Microsoft Sentinel - Export Incident Summary

This incident response workflow allows you to export summary of an XDR incident to a Microsoft Sentinel custom table from a playbook or using an automation rule. When using this workflow in a playbook, the user initiates the export. When using this workflow with an incident automation rule, the export can be done automatically when an incident is created.

Target: Conure APIs, Microsoft Sentinel Ingestion

Steps:

• Fetch the incident summary (if it fails, end the workflow)
• Process the incident summary
• Send the incident summary to the Microsoft Sentinel