Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/SecurityInsights/SecurityInsights/ChangeLog.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@
-->

## Upcoming Release
* Improved `Update-AzSentinelIncident` help documentation for updating incidents using `-InputObject`
- Examples now include required `-Title`, `-Status`, and `-Severity` parameters and avoid validation errors when using `-InputObject`
- Fixed issue [#29130]

## Version 3.2.1
* Preannounced breaking changes. Please refer to https://go.microsoft.com/fwlink/?linkid=2333229
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,28 @@ Update-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceNam
```

This command updates an incident by assigning an owner.
The `-Title`, `-Status`, and `-Severity` parameters must be provided to avoid validation errors, even though they are listed as optional in the parameter syntax.

### Example 2: Update an Incident using InputObject
```powershell
$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
Update-AzSentinelIncident -InputObject $incident -Title $incident.Title -Status $incident.Status -Severity $incident.Severity -OwnerAssignedTo "user@mydomain.local"
```

This command updates an incident by passing the incident object via the `-InputObject` parameter.
When using `-InputObject`, you must still provide `-Title`, `-Status`, and `-Severity` to prevent the API from returning a validation error.
It is recommended to pass the existing values from the incident object (e.g., `$incident.Title`) to avoid unintentionally resetting those fields.

### Example 3: Update Incident Labels using InputObject
```powershell
$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
$newLabels = @( @{ LabelName = "Critical" } )
Update-AzSentinelIncident -InputObject $incident -Title $incident.Title -Status $incident.Status -Severity $incident.Severity -Label $newLabels
```

This command updates the labels on an existing incident.
Note that `-Title`, `-Status`, and `-Severity` must be included to avoid validation errors.
Passing the original values from `$incident` ensures those fields are not reset.

## PARAMETERS

Expand Down