Create multiple Microsoft Sentinel rules from rule templates – The Next Generation

Introduction Just over three years ago I wrote a blog post and code about how to create multiple rules from Microsoft Sentinel analytic rule template. A lot has changed in that three years. Not only have new features been added to Microsoft Sentinel, but I have learned better ways to work with PowerShell. With all […]

Generate report of Microsoft Sentinel Analytic rules that can be updated.

Introduction I have heard from many people that they would like to be able to see which rules need to be updated. There is currently no easy way to do this in the Microsoft Sentinel portal. You can go through each page and see which ones have the “Update Available” tag in the name, but […]

Create a Word Document report from a Microsoft Sentinel Incident

Introduction I recall reading a post where someone asked if there was a way to generate a word document when an incident was closed for reporting purposes. There is no built-in way, but by using a Playbook, a Team’s site (or other SharePoint site), and a Word template, you can do this. The Playbook, Word […]

Programmatically enable Microsoft Sentinel solutions

Introduction One last post for 2022! Microsoft Sentinel has the Content Hub which, at the time this post was written, is still in preview. Inside the Content Hub are two types of entries: Solutions and Standalone contents. Standalone contents are pretty new and are just single entities that can be enabled and be listed using […]

Extract Microsoft Sentinel MITRE information to CSV file – Part III

Introduction Some exciting news! I have updated the “Export-AzSentinelMITREToCSV.ps1” file so that the individual rules can be saved to the CSV file instead of just the counts. This can be found in my GitHub repo here An older version of this can be found in the official Microsoft Sentinel GitHub repo located here. I am […]

Mimic drilldown in a Microsoft Sentinel workbook – Part II

Overview Another Saturday, another blog post. In a completely unrelated note, I really miss Saturday morning cartoons 🙂 I was watching the latest Microsoft Security Insights show (Microsoft Security Insights Show Ep. 103 – YouTube) and saw some workbooks that Jing Nghik had created. In one spot he showed a spot where a workbook could […]

Get or Export Microsoft Sentinel Automation rules

Introduction I ran across a question where someone was asking how to extract Microsoft Sentinel automation rules. I had thought the functionality was already in the automation rules, but I was wrong. There is the functionality for analytic rules, but it is not yet there for automation rules. I had some simple PowerShell scripts that […]

Azure KQL: Access sub-columns using the bag_unpack plugin

Overview When accessing information using KQL, sometimes you have a column that contains sub-columns that you want to access. There are a couple of different ways to obtain this information and I will show you two ways in this blog post. The first way will be to extract each column individually. While this works and, […]