Sometimes when you need data for your reporting you have to ingest and store it, here are two recent use cases that do that, they get Teams and Azure Sentinel Incident data and keep the data within a...
Updated Nov 03, 2021
Version 10.0
Blog Post
Thats the sample Json from which the results should be filtered before loading based on dashboards time selection.
{
"value": [
{
"id": "/subscriptions/xxxxxxxxx/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/mdr-asi-cef/providers/Microsoft.SecurityInsights/Cases/xxxxxxxxx",
"name": "xxxxxxxxx",
"etag": "\"xxxxxxxx\"",
"type": "Microsoft.SecurityInsights/Cases",
"properties": {
"title": "Sample ticket 1",
"description": "",
"severity": "High",
"status": "InProgress",
"labels": [],
"endTimeUtc": "2020-06-11T10:42:45.4101056Z",
"startTimeUtc": "2020-06-11T10:32:45.4101056Z",
"lastUpdatedTimeUtc": "2020-06-11T10:47:50Z",
"createdTimeUtc": "2020-06-11T10:47:47.6183665Z",
"caseNumber": 75,
"lastComment": "test comment",
"totalComments": 1,
"firstAlertTimeGenerated": "2020-06-11T10:47:47.3249624Z",
"lastAlertTimeGenerated": "2020-06-11T10:47:47.3249624Z"
}
},
{
"id": "/subscriptions/xxxxxxxxx/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/mdr-asi-cef/providers/Microsoft.SecurityInsights/Cases/xxxxxxxxx",
"name": "xxxxxxxxx",
"etag": "\"xxxxxxxx\"",
"type": "Microsoft.SecurityInsights/Cases",
"properties": {
"title": "Sample ticket 2",
"description": "",
"severity": "High",
"status": "InProgress",
"labels": [],
"endTimeUtc": "2020-06-11T10:42:45.4101056Z",
"startTimeUtc": "2020-06-11T10:32:45.4101056Z",
"lastUpdatedTimeUtc": "2020-06-11T10:47:50Z",
"createdTimeUtc": "2020-06-11T10:47:47.6183665Z",
"caseNumber": 75,
"lastComment": "test comment 1",
"totalComments": 1,
"firstAlertTimeGenerated": "2020-06-11T10:47:47.3249624Z",
"lastAlertTimeGenerated": "2020-06-11T10:47:47.3249624Z"
}
}