services / Azure / Microsoft Sentinel incident

A Microsoft Sentinel incident aggregating related alerts, entities, and analyst activity into the primary case record for security investigation and response.

Incidents are the SOC's investigation and response record; deleting or tampering with them destroys the audit trail of an attack, so the resource type is HIGH.

Microsoft.​SecurityInsights/​incidents/​write

Updating an incident lets an attacker close it, downgrade its severity, or reassign it to bury an active detection and mislead responders.

Risks

1. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links