Microsoft Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.
Use the Azure Sentinel integration to get and manage incidents and get related entity information for incidents.
What does this pack do?
- Gets a single incident or a list of incidents from Azure Sentinel.
- Gets a list of watchlists from Azure Sentinel.
- Creates, updates, or deletes a watchlist in Azure Sentinel.
- Updates or deletes a single incident in Azure Sentinel.
- Gets, adds, or deletes the comments of an incident from Azure Sentinel.
- Gets a list of an incident's related entities from Azure Sentinel.
- Gets a list of an incident's entities from Azure Sentinel.
- Gets a list of an incident's alerts from Azure Sentinel.
- Get a single watchlist item or list of watchlist items.
- Creates, updates, deletes a watchlist item.
- Returns a list of threat indicators.
- Returns a list of threat indicators with specific entities.
- Creates, updates, or deletes a threat indicator.
- Appends new tags to an existing indicator.
- Replaces the tags of a given indicator.
Use the Azure Sentinel integration to get and manage incidents and get related entity information for incidents.
What does this pack do?
- Gets a single incident or a list of incidents from Azure Sentinel.
- Gets a list of watchlists from Azure Sentinel.
- Creates, updates, or deletes a watchlist in Azure Sentinel.
- Updates or deletes a single incident in Azure Sentinel.
- Gets, adds, or deletes the comments of an incident from Azure Sentinel.
- Gets a list of an incident's related entities from Azure Sentinel.
- Gets a list of an incident's entities from Azure Sentinel.
- Gets a list of an incident's alerts from Azure Sentinel.
- Get a single watchlist item or list of watchlist items.
- Creates, updates, deletes a watchlist item.
- Returns a list of threat indicators.
- Returns a list of threat indicators with specific entities.
- Creates, updates, or deletes a threat indicator.
- Appends new tags to an existing indicator.
- Replaces the tags of a given indicator.
