Use the Azure Sentinel integration to get and manage incidents and get related entity information for incidents.
​
What does this pack do?
- Gets a single incident or a list of incidents from Azure Sentinel.
- Gets a list of watchlists from Azure Sentinel.
- Creates, updates, or deletes a watchlist in Azure Sentinel.
- Creates, updates or deletes a single incident in Azure Sentinel.
- Gets, adds, or deletes the comments of an incident from Azure Sentinel.
- Gets a list of an incident's related entities from Azure Sentinel.
- Gets a list of an incident's entities from Azure Sentinel.
- Gets a list of an incident's alerts from Azure Sentinel.
- Get a single watchlist item or list of watchlist items.
- Creates, updates, deletes a watchlist item.
- Returns a list of threat indicators.
- Returns a list of threat indicators with specific entities.
- Creates, updates, or deletes a threat indicator.
- Appends new tags to an existing indicator.
- Replaces the tags of a given indicator.
Pack Contributors:
- Clément Verhille
- Ole Eikrem
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
