diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
index ae881df1bd8e..cb060a4f9a18 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
@@ -2077,6 +2077,121 @@
         }
       }
     },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}/relations": {
+      "get": {
+        "x-ms-examples": {
+          "Get all relations of an entity.": {
+            "$ref": "./examples/entities/relations/GetAllEntityRelations.json"
+          }
+        },
+        "tags": [
+          "EntityRelations"
+        ],
+        "description": "Gets all relations of an entity.",
+        "operationId": "EntitiesRelations_List",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/EntityId"
+          },
+          {
+            "$ref": "#/parameters/ODataFilter"
+          },
+          {
+            "$ref": "#/parameters/ODataOrderBy"
+          },
+          {
+            "$ref": "#/parameters/ODataTop"
+          },
+          {
+            "$ref": "#/parameters/ODataSkipToken"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/RelationList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-odata": "#/definitions/Relation",
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}/relations/{relationName}": {
+      "get": {
+        "x-ms-examples": {
+          "Get an entity relation.": {
+            "$ref": "./examples/entities/relations/GetEntityRelationByName.json"
+          }
+        },
+        "tags": [
+          "EntityRelations"
+        ],
+        "description": "Gets an entity relation.",
+        "operationId": "EntityRelations_GetRelation",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/EntityId"
+          },
+          {
+            "$ref": "#/parameters/RelationName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/Relation"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      }
+    },
     "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/officeConsents": {
       "get": {
         "x-ms-examples": {
@@ -2462,6 +2577,604 @@
           }
         }
       }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents": {
+      "get": {
+        "x-ms-examples": {
+          "Get all incidents.": {
+            "$ref": "./examples/incidents/GetIncidents.json"
+          }
+        },
+        "tags": [
+          "Incidents"
+        ],
+        "description": "Gets all incidents.",
+        "operationId": "Incidents_List",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/ODataFilter"
+          },
+          {
+            "$ref": "#/parameters/ODataOrderBy"
+          },
+          {
+            "$ref": "#/parameters/ODataTop"
+          },
+          {
+            "$ref": "#/parameters/ODataSkipToken"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/IncidentList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}": {
+      "get": {
+        "x-ms-examples": {
+          "Get an incident.": {
+            "$ref": "./examples/incidents/GetIncidentById.json"
+          }
+        },
+        "tags": [
+          "Incidents"
+        ],
+        "description": "Gets an incident.",
+        "operationId": "Incidents_Get",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/Incident"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "put": {
+        "x-ms-examples": {
+          "Creates or updates an incident.": {
+            "$ref": "./examples/incidents/CreateIncident.json"
+          }
+        },
+        "tags": [
+          "Incidents"
+        ],
+        "description": "Creates or updates the incident.",
+        "operationId": "Incidents_CreateOrUpdate",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/Incident"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/Incident"
+            }
+          },
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/Incident"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "delete": {
+        "x-ms-examples": {
+          "Delete an incident.": {
+            "$ref": "./examples/incidents/DeleteIncident.json"
+          }
+        },
+        "tags": [
+          "Incidents"
+        ],
+        "description": "Delete the incident.",
+        "operationId": "Incidents_Delete",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "204": {
+            "description": "No Content"
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments": {
+      "get": {
+        "x-ms-examples": {
+          "Get all incident comments.": {
+            "$ref": "./examples/incidents/comments/GetAllIncidentComments.json"
+          }
+        },
+        "tags": [
+          "IncidentComments"
+        ],
+        "description": "Gets all incident comments.",
+        "operationId": "IncidentComments_ListByIncident",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/ODataFilter"
+          },
+          {
+            "$ref": "#/parameters/ODataOrderBy"
+          },
+          {
+            "$ref": "#/parameters/ODataTop"
+          },
+          {
+            "$ref": "#/parameters/ODataSkipToken"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/IncidentCommentList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-odata": "#/definitions/IncidentComment",
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}": {
+      "get": {
+        "x-ms-examples": {
+          "Get an incident comment.": {
+            "$ref": "./examples/incidents/comments/GetIncidentCommentById.json"
+          }
+        },
+        "tags": [
+          "IncidentComments"
