Get Incident Comment - BlinkOps Documentation

Get a comment for a given incident.

External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

Parameters

Parameter	Description
Incident Comment ID	The ID of the incident comment.
Incident ID	The ID of the incident, can be obtained by using the `List Incidents` action.
Resource Group Name	The name of the resource group. The name is case insensitive.
Subscription ID	The ID of the target subscription.
Workspace Name	The name of the workspace.

Example Output

{
	"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"type": "Microsoft.SecurityInsights/incidents/comments",
	"etag": "0300bf09-0000-0000-0000-5c37296e0000",
	"properties": {
		"message": "Some message",
		"createdTimeUtc": "2019-01-01T13:15:30Z",
		"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
		"author": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john.doe@contoso.com",
			"userPrincipalName": "john@contoso.com",
			"name": "john doe"
		}
	}
}

Workflow Library Example

Get Incident Comment with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Get Incident Get Indicator

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example