There is a command group 'az_sentinel_incident'. This group of commands could 'manage incident with sentinel'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_sentinel_incident_update'.The syntax is: az sentinel incident update [--add]
                            [--classification {benignpositive, falsepositive, truepositive, undetermined}]
                            [--classification-comment]
                            [--classification-reason {inaccuratedata, incorrectalertlogic, suspiciousactivity, suspiciousbutexpected}]
                            [--description]
                            [--etag]
                            [--first-activity-time-utc]
                            [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                            [--ids]
                            [--incident-id]
                            [--labels]
                            [--last-activity-time-utc]
                            [--owner]
                            [--provider-incident-id]
                            [--provider-name]
                            [--remove]
                            [--resource-group]
                            [--set]
                            [--severity {high, informational, low, medium}]
                            [--status {active, closed, new}]
                            [--subscription]
                            [--title]
                            [--workspace-name]. The parameter '--add' is optional. add an object to a list of objects by specifying a path and key value pairs.  example: --add property.listproperty <key=value, string or json string>.. The parameter '--classification' is optional. the reason the incident was closed.. The parameter '--classification-comment' is optional. describes the reason the incident was closed.. The parameter '--classification-reason' is optional. the classification reason the incident was closed with.. The parameter '--description' is optional. the description of the incident.. The parameter '--etag' is optional. etag of the azure resource.. The parameter '--first-activity-time-utc' is optional. the time of the first activity in the incident.. The parameter '--force-string' is optional. when using 'set' or 'add', preserve string literals instead of attempting to convert to json.. The parameter '--ids' is optional. one or more resource ids (space-delimited). it should be a complete resource id containing all information of 'resource id' arguments. you should provide either --ids or other 'resource id' arguments.. The parameter '--incident-id --name -n' is optional. incident id.. The parameter '--labels' is optional. list of labels relevant to this incident  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--last-activity-time-utc' is optional. the time of the last activity in the incident.. The parameter '--owner' is optional. describes a user that the incident is assigned to  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--provider-incident-id' is optional. the incident id assigned by the incident provider.. The parameter '--provider-name' is optional. the name of the source provider that generated the incident.. The parameter '--remove' is optional. remove a property or an element from a list.  example: --remove property.list <indextoremove> or --remove propertytoremove.. The parameter '--resource-group -g' is optional. name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--set' is optional. update an object by specifying a property path and value to set.  example: --set property1.property2=<value>.. The parameter '--severity' is optional. the severity of the incident.. The parameter '--status' is optional. the status of the incident.. The parameter '--subscription' is optional. name or id of subscription. you can configure the default subscription using `az account set -s name_or_id`.. The parameter '--title' is optional. the title of the incident.. The parameter '--workspace-name -w' is optional. the name of the workspace.. 