For those customers looking to add more to the comments section of Microsoft Sentinel Incidents, you can now provide a bit more context and content.
One of the top asks from customers for improving Microsoft Sentinel was that the 3k character limitation in commenting could be bumped up. This has now been increased to 30k per comment.
Commenting per Incident is limited to 100 comments.
Additional commenting capability is still under review. For example, I heard from customers last week (and many times in the past) that it would be nice to provide attachment capability. And, while this can already be accomplished by utilizing the Microsoft Teams integration or the Link feature (store the attachment in blog storage), it does seem valuable to have a lightweight attachment facility.
=========================
[Want to discuss this further? Hit me up on Twitter or LinkedIn]
[Subscribe to the RSS feed for this blog]
[Subscribe to the Weekly Microsoft Sentinel Newsletter]
[Subscribe to the Weekly Microsoft Defender Newsletter]
[Learn KQL with the Must Learn KQL series and book]
You must log in to post a comment.