Skip to content

Commit 47b30e1

Browse files
committed
Final changes
1 parent 25ff456 commit 47b30e1

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

articles/sentinel/delete-incident.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,15 +70,15 @@ DELETE https://management.azure.com/subscriptions/{subscriptionId}/resourceGroup
7070

7171
## Notes
7272

73-
- The incident delete operation is not reversible! After you delete an incident, the only reference to it will be the audit data in the *SecurityIncident* table in the Logs screen. (See the [table's schema documentation in Log Analytics](/azure/azure-monitor/reference/tables/securityincident)). The *Status* field in that table will be updated to "Deleted" for that incident.
73+
- To delete an incident, you must have the [**Microsoft Sentinel Contributor**](roles.md) role.
74+
75+
- Deleting an incident is not reversible! After you delete an incident, the only reference to it will be the audit data in the *SecurityIncident* table in the Logs screen. (See the [table's schema documentation in Log Analytics](/azure/azure-monitor/reference/tables/securityincident)). The *Status* field in that table will be updated to "Deleted" for that incident.
7476

7577
> [!NOTE]
7678
>
7779
> Due to the 64 KB limit of the record size in the *SecurityIncident* table, incident comments may be truncated (beginning from the earliest) if the limit is exceeded.
7880
79-
- This operation requires a [Microsoft Sentinel Contributor](roles.md) role.
80-
81-
- This operation is not available for [incidents imported from and synchronized with Microsoft 365 Defender](microsoft-365-defender-sentinel-integration.md).
81+
- You can't delete incidents from within Microsoft Sentinel that were [imported from and synchronized with Microsoft 365 Defender](microsoft-365-defender-sentinel-integration.md).
8282

8383
- If an alert [related to a deleted incident](relate-alerts-to-incidents.md) gets updated, or if a new alert is grouped under a deleted incident, a new incident will be created to replace the deleted one.
8484

0 commit comments

Comments
 (0)