+        ],
+        "description": "Gets an incident comment.",
+        "operationId": "IncidentComments_GetComment",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/IncidentCommentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/IncidentComment"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "put": {
+        "x-ms-examples": {
+          "Creates an incident comment.": {
+            "$ref": "./examples/incidents/comments/CreateIncidentComment.json"
+          }
+        },
+        "tags": [
+          "IncidentComments"
+        ],
+        "description": "Creates the incident comment.",
+        "operationId": "IncidentComments_CreateComment",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/IncidentCommentId"
+          },
+          {
+            "$ref": "#/parameters/IncidentComment"
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/IncidentComment"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations": {
+      "get": {
+        "x-ms-examples": {
+          "Get all incident relations.": {
+            "$ref": "./examples/incidents/relations/GetAllIncidentRelations.json"
+          }
+        },
+        "tags": [
+          "IncidentRelations"
+        ],
+        "description": "Gets all incident relations.",
+        "operationId": "IncidentRelations_List",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/ODataFilter"
+          },
+          {
+            "$ref": "#/parameters/ODataOrderBy"
+          },
+          {
+            "$ref": "#/parameters/ODataTop"
+          },
+          {
+            "$ref": "#/parameters/ODataSkipToken"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/RelationList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-odata": "#/definitions/Relation",
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}": {
+      "get": {
+        "x-ms-examples": {
+          "Get an incident relation.": {
+            "$ref": "./examples/incidents/relations/GetIncidentRelationByName.json"
+          }
+        },
+        "tags": [
+          "IncidentRelations"
+        ],
+        "description": "Gets an incident relation.",
+        "operationId": "IncidentRelations_GetRelation",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/RelationName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/Relation"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "put": {
+        "x-ms-examples": {
+          "Creates or updates an incident relation.": {
+            "$ref": "./examples/incidents/relations/CreateIncidentRelation.json"
+          }
+        },
+        "tags": [
+          "IncidentRelations"
+        ],
+        "description": "Creates or updates the incident relation.",
+        "operationId": "IncidentRelations_CreateOrUpdateRelation",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/RelationName"
+          },
+          {
+            "$ref": "#/parameters/Relation"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/Relation"
+            }
+          },
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/Relation"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "delete": {
+        "x-ms-examples": {
+          "Delete the incident relation.": {
+            "$ref": "./examples/incidents/relations/DeleteIncidentRelation.json"
+          }
+        },
+        "tags": [
+          "IncidentRelations"
+        ],
+        "description": "Delete the incident relation.",
+        "operationId": "IncidentRelations_DeleteRelation",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ApiVersion"
+          },
+          {
+            "$ref": "#/parameters/SubscriptionId"
+          },
+          {
+            "$ref": "#/parameters/ResourceGroupName"
+          },
+          {
+            "$ref": "#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/IncidentId"
+          },
+          {
+            "$ref": "#/parameters/RelationName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "204": {
+            "description": "No Content"
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "#/definitions/CloudError"
+            }
+          }
+        }
+      }
     }
   },
   "definitions": {
@@ -3860,6 +4573,29 @@
       },
       "type": "object"
     },
+    "ClientInfo": {
+      "description": "Information on the client (user or application) that made some action",
+      "properties": {
+        "email": {
+          "description": "The email of the client.",
+          "type": "string"
+        },
+        "name": {
+          "description": "The name of the client.",
+          "type": "string"
+        },
+        "objectId": {
+          "description": "The object id of the client.",
+          "format": "uuid",
+          "type": "string"
+        },
+        "userPrincipalName": {
+          "description": "The user principal name of the client.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "CloudApplicationEntity": {
       "allOf": [
         {
@@ -4857,135 +5593,471 @@
           "readOnly": true,
           "type": "string"
         },
-        "countryCode": {
-          "description": "The country code according to ISO 3166 format",
-          "readOnly": true,
+        "countryCode": {
+          "description": "The country code according to ISO 3166 format",
+          "readOnly": true,
+          "type": "string"
+        },
+        "countryName": {
+          "description": "Country name according to ISO 3166 Alpha 2: the lowercase of the English Short Name",
