Hi To export our Incidents, I'm currently using the Sentinel Rest API, Incidents endpoint. V 2021-10-01. Instead of doing a full load of all incidents each day, I've implemented a filter in the request $filter= properties/lastModifiedTimeUtc gt 'TodaysDate'. This gives me all new and changed Incidents. I then merge these with yesterday's load to get the full picture. But this does not include deleted incidents. Any way to get information about these -without doing a full load of all incidents? (I will be on holiday until Jan 3.) Thanks!

There is no deleted incidents option. All are records in log analytics which is largely immutable. You can resolve but not delete.

Sentinel REST API - Deleted Incidents

Accepted answer

Andrew Blumhardt 9,496 Reputation points Microsoft Employee

2022-12-23T06:05:19.103+00:00

There is no deleted incidents option. All are records in log analytics which is largely immutable. You can resolve but not delete.
Please sign in to rate this answer.
JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2022-12-29T17:16:29.023+00:00

@Frederik Larsen
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Frederik Larsen 76 Reputation points

2023-01-02T08:06:12.37+00:00

Hi Andrew
You can delete incidents in Sentinel ? Please see picture below:

Andrew Blumhardt 9,496 Reputation points Microsoft Employee

2023-01-03T05:59:34.983+00:00

Wow. That slipped past me thanks.

It may be that the API does not return deleted incidents. You could test with a filter on Status = Deleted.

You could also query the SecurityIncidents table directly using arg_max to get the most recent records.

SecurityIncident
| summarize arg_max(TimeGenerated, *) by ProviderIncidentId

https://learn.microsoft.com/en-us/rest/api/loganalytics/dataaccess/query/get?tabs=HTTP

Frederik Larsen 76 Reputation points

2023-01-03T13:59:00.95+00:00

Thanks for pointing me in this direction.
I also just learned; When deleting an incident you are prompted with the following: "After you delete an incident, the only reference to it will be the audit data in the SecurityIncident table in the Logs screen. (See the table's schema documentation in Log Analytics). The Status field in that table will be updated to "Deleted" for that incident."

So the right way to load Incidents data for my purpose would be to read the SecurityIncident table rather than going via the Sentinel API.

Well hidden, I also now found this documentation which tells more about deletion behavior:
https://learn.microsoft.com/en-us/azure/sentinel/delete-incident
Sign in to comment

Sentinel REST API - Deleted Incidents

0 additional answers