def incident_show(incident_id, resource_group, workspace_name):
    """
    Returns the details of a specific incident in JSON format.
    """
    result = subprocess.run(
        [
            "az",
            "sentinel",
            "incident",
            "show",
            "--incident-id",
            incident_id,
            "--resource-group",
            resource_group,
            "--workspace-name",
            workspace_name,
        ],
        stdout=subprocess.PIPE,
    )
    jsObj = json.loads(result.stdout)
    return jsObj

    Returns the details of a specific incident in JSON format.
    
Solutions/CohesitySecurity/Tests/az.py