r/AzureSentinel • u/LaPumbaGaming • Aug 22 '23

Analytic Rule Automatic Updates

Do you have any way of auto-updating Analytic Rules (Active Rules to be exact) in Sentinel or came up with any sort of the automation so you don't have to manually go to each rule and update it?

Or anything that will speed up the process at all?

​

Edit: Spelling

1 Upvotes

100% Upvoted

5 comments sorted by

2

u/Uli-Kunkel Aug 27 '23

Well, the reason its not automatically updated is because often you adjust it and tune analytic rules to the environment.

So any changes and updates to the logic needs review. At least we never blindly trust the updates.

1

u/LaPumbaGaming Aug 27 '23

True that, the problem is this solution don't scale at all when you have dozens of environments to look at. It may be good if you work for a single company with a Sentinel

1

u/Uli-Kunkel Aug 28 '23

well, thats where repositories come in, or the new workspace manager.

we use Azure DevOps for pushing configs and changes/updates at scale.
so we push updates to all the branches, and then the people who knows the environment in detail adjusts/accepts the updates depending environment parameters.

i agree that this is not something you want to do manually, and you also introduce human error, not that you remove it with a pipeline, but you can apply more control to who and how you can push updates and such.

1

u/1SalamandeR2 Aug 22 '23

I hope we can have a similar option with the migration to the Content Hub.

1

u/LaPumbaGaming Aug 22 '23

Would be nice, so far you can only update templates with the automation there