> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Incident

Update the properties of an incident object. Supply **only** the values for properties that should be updated.

* **Least privileged** Microsoft Graph permission to access the action via **application**: `SecurityIncident.ReadWrite.All*`.

<Note>
  External Documentation

  To learn more, visit the [Microsoft Defender XDR documentation](https://learn.microsoft.com/en-us/graph/api/security-incident-update?view=graph-rest-1.0\&tabs=http).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter      | Description                                                                                                                         |
  | -------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
  | Assigned To    | Owner of the incident, or `null` if no owner is assigned.                                                                           |
  | Classification | The specification for the incident.                                                                                                 |
  | Determination  | Specifies the determination of the incident.                                                                                        |
  | Incident ID    | The ID of the incident, can be obtained via the `List Incidents` action.                                                            |
  | Status         | The status of the incident.                                                                                                         |
  | Summary        | The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack. |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter   | Description                                                        |
  | ----------- | ------------------------------------------------------------------ |
  | Custom Tags | A comma separated list of custom tags associated with an incident. |
</div>

## Example Output

```json theme={"dark"}
{
	"@odata.type": "#microsoft.graph.incident",
	"id": "2972395",
	"incidentWebUrl": "https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47",
	"redirectIncidentId": null,
	"displayName": "Multi-stage incident involving Initial access & Command and control on multiple endpoints reported by multiple sources",
	"tenantId": "b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c",
	"createdDateTime": "2021-08-13T08:43:35.5533333Z",
	"lastUpdateDateTime": "2021-09-30T09:35:45.1133333Z",
	"assignedTo": "KaiC@contoso.com",
	"classification": "TruePositive",
	"determination": "MultiStagedAttack",
	"status": "Active",
	"severity": "Medium",
	"customTags": [
		"Demo"
	],
	"comments": [
		{
			"comment": "Demo incident",
			"createdBy": "DavidS@contoso.com",
			"createdTime": "2021-09-30T12:07:37.2756993Z"
		}
	],
	"systemTags": [
		"Defender Experts"
	],
	"description": "Microsoft observed Raspberry Robin worm activity spreading through infected USB on multiple devices in your environment. From available intel, these infections could be a potential precursor activity to ransomware deployment. ...",
	"summary": "Defender Experts has identified some malicious activity. This incident has been raised for your awareness and should be investigated as normal."
}
```

## Workflow Library Example

[Update Incident with Microsoft Defender Xdr and Send Results Via Email](https://library.blinkops.com/workflows/update-incident-with-microsoft-defender-xdr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/update-incident-with-microsoft-defender-xdr-and-send-results-via-email/canvas" />
</div>