What's New: Tags column is now available in Azure Sentinel incidents page!

[Cristhofer Munoz]

Hello everyone,

We are happy to share with you a small but important improvement we added to our incidents blade – a new tag column is now available as part of the Incidents list!

Tags are an integral part of the triaging process so we are now exposing them in a new column of the incident list. This improvement allows users to get informed about the tags that are related to the incidents without having to pivot to the incident preview page or full details. Every second counts, right? 

[#2]

Hi @Cristhofer Munoz is it possible to search for these tags via KQL?

Specifically I am running a search of security incidents this year, and I would like to 'not' include any tickets with an 'auto close' tag. This would provide me with a list and number of tickets by 'humans' in my team rather than including ones closed by playbooks and automation etc.

Cheers.

[#3]

Labels == Tags

SecurityIncident
| extend Tags = parse_json(Labels)
| extend labelName_ = tostring(Tags[0].labelName)
| where isnotempty(labelName_)

[#4]

great