---
title: "Microsoft Sentinel"
description: "Reference for the Tracecat Microsoft Sentinel integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Create incident comment

Action ID: `tools.microsoft_sentinel.create_incident_comment`

Create a comment on an incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="comment_id" type="string" required>

Comment ID (GUID).

</ParamField>

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="message" type="string" required>

Comment message text.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update alert rule

Action ID: `tools.microsoft_sentinel.create_or_update_alert_rule`

Create or update an alert rule in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="properties" type="object" required>

Alert rule properties including kind, displayName, enabled, query, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="rule_id" type="string" required>

Alert rule ID.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update bookmark

Action ID: `tools.microsoft_sentinel.create_or_update_bookmark`

Create or update a bookmark in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="bookmark_id" type="string" required>

Bookmark ID.

</ParamField>

<ParamField path="properties" type="object" required>

Bookmark properties including displayName, notes, query, labels, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update incident

Action ID: `tools.microsoft_sentinel.create_or_update_incident`

Create or update an incident in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="properties" type="object" required>

Incident properties including title, severity, status, description, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update incident relation

Action ID: `tools.microsoft_sentinel.create_or_update_incident_relation`

Create or update a relation for an incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="properties" type="object" required>

Relation properties including relatedResourceId.

</ParamField>

<ParamField path="relation_name" type="string" required>

Relation name (GUID).

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update watchlist

Action ID: `tools.microsoft_sentinel.create_or_update_watchlist`

Create or update a watchlist in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="properties" type="object" required>

Watchlist properties including displayName, provider, source, itemsSearchKey, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create or update watchlist item

Action ID: `tools.microsoft_sentinel.create_or_update_watchlist_item`

Create or update an item in a watchlist in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/create-or-update?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/create-or-update?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="properties" type="object" required>

Watchlist item properties including itemsKeyValue.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="watchlist_item_id" type="string" required>

Watchlist item ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Create threat intelligence indicator

Action ID: `tools.microsoft_sentinel.create_threat_intelligence_indicator`

Create a threat intelligence indicator in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/create?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/create?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="indicator_name" type="string" required>

Threat intelligence indicator name (GUID).

</ParamField>

<ParamField path="properties" type="object" required>

Indicator properties including kind, pattern, patternType, source, displayName, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete alert rule

Action ID: `tools.microsoft_sentinel.delete_alert_rule`

Delete an alert rule from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="rule_id" type="string" required>

Alert rule ID.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete bookmark

Action ID: `tools.microsoft_sentinel.delete_bookmark`

Delete a bookmark from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="bookmark_id" type="string" required>

Bookmark ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete incident

Action ID: `tools.microsoft_sentinel.delete_incident`

Delete an incident from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete incident comment

Action ID: `tools.microsoft_sentinel.delete_incident_comment`

Delete a comment from an incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="comment_id" type="string" required>

Comment ID.

</ParamField>

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete incident relation

Action ID: `tools.microsoft_sentinel.delete_incident_relation`

Delete a relation from an incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="relation_name" type="string" required>

Relation name.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete threat intelligence indicator

Action ID: `tools.microsoft_sentinel.delete_threat_intelligence_indicator`

Delete a threat intelligence indicator from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="indicator_name" type="string" required>

Threat intelligence indicator name.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete watchlist

Action ID: `tools.microsoft_sentinel.delete_watchlist`

Delete a watchlist from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Delete watchlist item

Action ID: `tools.microsoft_sentinel.delete_watchlist_item`

Delete an item from a watchlist in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/delete?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/delete?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="watchlist_item_id" type="string" required>

Watchlist item ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get alert rule

Action ID: `tools.microsoft_sentinel.get_alert_rule`

Get a specific alert rule by ID from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="rule_id" type="string" required>

Alert rule ID.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get alert rule template

Action ID: `tools.microsoft_sentinel.get_alert_rule_template`

Get a specific alert rule template by ID from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rule-templates/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rule-templates/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="alert_rule_template_id" type="string" required>

Alert rule template ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get bookmark

Action ID: `tools.microsoft_sentinel.get_bookmark`

Get a specific bookmark by ID from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="bookmark_id" type="string" required>

Bookmark ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get incident

Action ID: `tools.microsoft_sentinel.get_incident`

Get a specific incident by ID from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get incident relation

Action ID: `tools.microsoft_sentinel.get_incident_relation`

Get a specific relation for an incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="relation_name" type="string" required>

Relation name (GUID).

