Workarounds for Azure Sentinel SIR Closure

[designitsecure]

Hello,

Has anyone implemented a workaround to have Sentinel close SIR incidents since the integration is not bi-directional in this regard?

Thanks!

[Pooja P]

Can you please confirm if we use this checkbox it will automatically update the status of sentinel and update SIR to closed from draft state?

[charankollapudi]

Its available in the 11.0.24 store version.
You can Enable the 'Pull Closed Incidents' option to fetch the closed incidents during the ingestion.

[Pooja P]

Hi @charankollapudi ,

Can you please confirm if we use this checkbox it will automatically update the status of sentinel and update SIR to closed from draft state?

[charankollapudi]

When polling closed incidents, the state of SIR corresponding to it will be in closed state.

[AJ_UK]

Hi @charankollapudi this is excellent news.

Do you know if an update will be written for the Documentation, as there doesn't yet appear to be an explanation of how to use the latest updates from what I can see.

Thanks, AJ