Is it possible to remove an Azure Sentinel incident? The answer is Yes. However, this is not going to be a recommendation for security operation.
Let’s see how to make that happen.
TL;DR: You can skip this article and use the script from here to delete an incident in Azure Sentinel https://github.com/azsec/azure-sentinel-tools/blob/master/scripts/Delete-AzureSentinelIncident.ps1
Again, deleting a security incident is never a recommendation even in a test environment. If you think an incident is a false positive case just close it. Azure Sentinel allows you to close an incident and mark it whether True Positive or False Positive.
What would be a use case for incident removal? I couldn’t think of any case. Perhaps that would fit for adversary who would like to delete an incident after being detected?
Azure Sentinel API – Incident Removal
To delete a specific incident you only need to supply to Azure Sentinel API incident ID, as well as Log Analytics workspace information (Name and Resource Group) or simply a WorkspaceId
The URI is as follows:
https://management.azure.com" + $workspaceId + "/providers/Microsoft.SecurityInsights/cases/" + $IncidentId + "/?api-version=2019-01-01-preview"
- WorkspaceId is the Id of the Log Analytics workspace that Azure Sentinel connects to.
- IncidentId is a unique ID that you can get from running this script
The accepted method to delete an incident is DELETE.
If you want to catch response status code use Invoke-WebRequest instead of Invoke-RestMethod .
For ‘lazy’ people who may work on Linux and love Azure CLI, below is the dirty code spinet to remove an Azure Sentinel incident
ACCESS_TOKEN=$(az account get-access-token --query 'accessToken' -o tsv)
AUTH_HEADER="Authorization: Bearer $ACCESS_TOKEN"
WORKSPACE_ID=$(az monitor log-analytics workspace show --resource-group $RG_NAME \
--workspace-name $WORKSPACE_NAME \
--query 'id' \
curl -X DELETE -H "$AUTH_HEADER" -H "$CONTENT_TYPE" $URI
You need latest Azure CLI to use az monitor log-analytics workspace
Azure Activity Log
You can check Azure activity log. Or use query like below if you have log fed to your workspace
| where OperationNameValue =~ "Microsoft.SecurityInsights/cases/delete"
As of this article the API is still there. However it may get removed in the future.