+          "readOnly": true,
+          "type": "string"
+        },
+        "latitude": {
+          "description": "The longitude of the identified location, expressed as a floating point number with range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code.",
+          "format": "double",
+          "readOnly": true,
+          "type": "number"
+        },
+        "longitude": {
+          "description": "The latitude of the identified location, expressed as a floating point number with range of - 90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code.",
+          "format": "double",
+          "readOnly": true,
+          "type": "number"
+        },
+        "state": {
+          "description": "State name",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "readOnly": true,
+      "type": "object"
+    },
+    "HostEntity": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/Entity"
+        }
+      ],
+      "description": "Represents a host entity.",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/HostEntityProperties",
+          "description": "Host entity properties",
+          "x-ms-client-flatten": true
+        }
+      },
+      "type": "object",
+      "x-ms-discriminator-value": "Host"
+    },
+    "HostEntityProperties": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/EntityCommonProperties"
+        }
+      ],
+      "description": "Host entity property bag.",
+      "properties": {
+        "azureID": {
+          "description": "The azure resource id of the VM.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "dnsDomain": {
+          "description": "The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain",
+          "readOnly": true,
+          "type": "string"
+        },
+        "hostName": {
+          "description": "The hostname without the domain suffix.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "isDomainJoined": {
+          "description": "Determines whether this host belongs to a domain.",
+          "readOnly": true,
+          "type": "boolean"
+        },
+        "netBiosName": {
+          "description": "The host name (pre-windows2000).",
+          "readOnly": true,
+          "type": "string"
+        },
+        "ntDomain": {
+          "description": "The NT domain that this host belongs to.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "omsAgentID": {
+          "description": "The OMS agent id, if the host has OMS agent installed.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "osFamily": {
+          "description": "The operating system type.",
+          "enum": [
+            "Linux",
+            "Windows",
+            "Android",
+            "IOS"
+          ],
+          "type": "string",
+          "x-ms-enum": {
+            "modelAsString": false,
+            "name": "OSFamily",
+            "values": [
+              {
+                "description": "Host with Linux operating system.",
+                "value": "Linux"
+              },
+              {
+                "description": "Host with Windows operating system.",
+                "value": "Windows"
+              },
+              {
+                "description": "Host with Android operating system.",
+                "value": "Android"
+              },
+              {
+                "description": "Host with IOS operating system.",
+                "value": "IOS"
+              }
+            ]
+          }
+        },
+        "osVersion": {
+          "description": "A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "Incident": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ResourceWithEtag"
+        }
+      ],
+      "description": "Represents an incident in Azure Security Insights.",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/IncidentProperties",
+          "description": "Incident properties",
+          "x-ms-client-flatten": true
+        }
+      },
+      "type": "object"
+    },
+    "IncidentAdditionalData": {
+      "description": "Incident additional data property bag.",
+      "properties": {
+        "alertsCount": {
+          "description": "The number of alerts in the incident",
+          "readOnly": true,
+          "type": "integer"
+        },
+        "bookmarksCount": {
+          "description": "The number of bookmarks in the incident",
+          "readOnly": true,
+          "type": "integer"
+        },
+        "commentsCount": {
+          "description": "The number of comments in the incident",
+          "readOnly": true,
+          "type": "integer"
+        },
+        "alertProductNames": {
+          "description": "List of product names of alerts in the incident",
+          "items": {
+            "description": "Alert product name",
+            "type": "string"
+          },
+          "readOnly": true,
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "IncidentComment": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/Resource"
+        }
+      ],
+      "description": "Represents an incident comment",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/IncidentCommentProperties",
+          "description": "Incident comment properties",
+          "x-ms-client-flatten": true
+        }
+      },
+      "type": "object"
+    },
+    "IncidentCommentList": {
+      "description": "List of incident comments.",
+      "properties": {
+        "nextLink": {
