Azure Sentinel ListIncidents

Azure Sentinel ListIncidents

Certified

List Sentinel incidents

Lists and filters Sentinel incidents, following pagination and returning inline results or an ION file.

yaml
type: io.kestra.plugin.azure.sentinel.ListIncidents

List Sentinel incidents

yaml
id: sentinel_listincidents
namespace: company.security

tasks:
  - id: sentinel
    type: io.kestra.plugin.azure.sentinel.ListIncidents
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    subscriptionId: "{{ secret('AZURE_SUBSCRIPTION_ID') }}"
    resourceGroup: rg-security
    workspaceName: law-sentinel
    statuses: [New, Active]
    fetchType: STORE
Properties

Azure resource group

Name of the resource group that contains the Sentinel workspace.

Azure subscription ID

ID of the Azure subscription that contains the Sentinel workspace.

Azure AD tenant ID (GUID)

Sentinel workspace name

ARM resource name of the Log Analytics workspace, not its customer GUID (the workspaceId used by Query).

Defaulthttps://management.azure.com

Azure Resource Manager endpoint

Base URL of the Azure Resource Manager API. Defaults to https://management.azure.com (public cloud). Override it for sovereign clouds, for example https://management.usgovcloudapi.net (Azure Government) or https://management.chinacloudapi.cn (Azure China). The access token scope is derived from this endpoint (<endpoint>/.default). Microsoft Entra sign-in uses the public authority unless the worker sets the AZURE_AUTHORITY_HOST environment variable, for example https://login.microsoftonline.us.

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions
assetFailureBehaviorstring
Possible Values
IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

id*string
Min length1
typestring
outputs

The assets produced as outputs.

id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*string
Min length1

Custom asset type

descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150

Client ID of the Azure AD application

Application (client) ID used for service principal authentication.

Client secret for the Azure AD application

Secret value associated with the client ID; store in a Kestra secret.

DefaultSTORE
Possible Values
STOREFETCHFETCH_ONENONE

Fetch type

STORE (default) writes ION to internal storage; FETCH returns incidents; FETCH_ONE returns the first incident.

OData filter

Raw OData predicate, combined with severity and status filters using AND.

PEM-encoded certificate content for client authentication

PEM text for certificate-based auth; alternative to clientSecret.

SubTypestring
Possible Values
HighMediumLowInformational

Incident severities

Severities to keep: High, Medium, Low or Informational. Values within this list are combined using OR.

SubTypestring
Possible Values
NewActiveClosed

Incident statuses

Statuses to keep: New, Active or Closed. Values within this list are combined using OR.

Default100

Page size

Number of incidents requested per page, between 1 and 1000. Defaults to 100. All pages are fetched unless FETCH_ONE is selected.

Number of incidents fetched or stored

First incident

Populated for FETCH_ONE, null when no incident matches.

SubTypeobject

Fetched incidents

Populated for FETCH.

Formaturi

Stored incidents URI

ION file in Kestra internal storage, populated for STORE.

More Plugins in this Category

Firecrawl
Firecrawl

Tasks that scrape and crawl websites into clean, LLM-ready content with Firecrawl.

Data

2 tasks

Canonical (EE)
Canonical
Enterprise

Tasks to interact with Canonical services, enabling automation and infrastructure management through API-driven workflows.

CloudInfrastructure

5 tasks