Azure Sentinel UpdateIncident

Azure Sentinel UpdateIncident

Certified

Update a Sentinel incident

Reads and merges the writable incident properties, preserving omitted values and its ETag for optimistic concurrency.

yaml
type: io.kestra.plugin.azure.sentinel.UpdateIncident

Update a Sentinel incident

yaml
id: sentinel_updateincident
namespace: company.security

inputs:
  - id: incidentId
    type: STRING

tasks:
  - id: sentinel
    type: io.kestra.plugin.azure.sentinel.UpdateIncident
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    subscriptionId: "{{ secret('AZURE_SUBSCRIPTION_ID') }}"
    resourceGroup: rg-security
    workspaceName: law-sentinel
    incidentId: "{{ inputs.incidentId }}"
    status: Active
Properties

Incident ID

Azure resource group

Name of the resource group that contains the Sentinel workspace.

Azure subscription ID

ID of the Azure subscription that contains the Sentinel workspace.

Azure AD tenant ID (GUID)

Sentinel workspace name

ARM resource name of the Log Analytics workspace, not its customer GUID (the workspaceId used by Query).

Defaulthttps://management.azure.com

Azure Resource Manager endpoint

Base URL of the Azure Resource Manager API. Defaults to https://management.azure.com (public cloud). Override it for sovereign clouds, for example https://management.usgovcloudapi.net (Azure Government) or https://management.chinacloudapi.cn (Azure China). The access token scope is derived from this endpoint (<endpoint>/.default). Microsoft Entra sign-in uses the public authority unless the worker sets the AZURE_AUTHORITY_HOST environment variable, for example https://login.microsoftonline.us.

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions
assetFailureBehaviorstring
Possible Values
IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

id*string
Min length1
typestring
outputs

The assets produced as outputs.

id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*object
descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
id*string
Min length1
Max length150
type*string
Min length1

Custom asset type

descriptionstring
displayNamestring
metadataobject
Default{}
namespacestring
Min length1
Max length150
Possible Values
UndeterminedTruePositiveBenignPositiveFalsePositive

Closure classification

Why the incident was closed. One of Undetermined, TruePositive, BenignPositive or FalsePositive.

Closure classification comment

Possible Values
SuspiciousActivitySuspiciousButExpectedIncorrectAlertLogicInaccurateData

Closure classification reason

Reason for the closure classification. One of SuspiciousActivity, SuspiciousButExpected, IncorrectAlertLogic or InaccurateData.

Client ID of the Azure AD application

Application (client) ID used for service principal authentication.

Client secret for the Azure AD application

Secret value associated with the client ID; store in a Kestra secret.

Incident description

SubTypestring

User labels

Replace user labels with these names, preserving system labels. An empty list clears user labels; omitted leaves labels unchanged.

Owner email

Replaces the owner with the supplied owner fields. Use ownerObjectId for the most reliable assignment.

Owner object ID

Most reliable way to assign an incident. Replaces the owner with the supplied owner fields.

PEM-encoded certificate content for client authentication

PEM text for certificate-based auth; alternative to clientSecret.

Possible Values
HighMediumLowInformational

Incident severity

New severity of the incident. One of High, Medium, Low or Informational.

Possible Values
NewActiveClosed

Incident status

New status of the incident. One of New, Active or Closed.

Incident title

Updated incident resource

More Plugins in this Category

Firecrawl
Firecrawl

Tasks that scrape and crawl websites into clean, LLM-ready content with Firecrawl.

Data

2 tasks

Canonical (EE)
Canonical
Enterprise

Tasks to interact with Canonical services, enabling automation and infrastructure management through API-driven workflows.

CloudInfrastructure

5 tasks