This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 85%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
I and others in my organization are members of "Microsoft Sentinel Contributor" We can usually close the incidents but sometimes we cannot close them. I have verified my role assignments and since I have the role of "Microsoft Sentinel Contributor" I also carry the permissions of the Sentinel Responder role. I have tried to close it using both the old and the new "experience" interfaces. There is no indication that it is locked.
From above description I could understand that you have Microsoft Sentinel Contributor, but still are not able to dismiss some of the incidents.
As according to Microsoft Sentinel roles, permissions, and allowed actions you could manage or dismiss incidents with highlighted roles.
Request you to please collect the F12/Browser trace while reproducing the issue and validate for the behind the scenes errors. Also, if you need more help you may share the trace with me.
Thanks,
Akshay Kaushik
I am following up seeking update on the above issue, were you able to collect and analyze the browser trace. Please do let me know if this did not help.
Thanks,
Akshay Kaushik
I was able to perform the browser trace as suggested. I receive the following error: "
| ⚙ batch?api-version=2020-06-01 | (failed)net::ERR_EMPTY_RESPONSE |
" The following is from the postData field for that error:
"postData": {
"mimeType": "application/json",
"text": "{\"requests\":[{\"content\":{\"etag\":\"\\\"[REDACTED]\\\"\",\"properties\":{\"title\":\"BDS: Baza Recon\",\"description\":\"Detects [REDACTED])\",\"severity\":\"Medium\",\"status\":\"Closed\",\"classification\":\"BenignPositive\",\"classificationReason\":\"SuspiciousButExpected\",\"classificationComment\":\"Recognized behavior acknowledged by the user. \",\"firstActivityTimeUtc\":\"2024-06-04T20:52:03.418Z\",\"lastActivityTimeUtc\":\"2024-06-04T20:52:14.803Z\",\"labels\":[{\"labelName\":\"BDS: Needs Review\",\"labelType\":\"User\"},{\"labelName\":\"Reviewed By Binary Defense\",\"labelType\":\"User\"},{\"labelName\":\"Reviewed by CD\",\"labelType\":\"User\"},{\"labelName\":\"SOC Chat\",\"labelType\":\"User\"}],\"owner\":{\"assignedTo\":null,\"email\":null,\"objectId\":null,\"userPrincipalName\":null,\"ownerType\":null},\"providerIncidentId\":\"5265\",\"providerName\":\"Azure Sentinel\"}},\"httpMethod\":\"PUT\",\"name\":\"[REDACTED]\",\"requestHeaderDetails\":{\"commandName\":\"Microsoft_Azure_Security_Insights.\"},\"url\":\"https://management.azure.com/subscriptions/[REDACTED]/resourceGroups/[REDACTED]/providers/Microsoft.OperationalInsights/workspaces/[REDACTED]/providers/Microsoft.SecurityInsights/incidents/[REDACTED]?api-version=2021-10-01-preview\
&
"response": {
"status": 0,
"statusText": "",
"httpVersion": "",
"headers": [],
"cookies": [],
"content": {
"size": 0,
"mimeType": "x-unknown"
},
"redirectURL": "",
"headersSize": -1,
"bodySize": -1,
"_transferSize": 0,
"_error": "net::ERR_EMPTY_RESPONSE"
},
"serverIPAddress": "",
"startedDateTime": "2024-06-17T15:37:09.399Z",
"time": 3165.539000001445,
"timings": {
"blocked": 3165.539000001445,
"dns": -1,
"ssl": -1,
"connect": -1,
"send": 0,
"wait": 0,
"receive": 0,
"_blocked_queueing": -1
I forwarded the full version of this to my MSP but it has not been addressed.
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
CheckPoint pack inspection of "management.azure.com" was causing this issue. Once we made changes around this we began to be able to close the incidents once again. Not all incidents were affected so this was not an obvious fix.