Fix Update-AzSentinelIncident docs: clarify required params and add pipeline example by coder999999999 · Pull Request #29294 · Azure/azure-powershell

coder999999999 · 2026-03-23T02:05:22Z

Description

The Update-AzSentinelIncident documentation lists -Title, -Status, and -Severity as optional parameters. However, the underlying Sentinel REST API uses PUT (not PATCH), meaning these fields are required — omitting any of them results in an error:

Update-AzSentinelIncident : 'Title' must have a non-empty value
Update-AzSentinelIncident : status must not be empty.

Changes

Example 1: Added a note clarifying that -Title, -Status, and -Severity are required by the API
Example 2 (new): Added a pipeline example showing how to update an incident using -InputObject while preserving required fields from the original incident
ChangeLog.md: Updated with change descriptions

Files Changed

src/SecurityInsights/SecurityInsights.Autorest/examples/Update-AzSentinelIncident.md
src/SecurityInsights/SecurityInsights.Autorest/docs/Update-AzSentinelIncident.md
src/SecurityInsights/SecurityInsights/help/Update-AzSentinelIncident.md
src/SecurityInsights/SecurityInsights/ChangeLog.md

Documentation-only change
Tested manually against Sentinel workspace

azure-client-tools-bot-prd · 2026-03-23T02:05:25Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

microsoft-github-policy-service · 2026-03-23T02:06:50Z

Thank you for your contribution @coder999999999! We will review the pull request and get back to you soon.

Copilot

Pull request overview

This PR updates the Az.SecurityInsights documentation for Update-AzSentinelIncident to reflect Sentinel’s PUT semantics where Title, Status, and Severity must be provided, and it adds an additional example intended to show how to update using -InputObject.

Changes:

Added a note explaining that -Title, -Status, and -Severity are required by the underlying API.
Added a new Example 2 showing an update flow using -InputObject while preserving required fields.
Updated ChangeLog.md with release notes for the documentation fix.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/SecurityInsights/SecurityInsights/help/Update-AzSentinelIncident.md	Adds the note + new example to the published help markdown.
src/SecurityInsights/SecurityInsights.Autorest/docs/Update-AzSentinelIncident.md	Mirrors the note + new example in the AutoRest docs output.
src/SecurityInsights/SecurityInsights.Autorest/examples/Update-AzSentinelIncident.md	Mirrors the note + new example in the examples file.
src/SecurityInsights/SecurityInsights/ChangeLog.md	Adds upcoming release entries describing the doc changes.

Copilot · 2026-03-23T02:09:58Z

src/SecurityInsights/SecurityInsights/help/Update-AzSentinelIncident.md

+### Example 2: Update an Incident using the InputObject (pipeline) pattern
+```powershell
+$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
+$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
+$labels[-1].LabelName = "Reviewed"
+Update-AzSentinelIncident -InputObject $incident -Title $incident.Title -Status $incident.Status -Severity $incident.Severity -Label $labels


Example 2 is described as using the "pipeline" pattern, but the sample doesn’t actually use the PowerShell pipeline (it assigns to $incident and calls Update-AzSentinelIncident directly). Please either revise the wording to just describe using -InputObject, or update the sample to use a real pipeline-based flow (for example by piping the incident into a script block/ForEach-Object that calls Update-AzSentinelIncident).

Copilot · 2026-03-23T02:09:58Z

src/SecurityInsights/SecurityInsights.Autorest/docs/Update-AzSentinelIncident.md

+### Example 2: Update an Incident using the InputObject (pipeline) pattern
+```powershell
+$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
+$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
+$labels[-1].LabelName = "Reviewed"
+Update-AzSentinelIncident -InputObject $incident -Title $incident.Title -Status $incident.Status -Severity $incident.Severity -Label $labels


Example 2 is labeled as a "pipeline" pattern, but the code isn’t actually pipeline-based. Please either remove/adjust the "pipeline" wording or rewrite the example to genuinely use pipeline input when calling Update-AzSentinelIncident (for example by piping the incident into a script block that preserves required fields).

