Azure Sentinel GetIncident

Azure Sentinel GetIncident

Certified

Get a Sentinel incident

Retrieves one incident, optionally including its associated alerts.

yaml
type: io.kestra.plugin.azure.sentinel.GetIncident

Get a Sentinel incident

yaml
id: sentinel_getincident
namespace: company.security

inputs:
  - id: incidentId
    type: STRING

tasks:
  - id: sentinel
    type: io.kestra.plugin.azure.sentinel.GetIncident
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    subscriptionId: "{{ secret('AZURE_SUBSCRIPTION_ID') }}"
    resourceGroup: rg-security
    workspaceName: law-sentinel
    incidentId: "{{ inputs.incidentId }}"
Properties

Incident ID

Azure resource group

Name of the resource group that contains the Sentinel workspace.

Azure subscription ID

ID of the Azure subscription that contains the Sentinel workspace.

Azure AD tenant ID (GUID)

Sentinel workspace name

ARM resource name of the Log Analytics workspace, not its customer GUID (the workspaceId used by Query).

Defaulthttps://management.azure.com

Azure Resource Manager endpoint

Base URL of the Azure Resource Manager API. Defaults to https://management.azure.com (public cloud). Override it for sovereign clouds, for example https://management.usgovcloudapi.net (Azure Government) or https://management.chinacloudapi.cn (Azure China). The access token scope is derived from this endpoint (<endpoint>/.default). Microsoft Entra sign-in uses the public authority unless the worker sets the AZURE_AUTHORITY_HOST environment variable, for example https://login.microsoftonline.us.

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions
assetFailureBehaviorstring
Possible Values
IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

id*string
Min length1
typestring
outputs

The assets produced as outputs.

id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*string
Min length1

Custom asset type

descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150

Client ID of the Azure AD application

Application (client) ID used for service principal authentication.

Client secret for the Azure AD application

Secret value associated with the client ID; store in a Kestra secret.

Defaultfalse

Include incident alerts

Fetch the associated alerts with an additional request. Defaults to false.

PEM-encoded certificate content for client authentication

PEM text for certificate-based auth; alternative to clientSecret.

SubTypeobject

Associated alerts

Only populated when includeAlerts is true.

Incident resource

More Plugins in this Category

Firecrawl
Firecrawl

Tasks that scrape and crawl websites into clean, LLM-ready content with Firecrawl.

Data

2 tasks

Canonical (EE)
Canonical
Enterprise

Tasks to interact with Canonical services, enabling automation and infrastructure management through API-driven workflows.

CloudInfrastructure

5 tasks