+          "description": "URL to fetch the next set of comments.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "value": {
+          "description": "Array of comments.",
+          "items": {
+            "$ref": "#/definitions/IncidentComment"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "value"
+      ]
+    },
+    "IncidentCommentProperties": {
+      "description": "Incident comment property bag.",
+      "properties": {
+        "createdTimeUtc": {
+          "description": "The time the comment was created",
+          "format": "date-time",
+          "readOnly": true,
+          "type": "string"
+        },
+        "message": {
+          "description": "The comment message",
+          "type": "string"
+        },
+        "author": {
+          "$ref": "#/definitions/ClientInfo",
+          "description": "Describes the client that created the comment",
+          "readOnly": true,
+          "type": "object"
+        }
+      },
+      "required": [
+        "message"
+      ],
+      "type": "object"
+    },
+    "IncidentLabel": {
+      "description": "Represents an incident label",
+      "properties": {
+        "labelName": {
+          "description": "The name of the label",
+          "type": "string"
+        },
+        "labelType": {
+          "description": "The type of the label",
+          "enum": [
+            "User",
+            "System"
+          ],
+          "type": "string",
+          "readOnly": true,
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "IncidentLabelType",
+            "values": [
+              {
+                "description": "Label manually created by a user",
+                "value": "User"
+              },
+              {
+                "description": "Label automatically created by the system",
+                "value": "System"
+              }
+            ]
+          }
+        }
+      },
+      "required": [
+        "labelName"
+      ],
+      "type": "object"
+    },
+    "IncidentList": {
+      "description": "List all the incidents.",
+      "properties": {
+        "nextLink": {
+          "description": "URL to fetch the next set of incidents.",
+          "readOnly": true,
+          "type": "string"
+        },
+        "value": {
+          "description": "Array of incidents.",
+          "items": {
+            "$ref": "#/definitions/Incident"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "value"
+      ]
+    },
+    "IncidentOwnerInfo": {
+      "description": "Information on the user an incident is assigned to",
+      "properties": {
+        "email": {
+          "description": "The email of the user the incident is assigned to.",
           "type": "string"
         },
-        "countryName": {
-          "description": "Country name according to ISO 3166 Alpha 2: the lowercase of the English Short Name",
-          "readOnly": true,
+        "assignedTo": {
+          "description": "The name of the user the incident is assigned to.",
           "type": "string"
         },
-        "latitude": {
-          "description": "The longitude of the identified location, expressed as a floating point number with range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code.",
-          "format": "double",
-          "readOnly": true,
-          "type": "number"
-        },
-        "longitude": {
-          "description": "The latitude of the identified location, expressed as a floating point number with range of - 90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code.",
-          "format": "double",
-          "readOnly": true,
-          "type": "number"
+        "objectId": {
+          "description": "The object id of the user the incident is assigned to.",
+          "format": "uuid",
+          "type": "string"
         },
-        "state": {
-          "description": "State name",
-          "readOnly": true,
+        "userPrincipalName": {
+          "description": "The user principal name of the user the incident is assigned to.",
           "type": "string"
         }
       },
-      "readOnly": true,
       "type": "object"
     },
-    "HostEntity": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/Entity"
-        }
-      ],
-      "description": "Represents a host entity.",
-      "properties": {
-        "properties": {
-          "$ref": "#/definitions/HostEntityProperties",
-          "description": "Host entity properties",
-          "x-ms-client-flatten": true
-        }
-      },
-      "type": "object",
-      "x-ms-discriminator-value": "Host"
-    },
-    "HostEntityProperties": {
-      "allOf": [
-        {
-          "$ref": "#/definitions/EntityCommonProperties"
-        }
-      ],
-      "description": "Host entity property bag.",
+    "IncidentProperties": {
+      "description": "Describes incident properties",
       "properties": {
-        "azureID": {
-          "description": "The azure resource id of the VM.",
+        "additionalData": {
+          "$ref": "#/definitions/IncidentAdditionalData",
+          "description": "Additional data on the incident",
           "readOnly": true,
-          "type": "string"
+          "type": "object"
         },
-        "dnsDomain": {
-          "description": "The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain",
-          "readOnly": true,
-          "type": "string"
+        "classification": {
+          "description": "The reason the incident was closed",
