incident_relations

Creates, updates, deletes, gets or lists a incident_relations resource.

Overview

Name	incident_relations
Type	Resource
Id	azure.sentinel.incident_relations

Fields

vw_incident_relations

Name	Datatype	Description
etag	text	Etag of the azure resource
incidentId	text	field from the properties object
related_resource_id	text	field from the properties object
related_resource_kind	text	field from the properties object
related_resource_name	text	field from the properties object
related_resource_type	text	field from the properties object
relationName	text	field from the properties object
resourceGroupName	text	field from the properties object
subscriptionId	text	field from the properties object
workspaceName	text	field from the properties object

incident_relations

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Relation property bag.

Methods

Name	Accessible by	Required Params	Description
get	SELECT	incidentId, relationName, resourceGroupName, subscriptionId, workspaceName	Gets a relation for a given incident.
list	SELECT	incidentId, resourceGroupName, subscriptionId, workspaceName	Gets all relations for a given incident.
create_or_update	INSERT	incidentId, relationName, resourceGroupName, subscriptionId, workspaceName	Creates or updates a relation for a given incident.
delete	DELETE	incidentId, relationName, resourceGroupName, subscriptionId, workspaceName	Deletes a relation for a given incident.

SELECT examples

Gets all relations for a given incident.

vw_incident_relations

SELECT
etag,
incidentId,
related_resource_id,
related_resource_kind,
related_resource_name,
related_resource_type,
relationName,
resourceGroupName,
subscriptionId,
workspaceName
FROM azure.sentinel.vw_incident_relations
WHERE incidentId = '{{ incidentId }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

incident_relations

SELECT
etag,
properties
FROM azure.sentinel.incident_relations
WHERE incidentId = '{{ incidentId }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

INSERT example

Use the following StackQL query and manifest file to create a new incident_relations resource.

All Properties

/*+ create */
INSERT INTO azure.sentinel.incident_relations (
incidentId,
relationName,
resourceGroupName,
subscriptionId,
workspaceName,
etag,
properties
)
SELECT 
'{{ incidentId }}',
'{{ relationName }}',
'{{ resourceGroupName }}',
'{{ subscriptionId }}',
'{{ workspaceName }}',
'{{ etag }}',
'{{ properties }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: etag
      value: string
    - name: properties
      value:
        - name: relatedResourceId
          value: string
        - name: relatedResourceName
          value: string
        - name: relatedResourceType
          value: string
        - name: relatedResourceKind
          value: string

DELETE example

Deletes the specified incident_relations resource.

/*+ delete */
DELETE FROM azure.sentinel.incident_relations
WHERE incidentId = '{{ incidentId }}'
AND relationName = '{{ relationName }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';