Share via

Extract Incidents from Sentinel

Shital Khatri - AzureAdmin 101 Reputation points
2021-11-26T09:24:04.907+00:00

Dear Team,

Kindly guide me how can I extract the Incidents from Azure Sentinel. 152730-1.png

Microsoft Security | Microsoft Sentinel
0 comments
Answer accepted by question author
  1. George Moise 2,361 Reputation points Microsoft Employee
    2021-11-26T09:46:14.74+00:00

    Hello,

    The Incidents generated in Azure Sentinel are stored in a Table inside the Log Analytics Workspace where Sentinel is enabled.
    This means, that you can execute a query to list the incidents, then export the results (if this is what you want to achieve):

    Query sample:

    SecurityIncident
    | where TimeGenerated > ago(24h)
    | project IncidentNumber,TimeGenerated, Title, Description, Severity, Status

    Hope this helps!

    BR,
    George

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.