RE: How you extract 'Incident ARM ID' from a KQL query to be used in a Logic App

Hello, Can the Security Incident ID be extracted from the SecurityIncident table and used as a property or Entity value in a workflow action of a Logic App, such as 'Update Incident'? See the bel...

KQL

playbooks

Rod_Trent
Mar 24, 2023
JMSHW0420 It comes from the system assigned Incident ID, the same ID that's included on the URL for the Incident in the browser. In the SecurityIncident table it's in the IncidentName data column.

Rod_Trent

Microsoft

JMSHW0420 It comes from the system assigned Incident ID, the same ID that's included on the URL for the Incident in the browser. In the SecurityIncident table it's in the IncidentName data column.

JMSHW0420

Iron Contributor

Mar 28, 2023

Hi Rod_Trent, so passing the IncidentName will basically 'map' to the value of 'Incident ARM ID' in the action of 'Update Incident' in a Logic App?

Rod_Trent
Microsoft
Mar 28, 2023
That is the ARM ID, yes.

Forum Discussion

RE: How you extract 'Incident ARM ID' from a KQL query to be used in a Logic App

Share

Resources