Incidents - Create Or Update

Service:: Sentinel

API Version:: 2025-09-01

Creates or updates an incident.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}?api-version=2025-09-01

URI Parameters

Name	In	Required	Type	Description
incidentId	path	True	string	Incident ID
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string minLength: 1 maxLength: 90 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Required	Type	Description
properties.severity	True	IncidentSeverity	The severity of the incident
properties.status	True	IncidentStatus	The status of the incident
properties.title	True	string	The title of the incident
etag		string	Etag of the azure resource
properties.classification		IncidentClassification	The reason the incident was closed
properties.classificationComment		string	Describes the reason the incident was closed
properties.classificationReason		IncidentClassificationReason	The classification reason the incident was closed with
properties.description		string	The description of the incident
properties.firstActivityTimeUtc		string (date-time)	The time of the first activity in the incident
properties.labels		IncidentLabel[]	List of labels relevant to this incident
properties.lastActivityTimeUtc		string (date-time)	The time of the last activity in the incident
properties.owner		IncidentOwnerInfo	Describes a user that the incident is assigned to

Responses

Name	Type	Description
200 OK	Incident	OK, Operation successfully completed
201 Created	Incident	Created
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Creates or updates an incident.

Sample request

HTTP

PUT https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2025-09-01

{
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
    "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
    "description": "This is a demo incident",
    "title": "My incident",
    "owner": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
    },
    "severity": "High",
    "classification": "FalsePositive",
    "classificationComment": "Not a malicious activity",
    "classificationReason": "IncorrectAlertLogic",
    "status": "Closed"
  }
}

Sample response

Status code:: 200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/incidents",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
  "properties": {
    "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
    "createdTimeUtc": "2019-01-01T13:15:30Z",
    "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
    "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
    "description": "This is a demo incident",
    "title": "My incident",
    "owner": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john.doe@contoso.com",
      "userPrincipalName": "john@contoso.com",
      "assignedTo": "john doe"
    },
    "severity": "High",
    "classification": "FalsePositive",
    "classificationComment": "Not a malicious activity",
    "classificationReason": "IncorrectAlertLogic",
    "status": "Closed",
    "incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    "incidentNumber": 3177,
    "labels": [],
    "providerName": "Azure Sentinel",
    "providerIncidentId": "3177",
    "relatedAnalyticRuleIds": [],
    "additionalData": {
      "alertsCount": 0,
      "bookmarksCount": 0,
      "commentsCount": 3,
      "alertProductNames": [],
      "tactics": []
    }
  }
}

Status code:: 201

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/incidents",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
  "properties": {
    "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
    "createdTimeUtc": "2019-01-01T13:15:30Z",
    "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
    "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
    "description": "This is a demo incident",
    "title": "My incident",
    "owner": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john.doe@contoso.com",
      "userPrincipalName": "john@contoso.com",
      "assignedTo": "john doe"
    },
    "severity": "High",
    "classification": "FalsePositive",
    "classificationComment": "Not a malicious activity",
    "classificationReason": "IncorrectAlertLogic",
    "status": "Closed",
    "incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
    "incidentNumber": 3177,
    "labels": [],
    "providerName": "Azure Sentinel",
    "providerIncidentId": "3177",
    "relatedAnalyticRuleIds": [],
    "additionalData": {
      "alertsCount": 0,
      "bookmarksCount": 0,
      "commentsCount": 3,
      "alertProductNames": [],
      "tactics": []
    }
  }
}

Definitions

Name	Description
AttackTactic	The severity for alerts created by this alert rule.
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
Incident	Represents an incident in Azure Security Insights.
IncidentAdditionalData	Incident additional data property bag.
IncidentClassification	The reason the incident was closed
IncidentClassificationReason	The classification reason the incident was closed with
IncidentLabel	Represents an incident label
IncidentLabelType	The type of the label
IncidentOwnerInfo	Information on the user an incident is assigned to
IncidentSeverity	The severity of the incident
IncidentStatus	The status of the incident
OwnerType	The type of the owner the incident is assigned to.
systemData	Metadata pertaining to creation and last modification of the resource.

AttackTactic

Enumeration

The severity for alerts created by this alert rule.

