Skip to main content
Get a comment for a given incident.
External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

​
Parameters

ParameterDescription
Incident Comment IDThe ID of the incident comment.
Incident IDThe ID of the incident, can be obtained by using the List Incidents action.
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Workspace NameThe name of the workspace.

​
Example Output

{
	"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
	"type": "Microsoft.SecurityInsights/incidents/comments",
	"etag": "0300bf09-0000-0000-0000-5c37296e0000",
	"properties": {
		"message": "Some message",
		"createdTimeUtc": "2019-01-01T13:15:30Z",
		"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
		"author": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john.doe@contoso.com",
			"userPrincipalName": "john@contoso.com",
			"name": "john doe"
		}
	}
}

​
Workflow Library Example

Get Incident Comment with Microsoft Sentinel and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I