table

SecurityIncident

SecurityIncident stores Microsoft Sentinel incident state changes and SOC metrics in the Log Analytics workspace.

tablesCurrent

Relationships

Microsoft Sentinel
Source productproduct Microsoft Sentinel REST API
API accessapi SecurityAlert
Related tabletable

Schema

Field	Type	Description
`TimeGenerated`	datetime	Time the incident record was generated.
`IncidentNumber`	int	Sequential incident number.
`Title`	string	Incident title.
`Severity`	string	Incident severity.
`Status`	string	Incident status.
`Owner`	dynamic	Incident owner information.
`AlertIds`	dynamic	Alerts from which the incident was created.
`AdditionalData`	dynamic	Additional incident metrics such as alert counts, tactics, bookmarks, and comments.
`Classification`	string	Incident closing classification.
`LastModifiedTime`	datetime	Time the incident was last modified.

Sample KQL

Open incidents by owner and severity

Create a queue view for active Sentinel incidents that need analyst attention.

kql

SecurityIncident
| where TimeGenerated > ago(30d)
| where Status != "Closed"
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by Severity, Status, Owner
| order by Severity asc, Incidents desc

Related KQL

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard

beginnersentinel-operationsoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: SecurityIncident

kql

SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.