Forum Discussion
How to close sentinel bulk incidents
I would like to know how we can close multiple incidents in bulk using KQL query or any other tested option. Appreciate quick response.
Rod_Trent
Microsoft
MicrosoftSee if the following helps: https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Update-BulkIncidents
I tried to use reference playbook however, I keep getting a failure:
$uri = "reference uri"
$header = @{'Content-Type' = 'application/json'}
$json = @"
{ "bulkoperation": {
"operationtype": "kql",
"operationquery": "SecurityIncident | where TimeGenerated >= ago(7d) | where Status == 'New'",
"operationstatus": "Closed"
}
}
"@
Invoke-WebRequest -Uri $uri -Method POST -Body $json -ContentType "application/json"- not able to access the above link
