MS365DefenderAddComment

Use this script to add a comment to a Microsoft 365 Defender incident. To be run within the incident.

python · Microsoft 365 Defender

Details

IDMS365DefenderAddComment
Languagepython
From Version6.10.0
Docker Imagedemisto/crypto:1.0.0.10120494
TagsMicrosoft 365 Defender

Source

MS365DefenderAddComment.py MS365DefenderAddComment_test.py MS365DefenderAddComment.yml
Download History Raw 
args:
- description: Comment to be added to the incident in Microsoft 365 Defender.
  name: comment
  required: true
- description: Specify the Microsoft 365 Defender ID of the incident. If not specified, it will use the microsoft365defenderid from the incident.
  name: id
- description: Specify the instance to be used. If not specified, it will run using all available instances.
  name: instance_name
comment: Use this script to add a comment to a Microsoft 365 Defender incident. To be run within the incident.
commonfields:
  id: MS365DefenderAddComment
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
dependson:
  must:
  - '|||microsoft-365-defender-incident-update'
dockerimage: demisto/crypto:1.0.0.10120494
enabled: true
name: MS365DefenderAddComment
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags:
- Microsoft 365 Defender
type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)