Question

I am attempting to update an Azure Sentinel incident label using msticpy. I can successfully modify other properties, but labels is not accepting the API call. Could anyone provide insight?

环境

• 机器学习室说明

缩略语

    from msticpy.data.azure import AzureData, MicrosoftSentinel
    azs = MicrosoftSentinel()
    azs.connect()
    azs.update_incident(incident_id = "INCIDENTID8", update_items = { labels : 
    [{ labelName :  test ,  labelType :  User }]})

错误:

HTTPStatus错误: Client error 400 Bad Request for url https://management.azure.com/subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.OperationalInsights/workspaces/WORKSPACE/providers/Microsoft.SecurityInsights/incidents/INCIDENTID?api-version=2020-01-01 For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400

Answer 1

您需要使用<代码>get_incident方法,首先返还一个事件物体。然后,你可以更改或添加来自那里的标签。

incident_id = "GUID HERE" # You can pass a name to get_incident, but it s not guaranteed to be unique
incident = azs.get_incident(incident_id)

new_label_name = "test"
new_label_type = "user"
new_label = IncidentLabel(label_name=new_label_name, label_type=new_label_type)

incident.labels[new_label_name] = new_label

azs.update_incident(incident)

友情链接