Share via

Incident Relations - Create Or Update

Service:
Sentinel
API Version:
2025-09-01

Creates or updates a relation for a given incident.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}?api-version=2025-09-01

URI Parameters

Name In Required Type Description
incidentId
 path True

string

Incident ID
relationName
 path True

string

minLength: 3
maxLength: 63
pattern: ^[a-zA-Z0-9-]{3,63}$

Relation Name
resourceGroupName
 path True

string

minLength: 1
maxLength: 90

The name of the resource group. The name is case insensitive.
subscriptionId
 path True

string (uuid)

The ID of the target subscription. The value must be an UUID.
workspaceName
 path True

string

minLength: 1
maxLength: 90
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

The name of the workspace.
api-version
 query True

string

minLength: 1

The API version to use for this operation.

Request Body

Name Required Type Description
properties.relatedResourceId True

string

The resource ID of the related resource
etag

string

Etag of the azure resource

Responses

Name Type Description
200 OK

Relation

OK
201 Created

Relation

Created
Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Creates or updates an incident relation.

Sample request

PUT https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014?api-version=2025-09-01

{
  "properties": {
    "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096"
  }
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
  "type": "Microsoft.SecurityInsights/incidents/relations",
  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
  "properties": {
    "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
    "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
    "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
  }
}
Status code:
201 
{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
  "type": "Microsoft.SecurityInsights/incidents/relations",
  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
  "properties": {
    "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
    "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
    "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
  }
}

Definitions

Name Description
CloudError

Error response structure.
CloudErrorBody

Error details.
createdByType

The type of identity that created the resource.
Relation

Represents a relation between two resources
systemData

Metadata pertaining to creation and last modification of the resource.

CloudError

Object

Error response structure.

Name Type Description
error

CloudErrorBody

Error data

CloudErrorBody

Object

Error details.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message

string

A message describing the error, intended to be suitable for display in a user interface.

createdByType

Enumeration

The type of identity that created the resource.

Value Description
User
Application
ManagedIdentity
Key

Relation

Object

Represents a relation between two resources

Name Type Description
etag

string

Etag of the azure resource
id

string (arm-id)

Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name

string

The name of the resource
properties.relatedResourceId

string

The resource ID of the related resource
properties.relatedResourceKind

string

The resource kind of the related resource
properties.relatedResourceName

string

The name of the related resource
properties.relatedResourceType

string

The resource type of the related resource
systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string (date-time)

The timestamp of resource creation (UTC).
createdBy

string

The identity that created the resource.
createdByType

createdByType

The type of identity that created the resource.
lastModifiedAt

string (date-time)

The timestamp of resource last modification (UTC)
lastModifiedBy

string

The identity that last modified the resource.
lastModifiedByType

createdByType

The type of identity that last modified the resource.