+          "enum": [
+            "Unknown",
+            "TruePositive",
+            "FalsePositive"
+          ],
+          "type": "string",
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "IncidentClassification",
+            "values": [
+              {
+                "description": "Incident classification was not set",
+                "value": "Unknown"
+              },
+              {
+                "description": "Incident was true positive",
+                "value": "TruePositive"
+              },
+              {
+                "description": "Incident was false positive",
+                "value": "FalsePositive"
+              }
+            ]
+          }
         },
-        "hostName": {
-          "description": "The hostname without the domain suffix.",
+        "createdTimeUtc": {
+          "description": "The time the incident was created",
+          "format": "date-time",
           "readOnly": true,
           "type": "string"
         },
-        "isDomainJoined": {
-          "description": "Determines whether this host belongs to a domain.",
-          "readOnly": true,
-          "type": "boolean"
+        "description": {
+          "description": "The description of the incident",
+          "type": "string"
         },
-        "netBiosName": {
-          "description": "The host name (pre-windows2000).",
-          "readOnly": true,
+        "firstActivityTimeUtc": {
+          "description": "The time of the first activity in the incident",
+          "format": "date-time",
           "type": "string"
         },
-        "ntDomain": {
-          "description": "The NT domain that this host belongs to.",
+        "incidentNumber": {
+          "description": "A sequential number",
           "readOnly": true,
+          "type": "integer"
+        },
+        "labels": {
+          "description": "List of labels relevant to this incident",
+          "items": {
+            "$ref": "#/definitions/IncidentLabel"
+          },
+          "type": "array"
+        },
+        "lastActivityTimeUtc": {
+          "description": "The time of the last activity in the incident",
+          "format": "date-time",
           "type": "string"
         },
-        "omsAgentID": {
-          "description": "The OMS agent id, if the host has OMS agent installed.",
+        "lastModifiedTimeUtc": {
+          "description": "The last time the incident was updated",
+          "format": "date-time",
           "readOnly": true,
           "type": "string"
         },
-        "osFamily": {
-          "description": "The operating system type.",
+        "owner": {
+          "$ref": "#/definitions/IncidentOwnerInfo",
+          "description": "Describes a user that the incident is assigned to",
+          "type": "object"
+        },
+        "severity": {
+          "description": "The severity of the incident",
           "enum": [
-            "Linux",
-            "Windows",
-            "Android",
-            "IOS"
+            "High",
+            "Medium",
+            "Low",
+            "Informational"
           ],
           "type": "string",
           "x-ms-enum": {
-            "modelAsString": false,
-            "name": "OSFamily",
+            "modelAsString": true,
+            "name": "IncidentSeverity",
             "values": [
               {
-                "description": "Host with Linux operating system.",
-                "value": "Linux"
+                "description": "High severity",
+                "value": "High"
               },
               {
-                "description": "Host with Windows operating system.",
-                "value": "Windows"
+                "description": "Medium severity",
+                "value": "Medium"
               },
               {
-                "description": "Host with Android operating system.",
-                "value": "Android"
+                "description": "Low severity",
+                "value": "Low"
               },
               {
-                "description": "Host with IOS operating system.",
-                "value": "IOS"
+                "description": "Informational severity",
+                "value": "Informational"
               }
             ]
           }
         },
-        "osVersion": {
-          "description": "A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration",
-          "readOnly": true,
+        "status": {
+          "description": "The status of the incident",
+          "enum": [
+            "New",
+            "Active",
+            "Closed"
+          ],
+          "type": "string",
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "IncidentStatus",
+            "values": [
+              {
+                "description": "An active incident which isn't being handled currently",
+                "value": "New"
+              },
+              {
+                "description": "An active incident which is being handled",
+                "value": "Active"
+              },
+              {
+                "description": "A non-active incident",
+                "value": "Closed"
+              }
+            ]
+          }
+        },
+        "title": {
+          "description": "The title of the incident",
           "type": "string"
         }
       },
+      "required": [
+        "title",
+        "severity",
+        "status"
+      ],
       "type": "object"
     },
     "IpEntity": {
