AzureTracksJan 2, 2025
Sentinel Tip - Keep Analytics Rules Relevant: Update Mitre Att&ck Properties and KQL queries to reflect periodic updates to your environment, changes in your cloud and on-premises environments, and changing attacks in the wild. #SOC #Governance #AnalyticsRules #HuntingQueries
Fabian BaderNov 5, 2023

New release of SentinelARConverter now available in the #PowerShell gallery.

v2.2.1 is optimized to use the resulting ARM files in a #Git repository since it always uses the same order for all properties.

In addition to that you now can add a prefix to the ANR name using the new NamePrefix parameter

#Sentinel #CICD #GitHub #AnalyticsRules

https://github.com/f-bader/SentinelARConverter

GitHub - f-bader/SentinelARConverter: Sentinel Analytics Rule converter PowerShell module

Sentinel Analytics Rule converter PowerShell module - GitHub - f-bader/SentinelARConverter: Sentinel Analytics Rule converter PowerShell module

GitHub
Fabian BaderFeb 19, 2023

Converting #Sentinel #AnalyticsRules from #ARM to #YAML and back hasn't been as easy as it should be.
Until now! 🥳

Today I share my #PowerShell module that makes #sharing of Analytics Rules super easy.

Check out my blog post for more info
https://cloudbrothers.info/en/convert-sentinel-analytics-rules/

Convert Sentinel Analytics Rules with PowerShell

If you have worked with Microsoft Sentinel you will, at one point, stumbled over two different file formats for Analytics Rules: YAML and ARM. The YAML format is mostly used to distribute Analytics Rules between people. All Analytics Rules you will find in the official Sentinel GitHub repo and others out there are offered in this format. The ARM format is what you need to deploy the Analytics Rules when using a pipeline or even if you want to import them using the UI in Microsoft Sentinel.

Fabian BaderDec 11, 2022

❓ Have you already visited https://analyticsrules.exchange/

I added two new features today.

1. You now can deploy any of the analytics rules directly from the website using "Deploy to Azure"

2. The ARM JSON is included on the analytics rules site

#Sentinel #Azure #ARM #AnalyticsRules #security #Microsoft

Microsoft Sentinel Analytic Rules

Microsoft Sentinel Analytic Rules
Fabian BaderDec 6, 2022

Dynamic alert details - The force awakens

#Sentinel #Microsoft #Security #AnalyticsRules

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/dynamic-alert-details-the-force-awakens/ba-p/3690747?WT.mc_id=AZ-MVP-5004810

Dynamic alert details - The force awakens

About year ago, we released the alert enrichment blog post covering a few new (at the time) capabilities in scheduled analytics rules. The dynamic alert details section explained why and how we can set the name, description, severity and MITRE ATT&CK tactics. This resulted in many users thinking to ...

TECHCOMMUNITY.MICROSOFT.COM
Show threadFabian BaderNov 20, 2022

Want to know how I do it? I just released my latest blog post on how I create this, always up to date, website using #GitHubActions #hugo #markdown #PowerShell and #GitHubPages

#Sentinel #AnalyticsRules #Kusto #YAML #Security

https://cloudbrothers.info/en/analyticsrules-exchange/

AnalyticsRules.Exchange

Over the weekend I finished a really fun project I had in mind for a couple of weeks. My newest website: AnalyticsRules.Exchange In this post I will explain the reason why I created this new website, as well on how I did it. At the moment I will not publish the code, not because I don’t want to share it, but because it’s super ugly and not something I want to be a source for other people to start with.

Fabian BaderNov 18, 2022

Hello mastodon #infosec friends, I built a new website to better search for #Sentinel #AnalyticsRules.

https://analyticsrules.exchange

It is a searchable and filterable list of all Analytics rules in the public repository built automatically twice a day.

Feedback welcome

Microsoft Sentinel Analytic Rules

Microsoft Sentinel Analytic Rules