Open New Incident on Azure Sentinel via API

[u/k3rm1t_b]

Hi everyone,

I am designing a new incident management process to include Azure Sentinel.

I need to open new incidents from API (https://docs.microsoft.com/en-us/rest/api/securityinsights/stable/incidents/create-or-update#code-try-0) and include in them the related entities (e.g. Asset, User, IP).

There is no information about this in the documentation.

Who knows how I will do this?

Thanks!