Incident Comments - List
Gets all comments for a given incident.
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments?api-version=2024-03-01
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments?api-version=2024-03-01&$filter={$filter}&$orderby={$orderby}&$top={$top}&$skipToken={$skipToken}
URI Parameters
Name | In | Required | Type | Description |
---|---|---|---|---|
incident
|
path | True |
string |
Incident ID |
resource
|
path | True |
string |
The name of the resource group. The name is case insensitive. |
subscription
|
path | True |
string uuid |
The ID of the target subscription. The value must be an UUID. |
workspace
|
path | True |
string |
The name of the workspace. Regex pattern: |
api-version
|
query | True |
string |
The API version to use for this operation. |
$filter
|
query |
string |
Filters the results, based on a Boolean condition. Optional. |
|
$orderby
|
query |
string |
Sorts the results. Optional. |
|
$skip
|
query |
string |
Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. |
|
$top
|
query |
integer int32 |
Returns only the first n results. Optional. |
Responses
Name | Type | Description |
---|---|---|
200 OK |
OK, Operation successfully completed |
|
Other Status Codes |
Error response describing why the operation failed. |
Security
azure_auth
Azure Active Directory OAuth2 Flow
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
Name | Description |
---|---|
user_impersonation | impersonate your user account |
Examples
Get all incident comments.
Sample Request
GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments?api-version=2024-03-01
Sample Response
{
"value": [
{
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
"name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
"type": "Microsoft.SecurityInsights/incidents/comments",
"etag": "0300bf09-0000-0000-0000-5c37296e0000",
"properties": {
"message": "Some message",
"createdTimeUtc": "2019-01-01T13:15:30Z",
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
"author": {
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
"email": "john.doe@contoso.com",
"userPrincipalName": "john@contoso.com",
"name": "john doe"
}
}
}
]
}
Definitions
Name | Description |
---|---|
Client |
Information on the client (user or application) that made some action |
Cloud |
Error response structure. |
Cloud |
Error details. |
created |
The type of identity that created the resource. |
Incident |
Represents an incident comment |
Incident |
List of incident comments. |
system |
Metadata pertaining to creation and last modification of the resource. |
ClientInfo
Information on the client (user or application) that made some action
Name | Type | Description |
---|---|---|
string |
The email of the client. |
|
name |
string |
The name of the client. |
objectId |
string |
The object id of the client. |
userPrincipalName |
string |
The user principal name of the client. |
CloudError
Error response structure.
Name | Type | Description |
---|---|---|
error |
Error data |
CloudErrorBody
Error details.
Name | Type | Description |
---|---|---|
code |
string |
An identifier for the error. Codes are invariant and are intended to be consumed programmatically. |
message |
string |
A message describing the error, intended to be suitable for display in a user interface. |
createdByType
The type of identity that created the resource.
Name | Type | Description |
---|---|---|
Application |
string |
|
Key |
string |
|
ManagedIdentity |
string |
|
User |
string |
IncidentComment
Represents an incident comment
Name | Type | Description |
---|---|---|
etag |
string |
Etag of the azure resource |
id |
string |
Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName} |
name |
string |
The name of the resource |
properties.author |
Describes the client that created the comment |
|
properties.createdTimeUtc |
string |
The time the comment was created |
properties.lastModifiedTimeUtc |
string |
The time the comment was updated |
properties.message |
string |
The comment message |
systemData |
Azure Resource Manager metadata containing createdBy and modifiedBy information. |
|
type |
string |
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts" |
IncidentCommentList
List of incident comments.
Name | Type | Description |
---|---|---|
nextLink |
string |
URL to fetch the next set of comments. |
value |
Array of comments. |
systemData
Metadata pertaining to creation and last modification of the resource.
Name | Type | Description |
---|---|---|
createdAt |
string |
The timestamp of resource creation (UTC). |
createdBy |
string |
The identity that created the resource. |
createdByType |
The type of identity that created the resource. |
|
lastModifiedAt |
string |
The timestamp of resource last modification (UTC) |
lastModifiedBy |
string |
The identity that last modified the resource. |
lastModifiedByType |
The type of identity that last modified the resource. |