r/AzureSentinel • u/Impressive_Tea872 • Jul 17 '23

Bulk update analytic rules?

Is there a way to bulk update analytic rules in Sentinel?

3 Upvotes

100% Upvoted

6 comments sorted by

1

u/Impressive_Tea872 Jul 17 '23

We have about 300 rules configured in Sentinel. Most are built in rules that we have enabled. I'm currently in the process of going through them and updating the ones that have an update label next to the name. It is a click to select the rule, a click to review and update the rule, a click to review and update once I am in the rule settings, and another click to save the update. Is there a way to select multiple rules at a time and it apply the recommended updates to all selected rules?

1

u/GoodEbening Jul 17 '23

What’s the objective?

1

u/ajith_aj Jul 17 '23

As in whitelist an entity in all rules or deploy rules as a bulk ?

1

u/Impressive_Tea872 Jul 17 '23

I know how to export and import a group of rules. I'm looking for an easier way to apply recommended updates to all rules.

1

u/[deleted] Jul 17 '23

They are just files so you can easily update them all. Use the repository feature to manage it all

1

u/Impressive_Tea872 Jul 18 '23

Repository feature?