api

Microsoft Sentinel REST API

The Microsoft Sentinel REST API manages Sentinel resources such as incidents, analytics rules, data connectors, bookmarks, and entity information.

apisCurrent

Relationships

SecurityIncident
Exposed tabletableSecurityAlert
Exposed tabletableThreatIntelIndicators
Exposed tabletableThreatIntelObjects
Exposed tabletable

Related KQL

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template
advancedthreat-intelligenceendpoint
Run surface
Sentinel Logs
Required tables
ThreatIntelIndicatorsDeviceNetworkEvents
License context
Microsoft Defender for Endpoint P2
kql
let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard
beginnersentinel-operationsoperational-excellence
Run surface
Sentinel Logs, Azure Monitor Logs
Required tables
SecurityIncident
kql
SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.

Example Request

http
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents?api-version=2025-09-01
Authorization: Bearer <token>