Viewing Incidents in an Azure Sentinel Workbook

I was playing around with workbooks and noticed that there is a new preview Data Source called Azure Resource Manager. When I selected it I noticed that the Path it wanted begins with /subscription so I thought I would try it with the URL to get Incidents from Sentinel. Lo and behold it worked! It […]

Microsoft improving the Azure Sentinel REST API

I was looking the latest changes MS made to the Azure Sentinel REST API (available at and noticed that they now have an entire section called “incidents” that can be used just as “cases” could before. This makes more sense since, during the beta, Alerts created “cases” but now they create “incidents” . This […]

Create multiple Azure Sentinel rules from selected templates

Introduction IMHO, one of the biggest PITA when setting up a new instance of Azure Sentinel is that while Microsoft gives you all these great Analytic rule templates, you have to select each, one at a time, to create a rule from them. These PowerShell scripts will avoid that. First, there is a PowerShell command, […]