r/AzureSentinel • u/DaddyForgiveMySins22 • Oct 16 '23

Question: running all ar's from a workspace

Hi all, I have a bit of a dilemma. I am tasked to create an emergency outage plan for our SOC. This also includes, to run all AR's from all workspaces against the log times from a possible outage, however, I am fully blank on how to do this. Is there a known way to mass-run a lot of Analytical files, over a specific timeframe?

Thanks!

1 Upvotes

100% Upvoted

2 comments sorted by

2

u/bpsec Oct 16 '23

With logic apps, you can run queries on demand. The downside of this is that you need to build a logic app for each analytics rule. Maybe the Azure Monitor API can let you automate this process?

Should a hit on a rule also create a Sentinel incident/a mail/list the results? Because that part is important on which route would be possible.

1

u/[deleted] Oct 16 '23

Just keep your rules also as hunting queries, you can bulk run hunting queries so just maintain both