Forum Discussion
jojo_the_coder
Mar 17, 2020Copper Contributor
Fetch Azure Sentinel Incidents Via API
Hi, I want to fetch incidents from azure sentinel via api. As Sentinel hasn't API, I have to use Graph api. I need a sample or endpoint. Any advice o document suggestion would be appreciated. B...
- Mar 17, 2020
Hi jojo_the_coder, current available APIs to fetch incidents can be found here.
To fetch alerts related to an incident without using Log Analytics API, you can do that via the Microsoft Graph Security API. Please refer to the documentation here. Below is an example query to get all alerts provided by Azure Sentinel via the Graph Security API. A list of curated sample queries can be found here.
https://graph.microsoft.com/v1.0/security/alerts?$filter=vendorInformation/provider eq 'Azure Sentinel'.
Chi_Nguyen
Microsoft
Mar 17, 2020Hi jojo_the_coder, current available APIs to fetch incidents can be found here.
To fetch alerts related to an incident without using Log Analytics API, you can do that via the Microsoft Graph Security API. Please refer to the documentation here. Below is an example query to get all alerts provided by Azure Sentinel via the Graph Security API. A list of curated sample queries can be found here.
https://graph.microsoft.com/v1.0/security/alerts?$filter=vendorInformation/provider eq 'Azure Sentinel'.
jeromeasenthorus
Dec 01, 2023Copper Contributor
This solution doesn't seems to work anymore, any ideas ?