Create or update a comment for a given incident.

Note: Only the user or application that created the comment can edit it.

External Documentation

To learn more, visit the Microsoft Sentinel documentation.

​
Parameters

ParameterDescription
EtagThe Etag of the azure resource.
Incident Comment IDIncident comment ID to upsert. If doesn’t exist, creates the comment with the given ID and properties. Otherwise, updates it.
Incident IDThe ID of the incident, can be obtained by using the List Incidents action.
MessageThe comment message.
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Workspace NameThe name of the workspace.

​
Example Output

{
	"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"type": "Microsoft.SecurityInsights/incidents/comments",
	"etag": "0300bf09-0000-0000-0000-5c37296e0000",
	"properties": {
		"message": "Some message",
		"createdTimeUtc": "2019-01-01T13:15:30Z",
		"lastModifiedTimeUtc": "2019-01-04T13:15:30Z",
		"author": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john.doe@contoso.com",
			"userPrincipalName": "john@contoso.com",
			"name": "john doe"
		}
	}
}

​
Workflow Library Example

Create or Update Incident Comment with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?