There is a Microsoft Sentinel feature currently in public preview that allow you to deploy custom Sentinel content from DevOps or GitHub, such as analytic rules. The linked article provides instructions on how to setup the connection between your Sentinel instance, however doesn’t provide details on what format your content files should be within DevOps.

ARM templates

As with nearly everything in Azure thankfully (for consistency) it uses ARM templates, and there is documentation outlining the ARM template schema for alert rules (aka analytics). However when I tried using the format indicated by the documentation I couldn’t get the deployment working.

Quickstart templates to the rescue

Doing some further investigation found that there is a fully functioning sample template available which does work, and its format does differ from the ARM template schema I’d first discovered.

Keep in mind the ARM template schema documentation is still useful, as it contains the full schema definition for all possible scenarios, which aren’t all covered in the quick start sample.

By Andrew

Leave a Reply

Your email address will not be published. Required fields are marked *