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get threat intelligence indicator

Action ID: `tools.microsoft_sentinel.get_threat_intelligence_indicator`

Get a specific threat intelligence indicator by name from Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicator/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="indicator_name" type="string" required>

Threat intelligence indicator name (GUID).

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get watchlist

Action ID: `tools.microsoft_sentinel.get_watchlist`

Get a specific watchlist by alias from Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Get watchlist item

Action ID: `tools.microsoft_sentinel.get_watchlist_item`

Get a specific item from a watchlist in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/get?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/get?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="watchlist_item_id" type="string" required>

Watchlist item ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List alert rule templates

Action ID: `tools.microsoft_sentinel.list_alert_rule_templates`

Get all alert rule templates available in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rule-templates/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rule-templates/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List alert rules

Action ID: `tools.microsoft_sentinel.list_alert_rules`

Get all alert rules in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List bookmarks

Action ID: `tools.microsoft_sentinel.list_bookmarks`

Get all bookmarks in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/bookmarks/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incident alerts

Action ID: `tools.microsoft_sentinel.list_incident_alerts`

Get all alerts related to a specific incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-alerts?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-alerts?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incident bookmarks

Action ID: `tools.microsoft_sentinel.list_incident_bookmarks`

Get all bookmarks related to a specific incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-bookmarks?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-bookmarks?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incident comments

Action ID: `tools.microsoft_sentinel.list_incident_comments`

Get all comments for a specific incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-comments/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incident entities

Action ID: `tools.microsoft_sentinel.list_incident_entities`

Get all entities related to a specific incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-entities?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list-entities?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incident relations

Action ID: `tools.microsoft_sentinel.list_incident_relations`

Get all relations for a specific incident in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incident-relations/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List incidents

Action ID: `tools.microsoft_sentinel.list_incidents`

Get all incidents in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression (e.g., "properties/status eq 'Active'").

Default: `null`.

</ParamField>

<ParamField path="orderby" type="string | null">

OData orderby expression (e.g., "properties/createdTimeUtc desc").

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string | null">

Skiptoken for pagination.

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of incidents to return.

Default: `null`.

</ParamField>

## List threat intelligence indicators

Action ID: `tools.microsoft_sentinel.list_threat_intelligence_indicators`

Get all threat intelligence indicators in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicators/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicators/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression.

Default: `null`.

</ParamField>

<ParamField path="orderby" type="string | null">

OData orderby expression.

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string | null">

Skiptoken for pagination.

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of indicators to return.

Default: `null`.

</ParamField>

## List watchlist items

Action ID: `tools.microsoft_sentinel.list_watchlist_items`

Get all items in a specific watchlist in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlist-items/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="watchlist_alias" type="string" required>

Watchlist alias.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## List watchlists

Action ID: `tools.microsoft_sentinel.list_watchlists`

Get all watchlists in Microsoft Sentinel workspace.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/list?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/list?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>

## Query threat intelligence indicators

Action ID: `tools.microsoft_sentinel.query_threat_intelligence_indicators`

Query threat intelligence indicators using advanced filters in Microsoft Sentinel.

Reference: [https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicators?view=rest-securityinsights-2025-09-01](https://learn.microsoft.com/en-us/rest/api/securityinsights/threat-intelligence-indicators?view=rest-securityinsights-2025-09-01)

### Secrets

Optional secrets:

- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_USER_TOKEN`.
- `microsoft_sentinel_oauth`: OAuth token `MICROSOFT_SENTINEL_SERVICE_TOKEN`.

### Input fields

<ParamField path="query" type="object" required>

Query parameters including keywords, patternTypes, sources, threatTypes, etc.

</ParamField>

<ParamField path="resource_group_name" type="string" required>

Azure resource group name.

</ParamField>

<ParamField path="subscription_id" type="string" required>

Azure subscription ID.

</ParamField>

<ParamField path="workspace_name" type="string" required>

Log Analytics workspace name.

</ParamField>

<ParamField path="api_version" type="string">

API version.

Default: `"2025-09-01"`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Azure Management API.

Default: `"https://management.azure.com"`.

Allowed values: `https://management.azure.com`, `https://management.usgovcloudapi.net`.

</ParamField>
