Tag Archives: azure sentinel incident

Get Alert Relation from an Incident using Azure Sentinel Incident Relation API

Posted on 07/15/2020 by azsec

I have a few questions recently asking if we can get an associated alert for an incident. The idea is to know which alert that caused an incident so SecOps team could better investigate the issue. In this article, let’s … Continue reading →

Posted in Security Automation | Tagged , , | Leave a comment

Transform Azure Sentinel incident to Log Analytics Workspace with Logic App

Posted on 07/08/2020 by azsec

As a SOC Analyst or Manager who are working on Azure Sentinel you would like to have a view of how productive your team is (response time, resolution..). As being familiar with Log Analytics query, you might wish to do … Continue reading →

Posted in Security Automation | Tagged , , | 1 Comment

Quick look at new Azure Sentinel Incident API

Posted on 03/18/2020 by azsec

I got some questions from people who worked with Microsoft product team about the new incident API they were introduced. I took a glance at it and thought I would need to write something about it, especially wrote a new … Continue reading →

Posted in Security Automation | Tagged , | 8 Comments

Get all comments in an Azure Sentinel incident programmatically

Posted on 01/27/2020 by azsec

For any kind of report you may want to get all comments in an Azure Sentinel in order to archive as an forensic or incident artifact in an incident case before it is closed. Even comments in Azure Sentinel is … Continue reading →

Posted in Security Automation | Tagged , , | Leave a comment

Demystify alert generated by Azure Sentinel versus other 3rd products

Posted on 01/12/2020 by azsec

There is a question in the community asking about alert field in Incident page, along with the question about what it meant. In this article, let’s talk about that and see how to distinguish between alert generated from Azure Sentinel … Continue reading →

Posted in Security Operation | Tagged , , | 1 Comment

Extract all Azure Sentinel incidents

Posted on 12/16/2019 by azsec

I got asked by a few readers after reading this article if there was a way to extract all incidents in Azure Sentinel so they could conduct a report and send out to their managers. In this article, let’s see … Continue reading →

Posted in Security Automation | Tagged , , | 5 Comments