Forum Discussion
Query Alert Status and Assigned User
Looking to query to alerts/incidents that have not been assigned/picked up or to look at the current status (New/In Progress) to detect and alert on stale events. I use the following query to genera...
ryanksmith What you are looking at is the listing of Alerts, not the Incidents. Alerts do not get assigned to users, only the Incident will.
Unfortunately, you cannot query Incidents using KQL directly. You have to use the Azure Sentinel REST API. There have been a few posts about doing this lately, including mine on doing this through PowerShell : https://www.garybushey.com/2020/01/11/your-first-azure-sentinel-rest-api-call/