Skip to content

Commit fa04719

Browse files
CSOAR-3221 : modified content
1 parent ebca7a3 commit fa04719

File tree

1 file changed

+12
-11
lines changed

1 file changed

+12
-11
lines changed

docs/platform-services/automation-service/app-central/integrations/microsoft-sentinel.md

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@ Microsoft Sentinel is a cloud-native security information and event manager (SIE
1515

1616
### Purpose
1717

18-
This documentation outlines the Microsoft Sentinel integration, providing details on its capabilities, usage, and support for managing security incidents and automating responses within Microsoft Sentinel.
18+
This documentation outlines the Microsoft Sentinel integration, providing details on its capabilities, usage, and support for managing security incidents.
1919

2020
### Use cases
2121

2222
* Automatically fetch and process security incidents from Sentinel.
23-
* Enrich incidents with contextual data from third-party sources.
24-
* Trigger automated containment actions such as disabling users or isolating machines.
25-
* Provide a unified security operations view through integration with external systems.
23+
* Review incident details, comments, and related entities to streamline triage.
24+
* Trigger automated incident management workflows, such as updating incident status, severity, or ownership using Update Incident, or adding context through Add Incident Comment.
25+
* Remove false positives or resolved alerts by leveraging the Delete Incident action.
2626

2727
### Supported Versions
2828

@@ -94,13 +94,14 @@ For information about Microsoft Sentinel, see [Microsoft Sentinel documentation]
9494
## API Reference
9595
### Configuration
9696
Environment variables or parameters:
97-
* tenant_id
98-
* client_id
99-
* client_secret
100-
* subscription_id
101-
* resource_group
102-
* workspace_name
103-
* Optional: api_root, login_endpoint, proxy, verify_ssl
97+
* tenant
98+
* client id
99+
* client secret
100+
* subscription id
101+
* resource group
102+
* workspace name
103+
* automation bridge
104+
* Optional: api root, login endpoint, proxy, verify_ssl, CSOAR API URL, Access ID, Access Key
104105

105106
### Containment APIs
106107
#### Update Incident

0 commit comments

Comments
 (0)