@@ -5783,6 +6855,69 @@
       },
       "type": "object"
     },
+    "RelationList": {
+      "description": "List of relations.",
+      "properties": {
+        "nextLink": {
+          "readOnly": true,
+          "description": "URL to fetch the next set of relations.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Array of relations.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Relation"
+          }
+        }
+      },
+      "required": [
+        "value"
+      ]
+    },
+    "Relation": {
+      "type": "object",
+      "description": "Represents a relation between two resources",
+      "allOf": [
+        {
+          "$ref": "#/definitions/ResourceWithEtag"
+        }
+      ],
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/RelationProperties",
+          "description": "Relation properties",
+          "x-ms-client-flatten": true
+        }
+      }
+    },
+    "RelationProperties": {
+      "description": "Relation property bag.",
+      "properties": {
+        "relatedResourceId": {
+          "description": "The resource ID of the related resource",
+          "type": "string"
+        },
+        "relatedResourceName": {
+          "description": "The name of the related resource",
+          "type": "string"
+        },
+        "relatedResourceType": {
+          "description": "The resource type of the related resource",
+          "readOnly": true,
+          "type": "string"
+        },
+        "relatedResourceKind": {
+          "description": "The resource kind of the related resource",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "required": [
+        "relatedResourceId"
+      ],
+      "type": "object"
+    },
     "Resource": {
       "description": "An azure resource object",
       "properties": {
@@ -6700,7 +7835,7 @@
           "type": "string",
           "x-ms-enum": {
             "modelAsString": true,
-            "name": "IncidentSeverity",
+            "name": "CaseSeverity",
             "values": [
               {
                 "description": "Critical severity",
@@ -6932,6 +8067,42 @@
       "type": "string",
       "x-ms-parameter-location": "method"
     },
+    "Incident": {
+      "description": "The incident",
+      "in": "body",
+      "name": "incident",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/Incident"
+      },
+      "x-ms-parameter-location": "method"
+    },
+    "IncidentComment": {
+      "description": "The incident comment",
+      "in": "body",
+      "name": "incidentComment",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/IncidentComment"
+      },
+      "x-ms-parameter-location": "method"
+    },
+    "IncidentCommentId": {
+      "description": "Incident comment ID",
+      "in": "path",
+      "name": "incidentCommentId",
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "IncidentId": {
+      "description": "Incident ID",
+      "in": "path",
+      "name": "incidentId",
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
     "ODataFilter": {
       "description": "Filters the results, based on a Boolean condition. Optional.",
       "in": "query",
@@ -6973,6 +8144,16 @@
       "type": "string",
       "x-ms-parameter-location": "method"
     },
+    "Relation": {
+      "name": "relation",
+      "in": "body",
+      "description": "The relation model",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/Relation"
+      },
+      "x-ms-parameter-location": "method"
+    },
     "ResourceGroupName": {
       "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
       "in": "path",
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetAllEntityRelations.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetAllEntityRelations.json
new file mode 100644
index 000000000000..8019900f524f
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetAllEntityRelations.json
@@ -0,0 +1,29 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "entityId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "type": "Microsoft.SecurityInsights/entities/relations",
+            "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+            "properties": {
+              "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/2216d0e1-91e3-4902-89fd-d2df8c535096",
+              "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+              "relatedResourceType": "Microsoft.SecurityInsights/incidents"
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetEntityRelationByName.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetEntityRelationByName.json
new file mode 100644
index 000000000000..d6c273d1b9c9
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/entities/relations/GetEntityRelationByName.json
@@ -0,0 +1,26 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "entityId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
+    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/entities/relations",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+        "properties": {
+          "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceType": "Microsoft.SecurityInsights/incidents"
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/CreateIncident.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/CreateIncident.json
new file mode 100644
index 000000000000..b1a86dc43404
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/CreateIncident.json
@@ -0,0 +1,93 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "incident": {