Copilot · 2026-03-23T02:09:58Z

src/SecurityInsights/SecurityInsights.Autorest/examples/Update-AzSentinelIncident.md

+### Example 2: Update an Incident using the InputObject (pipeline) pattern
+```powershell
+$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
+$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
+$labels[-1].LabelName = "Reviewed"
+Update-AzSentinelIncident -InputObject $incident -Title $incident.Title -Status $incident.Status -Severity $incident.Severity -Label $labels


This example is described as a "pipeline" pattern, but it doesn’t actually demonstrate PowerShell pipeline input (no use of '|'). Consider renaming it to "using -InputObject" or changing the example to a true pipeline flow.

Copilot · 2026-03-23T02:09:59Z

src/SecurityInsights/SecurityInsights/ChangeLog.md

+* Fixed documentation for `Update-AzSentinelIncident` to clarify that `-Title`, `-Status`, and `-Severity` are required by the API [#29130]
+* Added pipeline example showing how to update an incident using `-InputObject` while preserving required fields


The second Upcoming Release entry mentions a "pipeline example", but the added documentation example isn’t currently pipeline-based. Also, since this changelog update is part of fixing issue #29130, it would be helpful to include the issue reference on this bullet as well (consistent with the first bullet).

…ipeline example (Azure#29130) The -Title, -Status, and -Severity parameters are required by the underlying Sentinel API (which uses PUT, not PATCH) even though the cmdlet signature marks them as optional. Omitting any of them results in an error. Changes: - Added a note to Example 1 explaining the requirement - Added Example 2 showing the -InputObject pipeline pattern with the required fields passed through from the original incident - Updated ChangeLog.md

NoriZC · 2026-03-24T03:04:35Z

/azp run

azure-pipelines · 2026-03-24T03:04:51Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

src/SecurityInsights/SecurityInsights.Autorest/generate-info.json:1

The repository build/generation scripts expect each *.Autorest submodule to include a generate-info.json (tooling reads it to decide whether regeneration is needed and errors if it’s missing). Removing it from SecurityInsights.Autorest is likely to break those scripts; please restore the file (or update the tooling if this submodule is intentionally exempt).

Copilot · 2026-03-24T03:11:58Z

src/SecurityInsights/SecurityInsights.Autorest/examples/README.md

@@ -0,0 +1,11 @@
+# Examples
+This directory contains examples from the exported cmdlets of the module. When `build-module.ps1` is ran, example stub files will be generated here. If your module support Azure Profiles, the example stubs will be in individual profile folders. These example stubs should be updated to show how the cmdlet is used. The examples are imported into the documentation when `generate-help.ps1` is ran.


Grammar issues in this sentence make the guidance harder to read (e.g., “is ran” and “module support”). Please update to standard phrasing (“is run”, “module supports”, etc.).

Copilot · 2026-03-24T03:11:59Z

src/SecurityInsights/SecurityInsights.Autorest/examples/README.md

+- Packaged: no
+
+## Purpose
+This separates the example documentation details from the generated documentation information provided directly from the generated cmdlets. Since the cmdlets don't have examples from the REST spec, this provides a means to add examples easily. The example stubs provide the markdown format that is required. The 3 core elements are: the name of the example, the code information of the example, and the description of the example. That information, if the markdown format is followed, will be available to documentation generation and be part of the documents in the `..\docs` folder.


The path shown as ..\docs is Windows-specific; in Markdown/docs guidance it’s typically clearer and cross-platform to use ../docs (forward slash). Please update the path format for consistency and to avoid confusion.

Copilot · 2026-03-24T03:11:59Z

src/SecurityInsights/SecurityInsights.Autorest/docs/Update-AzSentinelIncident.md

+$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
+$labels[-1].LabelName = "Reviewed"


Example 2 appends a new label using $incident.Label + ... and then uses $labels[-1]. If the incident has no existing labels, $labels can be a scalar and indexing will fail. Make sure $labels is always an array before indexing/appending (e.g., wrap the existing value into an array first).

Suggested change

$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()

$labels[-1].LabelName = "Reviewed"

$newLabel = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()

$newLabel.LabelName = "Reviewed"

$labels = @($incident.Label) + $newLabel

Copilot · 2026-03-24T03:11:59Z

src/SecurityInsights/SecurityInsights.Autorest/examples/Update-AzSentinelIncident.md

+### Example 2: Update an Incident using InputObject
+```powershell
+$incident = Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Id "4a21e485-75ae-48b3-a7b9-e6a92bcfe434"
+$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()


In Example 2, $labels is created with $incident.Label + ... and then indexed ($labels[-1]). If the incident has no labels, $incident.Label may be $null and $labels[-1] will fail. Initialize $labels as an array before indexing/appending so the example works for incidents without existing labels.

