MicrosoftSentinelSetOwner
This script can be run from the War Room or used by a layout to set the Owner field in Microsoft Sentinel.
python · Microsoft Sentinel
Details
| ID | MicrosoftSentinelSetOwner |
|---|---|
| Language | python |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | dynamic-section |
README
This script can be run from the War Room or used by a layout to set the Owner field in Microsoft Sentinel.
Note: The Owner field in Cortex XSOAR can only be modified when the Mirroring Direction in the Instance Settings is set to Incoming or Incoming and Outgoing.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | dynamic-section |
| Cortex XSOAR Version | 5.5.0 |
Inputs
| Argument Name | Description | Required |
|---|---|---|
| owner_email | The owner email to set as the user principal name. If there is a user in Microsoft Sentinel for this email, they will be represented by their name in the remote incident and will be mirrored with all their details. Otherwise, only the email will be displayed on the remote incident, and only the email will be mirrored, with the rest of the details null. | Required |
| incident_id | The ID of the remote incident to update. Relevant only when the script is called directly from the War Room. | Optional (Required When the script is called directly from the War Room) |
Outputs
| Path | Description | Type |
|---|---|---|
| AzureSentinel.Incident.ID | The incident ID. | String |
| AzureSentinel.Incident.Title | The incident’s title. | String |
| AzureSentinel.Incident.Description | Description of the incident. | String |
| AzureSentinel.Incident.Severity | The incident severity. | String |
| AzureSentinel.Incident.Status | The incident status. | String |
| AzureSentinel.Incident.AssigneeName | The name of the incident assignee. | String |
| AzureSentinel.Incident.AssigneeEmail | The email address of the incident assignee. | String |
| AzureSentinel.Incident.AssigneeObjectID | The object ID of the incident assignee. | string |
| AzureSentinel.Incident.AssigneeUPN | The user principal name of the incident assignee. | string |
| AzureSentinel.Incident.Label.Name | The name of the incident label. | String |
| AzureSentinel.Incident.Label.Type | The incident label type. | String |
| AzureSentinel.Incident.FirstActivityTimeUTC | The date and time of the incident’s first activity. | Date |
| AzureSentinel.Incident.LastActivityTimeUTC | The date and time of the incident’s last activity. | Date |
| AzureSentinel.Incident.LastModifiedTimeUTC | The date and time the incident was last modified. | Date |
| AzureSentinel.Incident.CreatedTimeUTC | The date and time the incident was created. | Date |
| AzureSentinel.Incident.IncidentNumber | The incident number. | Number |
| AzureSentinel.Incident.AlertsCount | The number of alerts in the incident. | Number |
| AzureSentinel.Incident.BookmarkCount | The number of bookmarks in the incident. | Number |
| AzureSentinel.Incident.CommentCount | The number of comments in the incident. | Number |
| AzureSentinel.Incident.AlertProductNames | The alert product names of the incident. | String |
| AzureSentinel.Incident.Tactics | The incident’s tactics. | String |
| AzureSentinel.Incident.FirstActivityTimeGenerated | The incident’s generated first activity time. | Date |
| AzureSentinel.Incident.LastActivityTimeGenerated | The incident’s generated last activity time. | Date |
| AzureSentinel.Incident.Etag | The Etag of the incident. | String |
args: - name: user_principal_name required: true description: The owner email to set as the user principal name. If a user associated with this email exists in Microsoft Sentinel, their full name and details will be displayed and mirrored in the remote system. If no such user exists, only the email will be displayed and mirrored, with all other details remaining null. - name: incident_id required: false description: The ID of the remote incident to update. Relevant only when the script is called directly from the War Room. commonfields: id: MicrosoftSentinelSetOwner version: -1 comment: This script can be run from the War Room or used by a layout to set the Owner field in Microsoft Sentinel. name: MicrosoftSentinelSetOwner outputs: - contextPath: AzureSentinel.Incident.ID description: The incident ID. type: String - contextPath: AzureSentinel.Incident.Title description: The incident's title. type: String - contextPath: AzureSentinel.Incident.Description description: Description of the incident. type: String - contextPath: AzureSentinel.Incident.Severity description: The incident severity. type: String - contextPath: AzureSentinel.Incident.Status description: The incident status. type: String - contextPath: AzureSentinel.Incident.AssigneeName description: The name of the incident assignee. type: String - contextPath: AzureSentinel.Incident.AssigneeEmail description: The email address of the incident assignee. type: String - contextPath: AzureSentinel.Incident.AssigneeObjectID description: The object ID of the incident assignee. type: string - contextPath: AzureSentinel.Incident.AssigneeUPN description: The user principal name of the incident assignee. type: string - contextPath: AzureSentinel.Incident.Label.Name description: The name of the incident label. type: String - contextPath: AzureSentinel.Incident.Label.Type description: The incident label type. type: String - contextPath: AzureSentinel.Incident.FirstActivityTimeUTC description: The date and time of the incident's first activity. type: Date - contextPath: AzureSentinel.Incident.LastActivityTimeUTC description: The date and time of the incident's last activity. type: Date - contextPath: AzureSentinel.Incident.LastModifiedTimeUTC description: The date and time the incident was last modified. type: Date - contextPath: AzureSentinel.Incident.CreatedTimeUTC description: The date and time the incident was created. type: Date - contextPath: AzureSentinel.Incident.IncidentNumber description: The incident number. type: Number - contextPath: AzureSentinel.Incident.AlertsCount description: The number of alerts in the incident. type: Number - contextPath: AzureSentinel.Incident.BookmarkCount description: The number of bookmarks in the incident. type: Number - contextPath: AzureSentinel.Incident.CommentCount description: The number of comments in the incident. type: Number - contextPath: AzureSentinel.Incident.AlertProductNames description: The alert product names of the incident. type: String - contextPath: AzureSentinel.Incident.Tactics description: The incident's tactics. type: String - contextPath: AzureSentinel.Incident.FirstActivityTimeGenerated description: The incident's generated first activity time. type: Date - contextPath: AzureSentinel.Incident.LastActivityTimeGenerated description: The incident's generated last activity time. type: Date - contextPath: AzureSentinel.Incident.Etag description: The Etag of the incident. type: String script: "-" tags: - dynamic-section timeout: "0" type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 fromversion: 5.5.0 tests: - No tests (auto formatted)