+      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+      "properties": {
+        "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
+        "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
+        "description": "This is a demo incident",
+        "title": "My incident",
+        "owner": {
+          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
+        },
+        "severity": "High",
+        "classification": "FalsePositive",
+        "status": "Closed"
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "type": "Microsoft.SecurityInsights/incidents",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
+        "properties": {
+          "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
+          "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
+          "description": "This is a demo incident",
+          "title": "My incident",
+          "owner": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "assignedTo": "john doe"
+          },
+          "severity": "High",
+          "classification": "FalsePositive",
+          "status": "Closed",
+          "incidentNumber": 3177,
+          "labels": [],
+          "additionalData": {
+            "alertsCount": 0,
+            "bookmarksCount": 0,
+            "commentsCount": 3,
+            "alertProductNames": []
+          }
+        }
+      }
+    },
+    "201": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "type": "Microsoft.SecurityInsights/incidents",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
+        "properties": {
+          "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
+          "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
+          "description": "This is a demo incident",
+          "title": "My incident",
+          "owner": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "assignedTo": "john doe"
+          },
+          "severity": "High",
+          "classification": "FalsePositive",
+          "status": "Closed",
+          "incidentNumber": 3177,
+          "labels": [],
+          "additionalData": {
+            "alertsCount": 0,
+            "bookmarksCount": 0,
+            "commentsCount": 3,
+            "alertProductNames": []
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/DeleteIncident.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/DeleteIncident.json
new file mode 100644
index 000000000000..bfd04662497a
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/DeleteIncident.json
@@ -0,0 +1,14 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+  },
+  "responses": {
+    "200": {},
+    "204": {}
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidentById.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidentById.json
new file mode 100644
index 000000000000..878f03ee4baa
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidentById.json
@@ -0,0 +1,45 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "type": "Microsoft.SecurityInsights/incidents",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+        "properties": {
+          "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
+          "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
+          "description": "This is a demo incident",
+          "title": "My incident",
+          "owner": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "assignedTo": "john doe"
+          },
+          "severity": "High",
+          "classification": "FalsePositive",
+          "status": "Closed",
+          "incidentNumber": 3177,
+          "labels": [],
+          "additionalData": {
+            "alertsCount": 0,
+            "bookmarksCount": 0,
+            "commentsCount": 3,
+            "alertProductNames": []
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidents.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidents.json
new file mode 100644
index 000000000000..7c54eae94a42
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/GetIncidents.json
@@ -0,0 +1,50 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "$orderby": "properties/createdTimeUtc desc",
+    "$top": 1
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "type": "Microsoft.SecurityInsights/incidents",
+            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+            "properties": {
+              "lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
+              "createdTimeUtc": "2019-01-01T13:15:30Z",
+              "lastActivityTimeUtc": "2019-01-01T13:05:30Z",
+              "firstActivityTimeUtc": "2019-01-01T13:00:30Z",
+              "description": "This is a demo incident",
+              "title": "My incident",
+              "owner": {
+                "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                "email": "john.doe@contoso.com",
+                "userPrincipalName": "john@contoso.com",
+                "assignedTo": "john doe"
+              },
+              "severity": "High",
+              "classification": "FalsePositive",
+              "status": "Closed",
+              "incidentNumber": 3177,
+              "labels": [],
+              "additionalData": {
+                "alertsCount": 0,
+                "bookmarksCount": 0,
+                "commentsCount": 3,
+                "alertProductNames": []
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json
new file mode 100644
index 000000000000..e82cacf4bc78
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/CreateIncidentComment.json
