diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
index 682ca4c40b17..89fcb4acd112 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
@@ -3150,14 +3150,14 @@
       },
       "put": {
         "x-ms-examples": {
-          "Creates an incident comment.": {
+          "Creates or updates an incident comment.": {
             "$ref": "./examples/incidents/comments/CreateIncidentComment.json"
           }
         },
         "tags": [
           "IncidentComments"
         ],
-        "description": "Creates the incident comment.",
+        "description": "Creates or updates the incident comment.",
         "operationId": "IncidentComments_CreateComment",
         "parameters": [
           {
@@ -3186,6 +3186,12 @@
           }
         ],
         "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/IncidentComment"
+            }
+          },
           "201": {
             "description": "Created",
             "schema": {
@@ -3199,6 +3205,55 @@
             }
           }
         }
+      },
+      "delete": {
+        "x-ms-examples": {
+          "Delete the incident comment.": {
+            "$ref": "./examples/incidents/comments/DeleteIncidentComment.json"
+          }
+        },
+        "tags": [
+          "IncidentComments"
+        ],
+        "description": "Delete the incident comment.",
+        "operationId": "IncidentComments_DeleteComment",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/IncidentCommentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "204": {
+            "description": "No Content"
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
       }
     },
     "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/entities": {
@@ -6939,7 +6994,7 @@
     "IncidentComment": {
       "allOf": [
         {
-          "$ref": "#/definitions/Resource"
+          "$ref": "#/definitions/ResourceWithEtag"
         }
       ],
       "description": "Represents an incident comment",
@@ -6981,6 +7036,12 @@
           "readOnly": true,
           "type": "string"
         },
+        "lastModifiedTimeUtc": {
+          "description": "The time the comment was updated",
+          "format": "date-time",
+          "readOnly": true,
+          "type": "string"
+        },
         "message": {
           "description": "The comment message",
           "type": "string"
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json
index e82cacf4bc78..40faabcdc088 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json
@@ -14,14 +14,35 @@
     }
   },
   "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/comments",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+        "properties": {
+          "message": "Some message",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastModifiedTimeUtc": "2019-01-03T11:10:30Z",
+          "author": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "name": "john doe"
+          }
+        }
+      }
+    },
     "201": {
       "body": {
         "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
         "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
         "type": "Microsoft.SecurityInsights/incidents/comments",
+        "etag": "190057d0-0000-0d00-0000-5c622adb0000",
         "properties": {
           "message": "Some message",
           "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
           "author": {
             "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
             "email": "john.doe@contoso.com",
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/DeleteIncidentComment.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/DeleteIncidentComment.json
new file mode 100644
index 000000000000..77d29e520f83
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/DeleteIncidentComment.json
@@ -0,0 +1,15 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "incidentCommentId": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
+  },
+  "responses": {
+    "200": {},
+    "204": {}
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json
index 87dbdd886e30..b820b7626c63 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json
@@ -15,9 +15,11 @@
             "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
             "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
             "type": "Microsoft.SecurityInsights/incidents/comments",
+            "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
             "properties": {
               "message": "Some message",
               "createdTimeUtc": "2019-01-01T13:15:30Z",
+              "lastModifiedTimeUtc": "2019-01-03T11:10:30Z",
               "author": {
                 "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
                 "email": "john.doe@contoso.com",
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json
index fe757de317b3..315f614edc5e 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json
@@ -14,9 +14,11 @@
         "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
         "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
         "type": "Microsoft.SecurityInsights/incidents/comments",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
         "properties": {
           "message": "Some message",
           "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastModifiedTimeUtc": "2019-01-03T11:10:30Z",
           "author": {
             "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
             "email": "john.doe@contoso.com",