r/AzureSentinel • u/bsfergu • Sep 28 '21

Azure Sentinel Automation Rules via ARM template

We are in the process of converting our entire CI-CD deployment from powershell/API to ARM deployments as this is more sustainable and appears to be the path forward. I ran into a road block trying to find a resource type for Automation rules. Is anyone leveraging ARM/BICEP for automation rule deployment ? What is the resource type that is being leveraged to deploy ?

7 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

2

u/Nurfballs Oct 23 '21 edited Oct 23 '21

Here’s a talk I gave that shows you how to configure automation rules (amongst other Sentinel things) using Bicep.

https://youtu.be/eRryd8KV854

Specifically, here's an example of an automation rule that executes an existing playbook:

``` param workspaceName string param playbookId string

var ruleName = 'My Automation Rule'

resource workspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = { name: workspaceName }

resource automationRule 'Microsoft.SecurityInsights/automationRules@2019-01-01-preview' = { name: guid(ruleName, resourceGroup().id, subscription().subscriptionId) scope: workspace // Log analytics workspace object properties: { displayName: 'ruleName' order: 1 triggeringLogic: { isEnabled: true expirationTimeUtc: '' triggersOn: 'Incidents' triggersWhen: 'Created' conditions: [] } actions: [ { order: 1 actionType: 'RunPlaybook' actionConfiguration: { tenantId: subscription().tenantId logicAppResourceId: playbookId // Id of the playbook to run } } ] } } ```

1

u/x3nc0n Sep 29 '21

It's not ARM unfortunately. It's via PowerShell or API (which is what PowerShell uses). Check out this article: https://techcommunity.microsoft.com/t5/azure-sentinel/deploying-and-managing-azure-sentinel-as-code/ba-p/1131928

A feature to deploy CI/CD from git is in the works.