@@ -0,0 +1,35 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "incidentCommentId": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+    "incidentComment": {
+      "properties": {
+        "message": "Some message"
+      }
+    }
+  },
+  "responses": {
+    "201": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/comments",
+        "properties": {
+          "message": "Some message",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "author": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "name": "john doe"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json
new file mode 100644
index 000000000000..87dbdd886e30
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetAllIncidentComments.json
@@ -0,0 +1,33 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "type": "Microsoft.SecurityInsights/incidents/comments",
+            "properties": {
+              "message": "Some message",
+              "createdTimeUtc": "2019-01-01T13:15:30Z",
+              "author": {
+                "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                "email": "john.doe@contoso.com",
+                "userPrincipalName": "john@contoso.com",
+                "name": "john doe"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json
new file mode 100644
index 000000000000..fe757de317b3
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/comments/GetIncidentCommentById.json
@@ -0,0 +1,30 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "incidentCommentId": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/comments",
+        "properties": {
+          "message": "Some message",
+          "createdTimeUtc": "2019-01-01T13:15:30Z",
+          "author": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "userPrincipalName": "john@contoso.com",
+            "name": "john doe"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/CreateIncidentRelation.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/CreateIncidentRelation.json
new file mode 100644
index 000000000000..bbc267ef2842
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/CreateIncidentRelation.json
@@ -0,0 +1,44 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
+    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+    "relation": {
+      "properties": {
+        "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096"
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/relations",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+        "properties": {
+          "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
+        }
+      }
+    },
+    "201": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/relations",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+        "properties": {
+          "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/DeleteIncidentRelation.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/DeleteIncidentRelation.json
new file mode 100644
index 000000000000..c0ebcb3647ab
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/DeleteIncidentRelation.json
@@ -0,0 +1,15 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
+    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
+  },
+  "responses": {
+    "200": {},
+    "204": {}
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetAllIncidentRelations.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetAllIncidentRelations.json
new file mode 100644
index 000000000000..9fda5d1dfb05
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetAllIncidentRelations.json
@@ -0,0 +1,41 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+            "type": "Microsoft.SecurityInsights/incidents/relations",
+            "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+            "properties": {
+              "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
+              "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+              "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
+            }
+          },
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/9673a17d-8bc7-4ca6-88ee-38a4f3efc032",
+            "name": "9673a17d-8bc7-4ca6-88ee-38a4f3efc032",
+            "type": "Microsoft.SecurityInsights/incidents/relations",
+            "etag": "6f714025-dd7c-46aa-b5d0-b9857488d060",
+            "properties": {
+              "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/1dd267cd-8a1f-4f6f-b92c-da43ac8819af",
+              "relatedResourceName": "1dd267cd-8a1f-4f6f-b92c-da43ac8819af",
+              "relatedResourceType": "Microsoft.SecurityInsights/entities",
+              "relatedResourceKind": "SecurityAlert"
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetIncidentRelationByName.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetIncidentRelationByName.json
new file mode 100644
index 000000000000..22cc32e2554f
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/incidents/relations/GetIncidentRelationByName.json
@@ -0,0 +1,26 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
+    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
+        "type": "Microsoft.SecurityInsights/incidents/relations",
+        "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
+        "properties": {
+          "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096",
+          "relatedResourceType": "Microsoft.SecurityInsights/bookmarks"
+        }
+      }
+    }
+  }
+}