Skip to main content

List Incidents

Gets all incidents.

External Documentation

To learn more, visit the Microsoft Sentinel documentation.

Basic Parameters​

ParameterDescription
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Workspace NameThe name of the workspace. Use the Log Analytics List Workspaces action to get workspace names.

Advanced Parameters​

ParameterDescription
FilterFilters the results, based on a Boolean condition.
Order BySorts the results.
Skip TokenSkip token is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skip token parameter that specifies a starting point to use for subsequent calls.
TopReturns only the first n results.

Example Output​

{
    "value": [
        {
            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
            "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
            "type": "Microsoft.SecurityInsights/incidents",
            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
            "properties": {
                "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
                "createdTimeUtc": "2019-01-01T13:15:30Z",
                "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
                "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
                "description": "This is a demo incident",
                "title": "My incident",
                "owner": {
                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
                    "email": "john.doe@contoso.com",
                    "userPrincipalName": "john@contoso.com",
                    "assignedTo": "john doe"
                },
                "severity": "High",
                "classification": "FalsePositive",
                "classificationComment": "Not a malicious activity",
                "classificationReason": "IncorrectAlertLogic",
                "status": "Closed",
                "incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                "incidentNumber": 3177,
                "labels": [],
                "relatedAnalyticRuleIds": [
                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
                ],
                "additionalData": {
                    "alertsCount": 0,
                    "bookmarksCount": 0,
                    "commentsCount": 3,
                    "alertProductNames": [],
                    "tactics": [
                        "Persistence"
                    ]
                }
            }
        }
    ]
}

Workflow Library Example​

List Incidents with Microsoft Sentinel and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop