table

SecurityIncident

SecurityIncident stores Microsoft Sentinel incident state changes and SOC metrics in the Log Analytics workspace.

tablesCurrent

Relationships

Microsoft Sentinel
Source productproduct Microsoft Sentinel REST API
API accessapi SecurityAlert
Related tabletable

Schema

Field	Type	Description
`TimeGenerated`	datetime	Time the incident record was generated.
`IncidentNumber`	int	Sequential incident number.
`Title`	string	Incident title.
`Severity`	string	Incident severity.
`Status`	string	Incident status.
`Owner`	dynamic	Incident owner information.
`AlertIds`	dynamic	Alerts from which the incident was created.
`AdditionalData`	dynamic	Additional incident metrics such as alert counts, tactics, bookmarks, and comments.
`Classification`	string	Incident closing classification.
`LastModifiedTime`	datetime	Time the incident was last modified.

Sample KQL

Open incidents by owner and severity

Create a queue view for active Sentinel incidents that need analyst attention.

kql

SecurityIncident
| where TimeGenerated > ago(30d)
| where Status != "Closed"
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by Severity, Status, Owner
| order by Severity asc, Incidents desc