MicrosoftSentinelSubmitNewComment

Use this script to add a comment which will then be mirrored as a comment to a Sentinal event. This script should be run within an incident.

python · Microsoft Sentinel

Details

ID	`MicrosoftSentinelSubmitNewComment`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	dynamic-section

README

Use this script to add a comment which will then be mirrored as a comment to a Sentinal event. This script should be run within an incident.

Note: Comments in Cortex XSOAR can only be added when the Mirroring Direction in the Instance Settings is set to Incoming or Incoming and Outgoing.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description	Required
new_comment	The comment text to be added to the incident comments.	Required
incident_id	The ID of the incident to add the comment to. This argument is relevant only when the script is called directly from the War Room.	Optional (Required When the script is called directly from the War Room).

Outputs

Path	Description	Type
AzureSentinel.AddComment.InstanceName	The name of the instance where the comment is added.	string
AzureSentinel.AddComment.IncidentId	The ID of the incident where the comment was added.	string
AzureSentinel.AddComment.Message	The message of the comment added to the incident.	string

Source

MicrosoftSentinelSubmitNewComment.py MicrosoftSentinelSubmitNewComment_test.py MicrosoftSentinelSubmitNewComment.yml

Download History Raw

args:
- name: new_comment
  required: true
  description: The comment text to be added to the incident comments.
- name: incident_id
  required: false
  description: The ID of the incident to add the comment to. This argument is relevant only when the script is called directly from the War Room.
commonfields:
  id: MicrosoftSentinelSubmitNewComment
  version: -1
comment: Use this script to add a comment which will then be mirrored as a comment to a Sentinal event. This script should be run within an incident.
name: MicrosoftSentinelSubmitNewComment
outputs:
- contextPath: AzureSentinel.AddComment.InstanceName
  type: string
  description: The name of the instance where the comment is added.
- contextPath: AzureSentinel.AddComment.IncidentId
  type: string
  description: The ID of the incident where the comment was added.
- contextPath: AzureSentinel.AddComment.Message
  type: string
  description: The message of the comment added to the incident.
script: "-"
tags:
- dynamic-section
timeout: "0"
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 5.5.0
tests:
- No tests (auto formatted)