type of identity that created the resource. |
Incident |
Represents an incident in Azure Security Insights. |
Incident |
Incident additional data property bag. |
Incident |
The reason the incident was closed |
Incident |
The classification reason the incident was closed with |
Incident |
Represents an incident label |
Incident |
The type of the label |
Incident |
Information on the user an incident is assigned to |
Incident |
The severity of the incident |
Incident |
The status of the incident |
Owner |
The type of the owner the incident is assigned to. |
system |
Metadata pertaining to creation and last modification of the resource. |
AttackTactic
The severity for alerts created by this alert rule.
Name | Type | Description |
---|---|---|
Collection |
string |
|
CommandAndControl |
string |
|
CredentialAccess |
string |
|
DefenseEvasion |
string |
|
Discovery |
string |
|
Execution |
string |
|
Exfiltration |
string |
|
Impact |
string |
|
ImpairProcessControl |
string |
|
InhibitResponseFunction |
string |
|
InitialAccess |
string |
|
LateralMovement |
string |
|
Persistence |
string |
|
PreAttack |
string |
|
PrivilegeEscalation |
string |
|
Reconnaissance |
string |
|
ResourceDevelopment |
string |
CloudError
Error response structure.
Name | Type | Description |
---|---|---|
error |
Error data |
CloudErrorBody
Error details.
Name | Type | Description |
---|---|---|
code |
string |
An identifier for the error. Codes are invariant and are intended to be consumed programmatically. |
message |
string |
A message describing the error, intended to be suitable for display in a user interface. |
createdByType
The type of identity that created the resource.
Name | Type | Description |
---|---|---|
Application |
string |
|
Key |
string |
|
ManagedIdentity |
string |
|
User |
string |
Incident
Represents an incident in Azure Security Insights.
Name | Type | Description |
---|---|---|
etag |
string |
Etag of the azure resource |
id |
string |
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}" |
name |
string |
The name of the resource |
properties.additionalData |
Additional data on the incident |
|
properties.classification |
The reason the incident was closed |
|
properties.classificationComment |
string |
Describes the reason the incident was closed |
properties.classificationReason |
The classification reason the incident was closed with |
|
properties.createdTimeUtc |
string |
The time the incident was created |
properties.description |
string |
The description of the incident |
properties.firstActivityTimeUtc |
string |
The time of the first activity in the incident |
properties.incidentNumber |
integer |
A sequential number |
properties.incidentUrl |
string |
The deep-link url to the incident in Azure portal |
properties.labels |
List of labels relevant to this incident |
|
properties.lastActivityTimeUtc |
string |
The time of the last activity in the incident |
properties.lastModifiedTimeUtc |
string |
The last time the incident was updated |
properties.owner |
Describes a user that the incident is assigned to |
|
properties.providerIncidentId |
string |
The incident ID assigned by the incident provider |
properties.providerName |
string |
The name of the source provider that generated the incident |
properties.relatedAnalyticRuleIds |
string[] |
List of resource ids of Analytic rules related to the incident |
properties.severity |
The severity of the incident |
|
properties.status |
The status of the incident |
|
properties.title |
string |
The title of the incident |
systemData |
Azure Resource Manager metadata containing createdBy and modifiedBy information. |
|
type |
string |
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts" |
IncidentAdditionalData
Incident additional data property bag.
Name | Type | Description |
---|---|---|
alertProductNames |
string[] |
List of product names of alerts in the incident |
alertsCount |
integer |
The number of alerts in the incident |
bookmarksCount |
integer |
The number of bookmarks in the incident |
commentsCount |
integer |
The number of comments in the incident |
providerIncidentUrl |
string |
The provider incident url to the incident in Microsoft 365 Defender portal |
tactics |
The tactics associated with incident |
IncidentClassification
The reason the incident was closed
Name | Type | Description |
---|---|---|
BenignPositive |
string |
Incident was benign positive |
FalsePositive |
string |
Incident was false positive |
TruePositive |
string |
Incident was true positive |
Undetermined |
string |
Incident classification was undetermined |
IncidentClassificationReason
The classification reason the incident was closed with
Name | Type | Description |
---|---|---|
InaccurateData |
string |
Classification reason was inaccurate data |
IncorrectAlertLogic |
string |
Classification reason was incorrect alert logic |
SuspiciousActivity |
string |
Classification reason was suspicious activity |
SuspiciousButExpected |
string |
Classification reason was suspicious but expected |
IncidentLabel
Represents an incident label
Name | Type | Description |
---|---|---|
labelName |
string |
The name of the label |
labelType |
The type of the label |
IncidentLabelType
The type of the label
Name | Type | Description |
---|---|---|
AutoAssigned |
string |
Label automatically created by the system |
User |
string |
Label manually created by a user |
IncidentOwnerInfo
Information on the user an incident is assigned to
Name | Type | Description |
---|---|---|
assignedTo |
string |
The name of the user the incident is assigned to. |
string |
The email of the user the incident is assigned to. |
|
objectId |
string |
The object id of the user the incident is assigned to. |
ownerType |
The type of the owner the incident is assigned to. |
|
userPrincipalName |
string |
The user principal name of the user the incident is assigned to. |
IncidentSeverity
The severity of the incident
Name | Type | Description |
---|---|---|
High |
string |
High severity |
Informational |
string |
Informational severity |
Low |
string |
Low severity |
Medium |
string |
Medium severity |
IncidentStatus
The status of the incident
Name | Type | Description |
---|---|---|
Active |
string |
An active incident which is being handled |
Closed |
string |
A non-active incident |
New |
string |
An active incident which isn't being handled currently |
OwnerType
The type of the owner the incident is assigned to.
Name | Type | Description |
---|---|---|
Group |
string |
The incident owner type is an AAD group |
Unknown |
string |
The incident owner type is unknown |
User |
string |
The incident owner type is an AAD user |
systemData
Metadata pertaining to creation and last modification of the resource.
Name | Type | Description |
---|---|---|
createdAt |
string |
The timestamp of resource creation (UTC). |
createdBy |
string |
The identity that created the resource. |
createdByType |
The type of identity that created the resource. |
|
lastModifiedAt |
string |
The timestamp of resource last modification (UTC) |
lastModifiedBy |
string |
The identity that last modified the resource. |
lastModifiedByType |
The type of identity that last modified the resource. |