How to export incidents in azure sentinel

KheenanH 

This will get you "all" columns.  You can when you are happy, replace the "*" on line 11 with a list of the specific columns you need.

SecurityIncident
| extend Alerts = extract("\\[(.*?)\\]", 1, tostring(AlertIds))
| mv-expand AlertIds to typeof(string), Labels to typeof(string), Comments to typeof(string), AdditionalData to typeof(string)
| join kind=inner
(
    SecurityAlert
    ) on $right.SystemAlertId == $left.AlertIds
    | summarize AlertCount=dcount(AlertIds),
                arg_max
                (
                 TimeGenerated, *  
                )
                by IncidentNumber

Including the three for Classification

Clive_Watson i am back at this again.  

ive been poking around for a few days.  ive found that i am unable to find where it stores any notes we enter whether its when we resolve it or not.  Also is there a way to get the classification reason out of here? 

In looking at the query language there was a Status1. I added that and now Sentinel now shows closed Clive_Watson 

KheenanH 

I'm not seeing that behaviour (I checked three workspaces in 3 regions)

Do you have an Automation Rule changing them back to "new"?