Skip to content

Commit 00f3af8

Browse files
yelevinyelevin
committed
Continued work 5
1 parent fd6a025 commit 00f3af8

File tree

3 files changed

+82
-4
lines changed

3 files changed

+82
-4
lines changed

‎articles/sentinel/media/relate-alerts-to-incidents/add-alert-using-playbook.png

44.5 KB
Loading

‎articles/sentinel/relate-alerts-to-incidents.md

Lines changed: 69 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ When adding an alert to an incident, depending on the circumstances, you might b
6868

6969
In this case you'll see a message that the alert is part of another incident or incidents, and asked if you want to proceed. Select **OK** to add the alert or **Cancel** to leave things as they were.
7070

71-
Adding the alert to this incident *will not remove it* from any other incidents. Alerts can be related to more than one incident.
71+
Adding the alert to this incident *will not remove it* from any other incidents. Alerts can be related to more than one incident. If you want, you can remove the alert manually from the other incident(s) by following the link(s) in the message prompt above.
7272

7373
- The alert you want to add belongs to another incident, and it's the only alert in the other incident.
7474

@@ -92,8 +92,73 @@ When adding an alert to an incident, depending on the circumstances, you might b
9292

9393
- An incident can contain a maximum of 150 alerts. If you try to add an alert to an incident with 150 alerts in it, you will get an error message.
9494

95+
## Add/remove alerts using playbooks
96+
97+
Adding and removing alerts to incidents are also available as actions in Logic Apps, and therefore in Microsoft Sentinel playbooks.
98+
99+
Here's an example of using the **Add alert to incident (Preview)** action in a playbook:
100+
101+
:::image type="content" source="media/relate-alerts-to-incidents/add-alert-using-playbook.png" alt-text="Screenshot of adding an alert to an incident using a playbook action.":::
102+
103+
## Add/remove alerts using the API
104+
105+
You're not limited to the portal to use this feature. It's also accessible through the Microsoft Sentinel API, through the [Incident relations](/rest/api/securityinsights/preview/incident-relations) operation group. It allows you to get, create, update, and delete relationships between alerts and incidents.
106+
107+
### Create a relationship
108+
109+
You add an alert to an incident by creating a relationship between them. Use the following endpoint to add an alert to an existing incident. After this request is made, the alert joins the incident and will be visible in the list of alerts in the incident in the portal.
110+
111+
```http
112+
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/Incidents/{incidentId}/relations/{incidentId}_{SystemAlertId}?api-version=2019-01-01-preview
113+
114+
```
115+
116+
The request body looks like this:
117+
118+
```json
119+
{
120+
"properties": {
121+
"relatedResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{alertSystemId}"
122+
}
123+
}
124+
```
125+
126+
### Delete a relationship
127+
128+
You remove an alert from an incident by deleting the relationship between them. Use the following endpoint to remove an alert from an existing incident. After this request is made, the alert will no longer be connected to or appear in the incident.
129+
130+
```http
131+
DELETE https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/Incidents/{incidentId}/relations/{incidentId}_{SystemAlertId }?api-version=2019-01-01-preview
132+
133+
```
134+
135+
### List alert relationships
136+
137+
You can also list all the alerts that are related to a particular incident, with this endpoint and request:
138+
139+
```http
140+
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/Incidents/{incidentId}/relations?api-version=2019-01-01-preview
141+
142+
```
143+
144+
### Expected responses
145+
146+
Here are the possible response codes and results of these requests:
147+
148+
| Code | Response | Result of operation |
149+
| ------- | ---------- | ------------------- |
150+
| **204** | No content | Success |
151+
| **400** | BadRequest | Failed to create relation. Different relation type with name {relationName} already exists in incident {incidentIdentifier}. |
152+
| **400** | BadRequest | Failed to create relation. Alert {systemAlertId} already exists in incident {incidentIdentifier}. |
153+
| **400** | BadRequest | Failed to create relation. Related resource and incident should belong to the same workspace. |
154+
| **400** | BadRequest | Failed to create relation. Microsoft 365 Defender alerts cannot be added to Microsoft 365 Defender incidents. |
155+
| **400** | BadRequest | Failed to delete relation. Microsoft 365 Defender alerts cannot be removed from Microsoft 365 Defender incidents. |
156+
| **409** | Conflict | Failed to create relation. Relation with name {relationName} already exists in incident {incidentIdentifier} to different alert {relationAlertId}. |
157+
| **404** | Not found | Resource '{alertId}' does not exist. |
158+
| **404** | Not found | Incident doesn’t exist. |
159+
95160
## Next steps
96-
In this article, you learned how to get started investigating incidents using Microsoft Sentinel. For more information, see:
161+
In this article, you learned how to add alerts to incidents and remove them using the Microsoft Sentinel portal and API. For more information, see:
97162

98-
- [Tutorial: Use playbooks with automation rules in Microsoft Sentinel](tutorial-respond-threats-playbook.md)
99-
- [Investigate incidents with UEBA data](investigate-with-ueba.md)
163+
- [Investigate incidents with Microsoft Sentinel](investigate-cases.md)
164+
- [Incident relations group in the Microsoft Sentinel REST API](/rest/api/securityinsights/preview/incident-relations)

‎articles/sentinel/whats-new.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,19 @@ If you're looking for items older than six months, you'll find them in the [Arch
2727
>
2828
> You can also contribute! Join us in the [Microsoft Sentinel Threat Hunters GitHub community](https://github.com/Azure/Azure-Sentinel/wiki).
2929
30+
## May 2022
31+
32+
- [Relate alerts to incidents](#relate-alerts-to-incidents)
33+
- [Similar incidents](#similar-incidents)
34+
35+
### Relate alerts to incidents
36+
37+
### Similar incidents
38+
39+
## April 2022
40+
41+
42+
3043
## March 2022
3144

3245
- [Automation rules now generally available](#automation-rules-now-generally-available)

0 commit comments

Comments
 (0)