Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,056 questions
I and others in my organization are members of "Microsoft Sentinel Contributor" but sometimes we cannot close Sentinel Incidents
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 85%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
JCrockett
0
Reputation points
I and others in my organization are members of "Microsoft Sentinel Contributor" We can usually close the incidents but sometimes we cannot close them. I have verified my role assignments and since I have the role of "Microsoft Sentinel Contributor" I also carry the permissions of the Sentinel Responder role. I have tried to close it using both the old and the new "experience" interfaces. There is no indication that it is locked.
{count} votes
-
Akshay-MSFT 17,651 Reputation points Microsoft Employee2024-06-06T08:59:30.2866667+00:00 From above description I could understand that you have Microsoft Sentinel Contributor, but still are not able to dismiss some of the incidents.
As according to Microsoft Sentinel roles, permissions, and allowed actions you could manage or dismiss incidents with highlighted roles.
Request you to please collect the F12/Browser trace while reproducing the issue and validate for the behind the scenes errors. Also, if you need more help you may share the trace with me.
Thanks,
Akshay Kaushik
-
Akshay-MSFT 17,651 Reputation points Microsoft Employee
2024-06-11T06:50:21.5366667+00:00 I am following up seeking update on the above issue, were you able to collect and analyze the browser trace. Please do let me know if this did not help.
Thanks,
Akshay Kaushik
-
JCrockett 0 Reputation points
2024-06-17T15:53:46.1266667+00:00 I was able to perform the browser trace as suggested. I receive the following error: "
⚙ batch?api-version=2020-06-01 (failed)net::ERR_EMPTY_RESPONSE " The following is from the postData field for that error:
"postData": {
"mimeType": "application/json", "text": "{\"requests\":[{\"content\":{\"etag\":\"\\\"[REDACTED]\\\"\",\"properties\":{\"title\":\"BDS: Baza Recon\",\"description\":\"Detects [REDACTED])\",\"severity\":\"Medium\",\"status\":\"Closed\",\"classification\":\"BenignPositive\",\"classificationReason\":\"SuspiciousButExpected\",\"classificationComment\":\"Recognized behavior acknowledged by the user. \",\"firstActivityTimeUtc\":\"2024-06-04T20:52:03.418Z\",\"lastActivityTimeUtc\":\"2024-06-04T20:52:14.803Z\",\"labels\":[{\"labelName\":\"BDS: Needs Review\",\"labelType\":\"User\"},{\"labelName\":\"Reviewed By Binary Defense\",\"labelType\":\"User\"},{\"labelName\":\"Reviewed by CD\",\"labelType\":\"User\"},{\"labelName\":\"SOC Chat\",\"labelType\":\"User\"}],\"owner\":{\"assignedTo\":null,\"email\":null,\"objectId\":null,\"userPrincipalName\":null,\"ownerType\":null},\"providerIncidentId\":\"5265\",\"providerName\":\"Azure Sentinel\"}},\"httpMethod\":\"PUT\",\"name\":\"[REDACTED]\",\"requestHeaderDetails\":{\"commandName\":\"Microsoft_Azure_Security_Insights.\"},\"url\":\"https://management.azure.com/subscriptions/[REDACTED]/resourceGroups/[REDACTED]/providers/Microsoft.OperationalInsights/workspaces/[REDACTED]/providers/Microsoft.SecurityInsights/incidents/[REDACTED]?api-version=2021-10-01-preview\&
"response": { "status": 0, "statusText": "", "httpVersion": "", "headers": [], "cookies": [], "content": { "size": 0, "mimeType": "x-unknown" }, "redirectURL": "", "headersSize": -1, "bodySize": -1, "_transferSize": 0, "_error": "net::ERR_EMPTY_RESPONSE" }, "serverIPAddress": "", "startedDateTime": "2024-06-17T15:37:09.399Z", "time": 3165.539000001445, "timings": { "blocked": 3165.539000001445, "dns": -1, "ssl": -1, "connect": -1, "send": 0, "wait": 0, "receive": 0, "_blocked_queueing": -1I forwarded the full version of this to my MSP but it has not been addressed.
Sign in to comment
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more