Microsoft Sentinel
Version: 1.3
Updated: Sep 04, 2023
Microsoft Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.
Actions
- List Incident Comments (Enrichment) - Gather all comments for a specific incident.
- Get Incident (Enrichment) - Get a specific incident.
- List Incidents (Enrichment) - Get a list of all incidents.
- Search Into Sentinel Events (Enrichment) - Query into a Sentinel event.
- List Incident Entities (Enrichment) - Get all incident related entities.
- Add Incident Comment (Containment) - Add a new incident comment.
- Delete Incident (Containment) - Delete an incident.
- Update Incident (Containment) - Update an incident.
- Microsoft Sentinel Incidents Daemon (Daemon) - Automatically pull all Sentinel incidents.
Change Log
- September 2, 2020 - First upload
- June 8, 2022 - Updated actions: added "Scope" field
- July 11, 2023 (v1.2) - Updated the integration with Environmental Variables
- September 4, 2023 (v1.3)
- integration refactored
- removed Alerts Daemon Sentinel (replaced by Microsoft Graph Security Alerts Daemon, in Graph Security integration)
- renamed action Get Entities to List Incident Entities
- renamed action Get Incident Comments to List Incident Comments
- renamed action Get Incidents to List Incidents
- renamed action Incidents Daemon Sentinel to Microsoft Sentinel Incidents Daemon
- added new action List Incident Alerts