Suggested change

$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()

$labels = @($incident.Label) + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()

Copilot · 2026-03-24T03:12:00Z

src/SecurityInsights/SecurityInsights.Autorest/Properties/AssemblyInfo.cs

 [assembly: System.Reflection.AssemblyTitleAttribute("Microsoft Azure PowerShell - SecurityInsights")]
-[assembly: System.Reflection.AssemblyFileVersionAttribute("3.2.1")]
-[assembly: System.Reflection.AssemblyVersionAttribute("3.2.1")]
+[assembly: System.Reflection.AssemblyFileVersionAttribute("0.1.0.0")]
+[assembly: System.Reflection.AssemblyVersionAttribute("0.1.0.0")]


This PR is marked as “documentation-only”, but it changes assembly version metadata in a generated AssemblyInfo file. If this wasn’t intentional, revert these version changes; if it is intentional, ensure the assembly versioning strategy is consistent with the module versioning/release process and explain why this change is required for the doc fix.

NoriZC · 2026-03-24T03:19:11Z

/azp run

azure-pipelines · 2026-03-24T03:19:26Z

Azure Pipelines successfully started running 3 pipeline(s).

…ipeline example (#29294) Co-authored-by: coder999999999 <coder999999999@users.noreply.github.com> Co-authored-by: Nori Zhang <norizhang@microsoft.com>

Copilot AI review requested due to automatic review settings March 23, 2026 02:05

microsoft-github-policy-service bot added the customer-reported label Mar 23, 2026

Copilot started reviewing on behalf of coder999999999 March 23, 2026 02:07 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

coder999999999 added 2 commits March 22, 2026 22:25

Address review: rename 'pipeline pattern' to 'using InputObject'

4bb8f9e

coder999999999 force-pushed the fix/update-sentinel-incident-docs-29130 branch from 93bf57c to 4bb8f9e Compare March 23, 2026 02:25

NoriZC added 2 commits March 24, 2026 14:02

generate info

7f55595

remove changelog because pure doc updates

fa292dd

Copilot AI review requested due to automatic review settings March 24, 2026 03:03

Copilot started reviewing on behalf of NoriZC March 24, 2026 03:06 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

generate info

95ad7a6

NoriZC mentioned this pull request Mar 24, 2026

Fix Update-AzSentinelIncident help examples to include required parameters #29293

Closed

4 tasks

VeryEarly approved these changes Mar 24, 2026

View reviewed changes

VeryEarly enabled auto-merge (squash) March 24, 2026 03:18

NoriZC self-assigned this Mar 24, 2026

NoriZC added the Waiting for CI label Mar 24, 2026

VeryEarly merged commit 1b79ce0 into Azure:main Mar 24, 2026
13 checks passed

		* Fixed documentation for `Update-AzSentinelIncident` to clarify that `-Title`, `-Status`, and `-Severity` are required by the API [#29130]
		* Added pipeline example showing how to update an incident using `-InputObject` while preserving required fields

		@@ -0,0 +1,11 @@
		# Examples
		This directory contains examples from the exported cmdlets of the module. When `build-module.ps1` is ran, example stub files will be generated here. If your module support Azure Profiles, the example stubs will be in individual profile folders. These example stubs should be updated to show how the cmdlet is used. The examples are imported into the documentation when `generate-help.ps1` is ran.

		$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
		$labels[-1].LabelName = "Reviewed"

-$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
-$labels[-1].LabelName = "Reviewed"
+$newLabel = [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
+$newLabel.LabelName = "Reviewed"
+$labels = @($incident.Label) + $newLabel

	$labels = $incident.Label + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()
	$labels = @($incident.Label) + [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Models.Api20210901Preview.IncidentLabel]::new()

Conversation

coder999999999 commented Mar 23, 2026

Description

Changes

Files Changed

Uh oh!

azure-client-tools-bot-prd bot commented Mar 23, 2026

Uh oh!

microsoft-github-policy-service bot commented Mar 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

NoriZC commented Mar 24, 2026

Uh oh!

azure-pipelines bot commented Mar 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

NoriZC commented Mar 24, 2026

Uh oh!

azure-pipelines bot commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants