Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,205 questions
Tasks-Details of the Tasks missing in SecurityIncident table
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 45%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGA%3C/text%3E%3C/svg%3E)
Grace A
1
Reputation point
The Tasks added to an Incident don't have the Details (text added to the Task except the Title) in the SecurityIncident table or any other Table. Where can we find these details?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
Givary-MSFT 34,891 Reputation points Microsoft Employee2024-12-30T06:27:50.7733333+00:00 @Grace A Thank you for reaching out to us, let me research on this ask and revert back.
-
Grace A 1 Reputation point
2024-12-30T21:16:40.21+00:00 Thanks!
Also I checked the API https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-tasks/list?view=rest-securityinsights-2024-09-01
Incident Tasks - List
Service:Sentinel
API Version:2024-09-01
And here i see the Field named "description" which has the information I am looking for
*"type": "Microsoft.SecurityInsights/Incidents/Tasks",* *"properties": {* *"title": "Automotive Threat Matrix - ATM",* ***"description": "<div><span style=\"color: rgba(0, 0, 0, 0.87);\">ATM-T0010</span></div><div><span style=\"color: rgba(0, 0, 0, 0.87);\"><span class=\"ql-cursor\"></span>ATM-T0054</span></div>",*** *"status": "New",*This is missing in the SecurityIncidents table and that should not be the case. Please do not have me use an API to access that one detail.
-
Givary-MSFT 34,891 Reputation points Microsoft Employee
2025-01-02T06:40:47.3433333+00:00 @Grace A Still awaiting response from my team on this. I did come across this API but checking do we store this info in any of the tables.
Sign in to comment
Sign in to answer