incident_tasks

Creates, updates, deletes, gets or lists a incident_tasks resource.

Overview

Name	incident_tasks
Type	Resource
Id	azure.sentinel.incident_tasks

Fields

vw_incident_tasks

Name	Datatype	Description
description	text	field from the properties object
created_by	text	field from the properties object
created_time_utc	text	field from the properties object
etag	text	Etag of the azure resource
incidentId	text	field from the properties object
incidentTaskId	text	field from the properties object
last_modified_by	text	field from the properties object
last_modified_time_utc	text	field from the properties object
resourceGroupName	text	field from the properties object
status	text	field from the properties object
subscriptionId	text	field from the properties object
title	text	field from the properties object
workspaceName	text	field from the properties object

incident_tasks

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Describes the properties of an incident task

Methods

Name	Accessible by	Required Params	Description
get	SELECT	incidentId, incidentTaskId, resourceGroupName, subscriptionId, workspaceName	Gets an incident task.
list	SELECT	incidentId, resourceGroupName, subscriptionId, workspaceName	Gets all incident tasks.
create_or_update	INSERT	incidentId, incidentTaskId, resourceGroupName, subscriptionId, workspaceName, data__properties	Creates or updates the incident task.
delete	DELETE	incidentId, incidentTaskId, resourceGroupName, subscriptionId, workspaceName	Delete the incident task.

SELECT examples

Gets all incident tasks.

vw_incident_tasks

SELECT
description,
created_by,
created_time_utc,
etag,
incidentId,
incidentTaskId,
last_modified_by,
last_modified_time_utc,
resourceGroupName,
status,
subscriptionId,
title,
workspaceName
FROM azure.sentinel.vw_incident_tasks
WHERE incidentId = '{{ incidentId }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

incident_tasks

SELECT
etag,
properties
FROM azure.sentinel.incident_tasks
WHERE incidentId = '{{ incidentId }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';

INSERT example

Use the following StackQL query and manifest file to create a new incident_tasks resource.

All Properties

/*+ create */
INSERT INTO azure.sentinel.incident_tasks (
incidentId,
incidentTaskId,
resourceGroupName,
subscriptionId,
workspaceName,
data__properties,
etag,
properties
)
SELECT 
'{{ incidentId }}',
'{{ incidentTaskId }}',
'{{ resourceGroupName }}',
'{{ subscriptionId }}',
'{{ workspaceName }}',
'{{ data__properties }}',
'{{ etag }}',
'{{ properties }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: etag
      value: string
    - name: properties
      value:
        - name: title
          value: string
        - name: description
          value: string
        - name: status
          value: []
        - name: createdTimeUtc
          value: string
        - name: lastModifiedTimeUtc
          value: string
        - name: createdBy
          value:
            - name: email
              value: string
            - name: name
              value: string
            - name: objectId
              value: string
            - name: userPrincipalName
              value: string

DELETE example

Deletes the specified incident_tasks resource.

/*+ delete */
DELETE FROM azure.sentinel.incident_tasks
WHERE incidentId = '{{ incidentId }}'
AND incidentTaskId = '{{ incidentTaskId }}'
AND resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND workspaceName = '{{ workspaceName }}';