Create Or Update Incident Comment

External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

Parameters

Parameter	Description
Etag	The Etag of the azure resource.
Incident Comment ID	Incident comment ID to upsert. If doesn’t exist, creates the comment with the given ID and properties. Otherwise, updates it.
Incident ID	The ID of the incident, can be obtained by using the `List Incidents` action.
Message	The comment message.
Resource Group Name	The name of the resource group. The name is case insensitive.
Subscription ID	The ID of the target subscription.
Workspace Name	The name of the workspace.

Example Output

{
	"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"type": "Microsoft.SecurityInsights/incidents/comments",
	"etag": "0300bf09-0000-0000-0000-5c37296e0000",
	"properties": {
		"message": "Some message",
		"createdTimeUtc": "2019-01-01T13:15:30Z",
		"lastModifiedTimeUtc": "2019-01-04T13:15:30Z",
		"author": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john.doe@contoso.com",
			"userPrincipalName": "john@contoso.com",
			"name": "john doe"
		}
	}
}

Integrations

Parameters

Example Output

Workflow Library Example

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example