Value	Description
Reconnaissance
ResourceDevelopment
InitialAccess
Execution
Persistence
PrivilegeEscalation
DefenseEvasion
CredentialAccess
Discovery
LateralMovement
Collection
Exfiltration
CommandAndControl
Impact
PreAttack
ImpairProcessControl
InhibitResponseFunction

CloudError

Object

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Object

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

Incident

Object

Represents an incident in Azure Security Insights.

Name	Type	Description
etag	string	Etag of the azure resource
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name	string	The name of the resource
properties.additionalData	IncidentAdditionalData	Additional data on the incident
properties.classification	IncidentClassification	The reason the incident was closed
properties.classificationComment	string	Describes the reason the incident was closed
properties.classificationReason	IncidentClassificationReason	The classification reason the incident was closed with
properties.createdTimeUtc	string (date-time)	The time the incident was created
properties.description	string	The description of the incident
properties.firstActivityTimeUtc	string (date-time)	The time of the first activity in the incident
properties.incidentNumber	integer (int32)	A sequential number
properties.incidentUrl	string	The deep-link url to the incident in Azure portal
properties.labels	IncidentLabel[]	List of labels relevant to this incident
properties.lastActivityTimeUtc	string (date-time)	The time of the last activity in the incident
properties.lastModifiedTimeUtc	string (date-time)	The last time the incident was updated
properties.owner	IncidentOwnerInfo	Describes a user that the incident is assigned to
properties.providerIncidentId	string	The incident ID assigned by the incident provider
properties.providerName	string	The name of the source provider that generated the incident
properties.relatedAnalyticRuleIds	string[] (arm-id)	List of resource ids of Analytic rules related to the incident
properties.severity	IncidentSeverity	The severity of the incident
properties.status	IncidentStatus	The status of the incident
properties.title	string	The title of the incident
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

IncidentAdditionalData

Object

Incident additional data property bag.

Name	Type	Description
alertProductNames	string[]	List of product names of alerts in the incident
alertsCount	integer (int32)	The number of alerts in the incident
bookmarksCount	integer (int32)	The number of bookmarks in the incident
commentsCount	integer (int32)	The number of comments in the incident
providerIncidentUrl	string	The provider incident url to the incident in Microsoft 365 Defender portal
tactics	AttackTactic[]	The tactics associated with incident

IncidentClassification

Enumeration

The reason the incident was closed

Value	Description
Undetermined	Incident classification was undetermined
TruePositive	Incident was true positive
BenignPositive	Incident was benign positive
FalsePositive	Incident was false positive

IncidentClassificationReason

Enumeration

The classification reason the incident was closed with

Value	Description
SuspiciousActivity	Classification reason was suspicious activity
SuspiciousButExpected	Classification reason was suspicious but expected
IncorrectAlertLogic	Classification reason was incorrect alert logic
InaccurateData	Classification reason was inaccurate data

IncidentLabel

Object

Represents an incident label

Name	Type	Description
labelName	string	The name of the label
labelType	IncidentLabelType	The type of the label

IncidentLabelType

Enumeration

The type of the label

Value	Description
User	Label manually created by a user
AutoAssigned	Label automatically created by the system

IncidentOwnerInfo

Object

Information on the user an incident is assigned to

Name	Type	Description
assignedTo	string	The name of the user the incident is assigned to.
email	string	The email of the user the incident is assigned to.
objectId	string (uuid)	The object id of the user the incident is assigned to.
ownerType	OwnerType	The type of the owner the incident is assigned to.
userPrincipalName	string	The user principal name of the user the incident is assigned to.

IncidentSeverity

Enumeration

The severity of the incident

Value	Description
High	High severity
Medium	Medium severity
Low	Low severity
Informational	Informational severity

IncidentStatus

Enumeration

The status of the incident

Value	Description
New	An active incident which isn't being handled currently
Active	An active incident which is being handled
Closed	A non-active incident

OwnerType

Enumeration

The type of the owner the incident is assigned to.

Value	Description
Unknown	The incident owner type is unknown
User	The incident owner type is an AAD user
Group	The incident owner type is an AAD group

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

Share via

Incidents - Create Or Update

URI Parameters

Request Body

Responses

Security

azure_auth

Scopes

Examples

Creates or updates an incident.

Sample request

Sample response

Definitions

AttackTactic

CloudError

CloudErrorBody

createdByType

Incident

IncidentAdditionalData

IncidentClassification

IncidentClassificationReason

IncidentLabel

IncidentLabelType

IncidentOwnerInfo

IncidentSeverity

IncidentStatus

OwnerType

systemData