Incident Comments - List By Incident

Reference

Service:: Sentinel

API Version:: 2020-01-01

Gets all incident comments.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments?api-version=2020-01-01

With optional parameters:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments?api-version=2020-01-01&$filter={$filter}&$orderby={$orderby}&$top={$top}&$skipToken={$skipToken}

URI Parameters

Name	In	Required	Type	Description
incidentId	path	True	string	Incident ID
resourceGroupName	path	True	string	The name of the resource group within the user's subscription. The name is case insensitive. Regex pattern: `^[-\w\._]+$`
subscriptionId	path	True	string	Azure subscription ID Regex pattern: `^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$`
workspaceName	path	True	string	The name of the workspace.
api-version	query	True	string	API version for the operation
$filter	query		string	Filters the results, based on a Boolean condition. Optional.
$orderby	query		string	Sorts the results. Optional.
$skipToken	query		string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
$top	query		integer int32	Returns only the first n results. Optional.

Responses

Name	Type	Description
200 OK	IncidentCommentList	OK, Operation successfully completed
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get all incident comments.

Sample Request

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments?api-version=2020-01-01

Sample Response

Status code:: 200

{
  "value": [
    {
      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
      "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
      "type": "Microsoft.SecurityInsights/incidents/comments",
      "properties": {
        "message": "Some message",
        "createdTimeUtc": "2019-01-01T13:15:30Z",
        "author": {
          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
          "email": "john.doe@contoso.com",
          "userPrincipalName": "john@contoso.com",
          "name": "john doe"
        }
      }
    }
  ]
}

Definitions

Name	Description
ClientInfo	Information on the client (user or application) that made some action
CloudError	An error response for a resource management request.
ErrorAdditionalInfo	The resource management error additional info.
ErrorResponse	Error Response
IncidentComment	Represents an incident comment
IncidentCommentList	List of incident comments.

ClientInfo

Information on the client (user or application) that made some action

Name	Type	Description
email	string	The email of the client.
name	string	The name of the client.
objectId	string	The object id of the client.
userPrincipalName	string	The user principal name of the client.

CloudError

An error response for a resource management request.

Name	Type	Description
error	ErrorResponse	Error Response The error object of the CloudError response

ErrorAdditionalInfo

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorResponse

Error Response

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorResponse[]	The error details.
message	string	The error message.
target	string	The error target.

IncidentComment

Represents an incident comment

Name	Type	Description
id	string	Azure resource Id
name	string	Azure resource name
properties.author	ClientInfo	Describes the client that created the comment
properties.createdTimeUtc	string	The time the comment was created
properties.message	string	The comment message
type	string	Azure resource type

IncidentCommentList

List of incident comments.

Name	Type	Description
nextLink	string	URL to fetch the next set of comments.
value	IncidentComment[]	Array of comments.