What is the URL to get to a specific Incident's Full Details page? The URL I get from my browser only takes me to the listing of Incidents. I thought I saw it listed here before but I cannot find it.

jcheal while I think Sentinel does indeed need a link back to the original Alert, if there is one, in this case the URL provided does just what I wanted it to. I wanted to be able to put this URL into a Team's message so that users had a quick and easy way to get back to the Incident. Now it just needs to show up as a field in the Logic App's connector 🙂

No. I mean is there a URL that would take me directly to the page showing an Incident's full details. Would be very useful to put into Teams messages

mevops weird on the @ ... we normally announce things in the what new blade Not everything will be announced as some are minor features.

mevops I wrote a blog post about adding this to an Incident.https://www.garybushey.com/2020/01/24/addin-the-mcas-alert-url-to-a-sentinel-incident-using-powershell/

Hi GaryBushey, do you mean this https://techcommunity.microsoft.com/t5/Azure-Sentinel/URL-entity-type/m-p/957193

Incident URL | Microsoft Community Hub

15 Replies

jcheal
Copper Contributor
Jan 02, 2020
GaryBushey If an incident is triggered by a Microsoft Service data connector > Incidents > View Full Details > ALERT ID > ExtendedLinks should contain two Href links - one might be the security policy ID and the other the Security Alert ID - if you navigate to the URL in the Security alert ID is this the link you were looking for?
- CurlX
  Copper Contributor
  May 27, 2020
  jcheal
  @ Nicholas DiCola (SECURITY JEDI)
  
  As a Security Analyst I prefer to go to the original Dashboard (e.g. in case I receive an MCAS ord Defender Alert in Sentinel, I like to jump out of Sentinel and go to the original Dashboard, as I have more analysis option there). Is there an easy way to navigate to the Source Dashboard? I think it is not so user friendly to search for the url in the logs (Extended Links).
  - GaryBushey
    Bronze Contributor
    May 28, 2020
    CurlX I would suggest adding this to the Azure Sentinel feedback site: https://feedback.azure.com/forums/920458-azure-sentinel
GaryBushey
Bronze Contributor
Nov 18, 2019
No. I mean is there a URL that would take me directly to the page showing an Incident's full details. Would be very useful to put into Teams messages
- Valon_Kolica
  Former Employee
  Nov 18, 2019
  Hi GaryBushey, thank you for your feedback! Adding Nicholas DiCola (SECURITY JEDI)
  - Nicholas DiCola (SECURITY JEDI)
    Former Employee
    Nov 19, 2019
    Valon_Kolica
    
    GaryBushey
    
    we dont have a "deep link" exposed today.
Valon_Kolica
Former Employee
Nov 18, 2019
Hi GaryBushey, do you mean this https://techcommunity.microsoft.com/t5/Azure-Sentinel/URL-entity-type/m-p/957193

Forum Discussion

Incident URL