Edit

New-AzSentinelIncident

  • Reference
Module:
Az.SecurityInsights

Creates or updates the incident.

Syntax

New-AzSentinelIncident
   -ResourceGroupName <String>
   -WorkspaceName <String>
   [-Id <String>]
   [-SubscriptionId <String>]
   [-Classification <IncidentClassification>]
   [-ClassificationComment <String>]
   [-ClassificationReason <IncidentClassificationReason>]
   [-Description <String>]
   [-FirstActivityTimeUtc <DateTime>]
   [-Label <IIncidentLabel[]>]
   [-LastActivityTimeUtc <DateTime>]
   [-OwnerAssignedTo <String>]
   [-OwnerEmail <String>]
   [-OwnerObjectId <String>]
   [-OwnerUserPrincipalName <String>]
   [-ProviderIncidentId <String>]
   [-ProviderName <String>]
   [-Severity <IncidentSeverity>]
   [-Status <IncidentStatus>]
   [-Title <String>]
   [-DefaultProfile <PSObject>]
   [-Confirm]
   [-WhatIf]
   [<CommonParameters>]
New-AzSentinelIncident
   -ResourceGroupName <String>
   -WorkspaceName <String>
   -Incident <IIncident>
   [-Id <String>]
   [-SubscriptionId <String>]
   [-DefaultProfile <PSObject>]
   [-Confirm]
   [-WhatIf]
   [<CommonParameters>]

Description

Creates or updates the incident.

Examples

Example 1: Create an Incident

New-AzSentinelIncident -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Id ((New-Guid).Guid) -Title "NewIncident" -Description "My Description" -Severity Low -Status New

Title          : NewIncident
Description    : My Description
Severity       : Low
Status         : New
Number         : 779
CreatedTimeUtc : 2/3/2022 7:47:03 PM
Name           : c831b5a7-5644-403f-9dc3-96d651e04c6d
Url            : https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/274b1a41-c53c-4092-8d4a-7210f6a44a0c/resourceGroups/cyber-soc/providers/Microsoft.OperationalInsights/workspaces/myworkspace/providers/Microsoft.SecurityInsights/Incidents/c831b5a7-5644-403f-9dc3-96d651e04c6d

This command creates an Incident.

Parameters

-Classification

The reason the incident was closed

Type:IncidentClassification
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ClassificationComment

Describes the reason the incident was closed

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ClassificationReason

The classification reason the incident was closed with

Type:IncidentClassificationReason
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Type:PSObject
Aliases:AzureRMContext, AzureCredential
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Description

The description of the incident

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-FirstActivityTimeUtc

The time of the first activity in the incident

Type:DateTime
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Id

Incident ID

Type:String
Aliases:IncidentId
Position:Named
Default value:(New-Guid).Guid
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Incident

Represents an incident in Azure Security Insights. To construct, see NOTES section for INCIDENT properties and create a hash table.

Type:IIncident
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-Label

List of labels relevant to this incident To construct, see NOTES section for LABEL properties and create a hash table.

Type:IIncidentLabel[]
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-LastActivityTimeUtc

The time of the last activity in the incident

Type:DateTime
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-OwnerAssignedTo

The name of the user the incident is assigned to.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-OwnerEmail

The email of the user the incident is assigned to.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-OwnerObjectId

The object id of the user the incident is assigned to.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-OwnerUserPrincipalName

The user principal name of the user the incident is assigned to.

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ProviderIncidentId

The incident ID assigned by the incident provider

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ProviderName

The name of the source provider that generated the incident

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Severity

The severity of the incident

Type:IncidentSeverity
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Status

The status of the incident

Type:IncidentStatus
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-SubscriptionId

The ID of the target subscription.

Type:String
Position:Named
Default value:(Get-AzContext).Subscription.Id
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Title

The title of the incident

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-WorkspaceName

The name of the workspace.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

Inputs

IIncident

Outputs

IIncident

Notes

ALIASES

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

INCIDENT <IIncident>: Represents an incident in Azure Security Insights.

  • [Etag <String>]: Etag of the azure resource
  • [SystemDataCreatedAt <DateTime?>]: The timestamp of resource creation (UTC).
  • [SystemDataCreatedBy <String>]: The identity that created the resource.
  • [SystemDataCreatedByType <CreatedByType?>]: The type of identity that created the resource.
  • [SystemDataLastModifiedAt <DateTime?>]: The timestamp of resource last modification (UTC)
  • [SystemDataLastModifiedBy <String>]: The identity that last modified the resource.
  • [SystemDataLastModifiedByType <CreatedByType?>]: The type of identity that last modified the resource.
  • [Classification <IncidentClassification?>]: The reason the incident was closed
  • [ClassificationComment <String>]: Describes the reason the incident was closed
  • [ClassificationReason <IncidentClassificationReason?>]: The classification reason the incident was closed with
  • [Description <String>]: The description of the incident
  • [FirstActivityTimeUtc <DateTime?>]: The time of the first activity in the incident
  • [Label <IIncidentLabel[]>]: List of labels relevant to this incident
    • LabelName <String>: The name of the label
  • [LastActivityTimeUtc <DateTime?>]: The time of the last activity in the incident
  • [OwnerAssignedTo <String>]: The name of the user the incident is assigned to.
  • [OwnerEmail <String>]: The email of the user the incident is assigned to.
  • [OwnerObjectId <String>]: The object id of the user the incident is assigned to.
  • [OwnerUserPrincipalName <String>]: The user principal name of the user the incident is assigned to.
  • [ProviderIncidentId <String>]: The incident ID assigned by the incident provider
  • [ProviderName <String>]: The name of the source provider that generated the incident
  • [Severity <IncidentSeverity?>]: The severity of the incident
  • [Status <IncidentStatus?>]: The status of the incident
  • [Title <String>]: The title of the incident

LABEL <IIncidentLabel[]>: List of labels relevant to this incident

  • LabelName <String>: The name of the label