Microsoft Sentinel

This atomic fetches an Incident by ID.

Target: Microsoft Sentinel

Steps:
- Build the query string
- Fetch incident by ID
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/get?view=rest-securityinsights-2025-06-01&tabs=HTTP

Microsoft Sentinel - Get Incident by ID

prod-nam

prod-eu

prod-apjc

This atomic fetches the schema of a table.

Target: Microsoft Sentinel

Steps:
- Build the query string
- Fetch table schema
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-logs-tables?tabs=api

Microsoft Sentinel - Get Table Schema

This atomic fetches incidents from Microsoft Sentinel.

Target: Microsoft Sentinel

Steps:
- Build the query string
- Fetch incidents list
- Check if the request was successful:
  - If it was, extract list and set the output variable
  - If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2025-06-01&tabs=HTTP

Microsoft Sentinel - List Incidents

This atomic fetches Log analytics table data.

Target: Microsoft Sentinel Log Analytics

Steps:
- Build the request payload
- Fetch table data
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/rest/api/loganalytics/query/get?view=rest-loganalytics-2022-10-27-preview&tabs=HTTP

Microsoft Sentinel - Run Query

This atomic sends JSON event for Ingestion.

Target: Microsoft Sentinel Ingestion

Steps:
- Send JSON event for Ingestion
- Check if the request was successful:
  - If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview