Sentinel REST API - Deleted Incidents

Question

Sentinel REST API - Deleted Incidents

Frederik Larsen 76

Hi

To export our Incidents, I'm currently using the Sentinel Rest API, Incidents endpoint. V 2021-10-01.

Instead of doing a full load of all incidents each day, I've implemented a filter in the request $filter= properties/lastModifiedTimeUtc gt 'TodaysDate'.
This gives me all new and changed Incidents. I then merge these with yesterday's load to get the full picture.

But this does not include deleted incidents. Any way to get information about these -without doing a full load of all incidents?

(I will be on holiday until Jan 3.)

Thanks!

Givary-MSFT 35,471 Reputation points Microsoft Employee

2022-12-23T03:56:02.02+00:00

@Frederik Larsen Thank you for reaching out to us, let me research on your ask and will revert back.

Accepted answer

0 additional answers

Your answer

Givary-MSFT 35,471 Reputation points Microsoft Employee

2022-12-23T03:56:02.02+00:00

@Frederik Larsen Thank you for reaching out to us, let me research on your ask and will revert back.

Answer 1

Andrew Blumhardt 9,951 Microsoft Employee

There is no deleted incidents option. All are records in log analytics which is largely immutable. You can resolve but not delete.

JamesTran-MSFT 36,841 Reputation points Microsoft Employee

2022-12-29T17:16:29.023+00:00

@Frederik Larsen
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Frederik Larsen 76 Reputation points

2023-01-02T08:06:12.37+00:00

Hi Andrew
You can delete incidents in Sentinel ? Please see picture below:
Andrew Blumhardt 9,951 Reputation points Microsoft Employee

2023-01-03T05:59:34.983+00:00

Wow. That slipped past me thanks.

It may be that the API does not return deleted incidents. You could test with a filter on Status = Deleted.

You could also query the SecurityIncidents table directly using arg_max to get the most recent records.

SecurityIncident
| summarize arg_max(TimeGenerated, *) by ProviderIncidentId

https://learn.microsoft.com/en-us/rest/api/loganalytics/dataaccess/query/get?tabs=HTTP
Frederik Larsen 76 Reputation points

2023-01-03T13:59:00.95+00:00

Thanks for pointing me in this direction.
I also just learned; When deleting an incident you are prompted with the following: "After you delete an incident, the only reference to it will be the audit data in the SecurityIncident table in the Logs screen. (See the table's schema documentation in Log Analytics). The Status field in that table will be updated to "Deleted" for that incident."

So the right way to load Incidents data for my purpose would be to read the SecurityIncident table rather than going via the Sentinel API.

Well hidden, I also now found this documentation which tells more about deletion behavior:
https://learn.microsoft.com/en-us/azure/sentinel/delete-incident

Share via

Sentinel REST API - Deleted Incidents

0 additional answers

Your answer