Forum Discussion
Cristhofer Munoz
Microsoft
MicrosoftWhat's New: Tags column is now available in Azure Sentinel incidents page!
Hello everyone,
We are happy to share with you a small but important improvement we added to our incidents blade – a new tag column is now available as part of the Incidents list!
Tags are an integral part of the triaging process so we are now exposing them in a new column of the incident list. This improvement allows users to get informed about the tags that are related to the incidents without having to pivot to the incident preview page or full details. Every second counts, right?
- great
Hi Cristhofer Munoz is it possible to search for these tags via KQL?
Specifically I am running a search of security incidents this year, and I would like to 'not' include any tickets with an 'auto close' tag. This would provide me with a list and number of tickets by 'humans' in my team rather than including ones closed by playbooks and automation etc.
Cheers.
Labels == Tags
SecurityIncident
| extend Tags = parse_json(Labels)
| extend labelName_ = tostring(Tags[0].labelName)
| where isnotempty(labelName_)Hi Clive
I was reading though the documentation on how to create a Sentinel Incident with API but unfortunately I am not able to add labels/tags while creating a Sentinel Incident Manually with API Payload
any suggestions I could try?
