New-AzSentinelIncidentTeam

Reference

Module:: Az.SecurityInsights

Creates a Microsoft team to investigate the incident by sharing information and insights between participants.

Syntax

New-AzSentinelIncidentTeam
   -IncidentId <String>
   -ResourceGroupName <String>
   -WorkspaceName <String>
   -TeamName <String>
   [-SubscriptionId <String>]
   [-GroupId <String[]>]
   [-MemberId <String[]>]
   [-TeamDescription <String>]
   [-DefaultProfile <PSObject>]
   [-Confirm]
   [-WhatIf]
   [<CommonParameters>]

New-AzSentinelIncidentTeam
   -IncidentId <String>
   -ResourceGroupName <String>
   -WorkspaceName <String>
   -TeamProperty <ITeamProperties>
   [-SubscriptionId <String>]
   [-DefaultProfile <PSObject>]
   [-Confirm]
   [-WhatIf]
   [<CommonParameters>]

Description

Creates a Microsoft team to investigate the incident by sharing information and insights between participants.

Examples

Example 1: Create an Incident Teams Room

$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Id "myIncidentId"
 New-AzSentinelIncidentTeam -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -IncidentId ($incident.Name) -TeamName ("Incident "+$incident.incidentNumber+": "+$incident.title)

Description         :
Name                : Incident : NewIncident3
PrimaryChannelUrl   : https://teams.microsoft.com/l/team/19:vYoGjeGlZmTEDmu0gTbrk9T_eDS4pKIkEU7UuM1IyZk1%40thread.tacv2/conversations?groupId=3c637cc5-caf1-46c7-93ac-069c6
                      4b05395&tenantId=8f21ced5-2eff-4f8d-aff1-4dbb4cee8e3d
TeamCreationTimeUtc : 2/4/2022 3:02:03 PM
TeamId              : 3c637cc5-caf1-46c7-93ac-069c64b05395

This command creates a Teams group for the Incident.

Parameters

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Type:	PSObject
Aliases:	AzureRMContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-GroupId

List of group IDs to add their members to the team

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IncidentId

Incident ID

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-MemberId

List of member IDs to add to the team

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-SubscriptionId

The ID of the target subscription.

Type:	String
Position:	Named
Default value:	(Get-AzContext).Subscription.Id
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-TeamDescription

The description of the team

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-TeamName

The name of the team

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-TeamProperty

Describes team properties To construct, see NOTES section for TEAMPROPERTY properties and create a hash table.

Type:	ITeamProperties
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WorkspaceName

The name of the workspace.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

ITeamProperties

Outputs

ITeamInformation

Notes

ALIASES

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

TEAMPROPERTY <ITeamProperties>: Describes team properties

TeamName <String>: The name of the team
[GroupId <String[]>]: List of group IDs to add their members to the team
[MemberId <String[]>]: List of member IDs to add to the team
[TeamDescription <String>]: The description of the team