Skip to main content
POST
Ingest incident

Path Parameters

workspaceId
string<uuid>
required

Body

application/json

v2 request body for ingesting a Microsoft Sentinel incident from a customer's Content Hub playbook.

incidentArmId
string
required

Full Azure Resource Manager id of the Sentinel incident, taken from the playbook trigger.

incidentTitle
null | string

Incident title from the trigger. Accepted for compatibility; not forwarded downstream.

severity
null | string

Incident severity from the trigger, forwarded to the pipeline only as a hint.

workspaceId
string<uuid>

The Sentinel (Log Analytics) workspace GUID from the trigger. Accepted for compatibility; the ContraForce workspace used for authorization is taken from the route, not this value.

Response

Accepted