Create a Word report of all Microsoft Sentinel solution resources


Microsoft Sentinel has solutions, under Content hub, that can be used to install multiple Microsoft Sentinel resources at one time. These resources include

  • Data connectors
  • Analytic Rules
  • Hunting Queries
  • Workbooks
  • Playbooks
  • Parsers

This makes is much easier to install what you need when you need it. With the upcoming change coming so that all the out-of-the-box content is moving to solutions (see Out-of-the-box (OOTB) content centralization changes – Microsoft Sentinel | Microsoft Learn for more information), it is more imperative that you know what each solution will provide or which solution to install to get the resources you want.

You can click on each solution and see what it contains, but that is a bit of a pain. With that in mind, I have created a PowerShell script that will create a Word document that contains this information.

The script, and a Word document that contains all the information, is available at garybushey/CreateSolutionReport: Create a word document showing all the resources in all the MS Sentinel solutions (

The Script

There really isn’t anything too special about this script. I did have to do some research on how to create a Word document through PowerShell, but there are plenty of web pages that provide that information. It actually took me longer to decide how to format the document (and I hope you like it) than to write the code to generate the file.

The rest of the script was just figuring out how all the information was stored.


This script will generate a Word document containing all the resources in all the Microsoft Sentinel solutions. Hope it helps!

2 thoughts on “Create a Word report of all Microsoft Sentinel solution resources

  • I do think that this will be helpful but I have a few suggestions:
    1. identify the status of the solution – enabled/disabled
    2. for the headings that don’t have any data, put n/a or something to indicate this

    • In regards to Dean’s comments:
      1) This would entail a much more complicated solution, since the calls I make don’t give me that information and it really isn’t what I was trying to do with this code
      2) I had that before but I didn’t think it looked that good. It is easy enough to add if you want it.

Leave a Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.