capability

Incidents

Microsoft Sentinel incidents group related alerts and entities into investigation records that analysts can triage, assign, classify, and close.

capabilitiesCurrent

Relationships

Microsoft Sentinel
Source productproduct SecurityAlert
Related tabletable SecurityIncident
Related tabletable Microsoft Sentinel REST API
API accessapi

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Gap	No product-specific PowerShell automation surface is recorded for this capability yet.
REST API	Supported	Reference
Graph	Supported	Reference
ARM	Gap	No ARM resource is recorded for this capability.
Bicep	Gap	No Bicep resource is recorded for this capability.
Terraform	Gap	Incidents are operational records, not desired-state configuration. Manage incident state through REST/Graph automation, not Terraform.
GitHub Actions	Supported	Reference
Azure DevOps	Supported	Reference

Related KQL

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard

beginnersentinel-operationsoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: SecurityIncident

kql

SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.