Edit

Get-AzSentinelIncidentBookmark

  • Reference
Module:
Az.SecurityInsights

Gets all incident bookmarks.

Syntax

Get-AzSentinelIncidentBookmark
   -IncidentId <String>
   -ResourceGroupName <String>
   -WorkspaceName <String>
   [-SubscriptionId <String[]>]
   [-DefaultProfile <PSObject>]
   [-Confirm]
   [-WhatIf]
   [<CommonParameters>]

Description

Gets all incident bookmarks.

Examples

Example 1: List all Bookmarks for a given Incident

Get-AzSentinelIncidentBookmark -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -IncidentId "7f40bbbc-e205-404b-bc2b-5d71cd1017a8"

DisplayName    : My 2021 Bookmark
FriendlyName   : My 2021 Bookmark
Label          : {my Tags}
Note           : my notes
                 2nd line notes
CreatedByEmail : luke@contoso.com
CreatedByName  : Luke
Name           : 4557d832-41f0-456f-977e-78a2e129b8d0

This command lists all Bookmarks for a given Incident.

Parameters

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Type:PSObject
Aliases:AzureRMContext, AzureCredential
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-IncidentId

Incident ID

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-SubscriptionId

The ID of the target subscription.

Type:String[]
Position:Named
Default value:(Get-AzContext).Subscription.Id
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-WorkspaceName

The name of the workspace.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

Outputs

IHuntingBookmark

Notes

ALIASES