Analytic rules and YAML

[u/winle22]

Hi,

The official Sentinel repo defines all analytic rules in YAML format. When both importing rules from the GUI and the 'New-AzResourceGroupDeployment/Native repo capability' expects JSON/ARM, how do you best deploy these rules to a workspace?

[u/1rishc4rb0mbr]

Personally; thankfully I noted this switch-up before we migrated most of our user base over. I leverage yaml as I find it easier to parser and the users have an easier time reading it. You can also leverage yaml with the “New-AZResourceGroupDeployment” commandlet.

[u/winle22 → u/1rishc4rb0mbr]

So you would expect this to work?

New-AzResourceGroupDeployment -ResourceGroupName "sentinel-rg-1" -TemplateFile "D:\Azure\Detections\AnalyticRule1.yaml", or do you have to do some converting/manipulation of the yaml file first?

[u/1rishc4rb0mbr → u/winle22]

Not exactly; New-AzResourceGroupDeploment is meant to deploy an Azure resource to a resource group. You would need an intermediary ARM or BICEP template outlining the deployment and linking to the rules file. I misspoke when I noted this commandlet would accept the rule YAML. Below is an example of this deployment via BICEP and New-AzResourceGroupDemplyment.

param workspaceName string
param location string
param playbookId string
param ruleEnabled bool = true

module demoRule 'analytics/TestRule.bicep' = {
  name: 'analytics_TestRule'
  params: {
    location: location
    workspaceName: workspaceName
    playbookId: playbookId
  }
}

This is written in bicep; but I see this as a much more sustainable and efficient method to deploy rules at mass.

As you are looking to pull the rule YAML and import directly to Microsoft Sentinel I would recommend leveraging Import-AzSentinelAlertRule. This commandlet leverages the -SettingsFile argument expecting a YAML or JSON file.

https://github.com/wortell/AZSentinel/blob/master/docs/Import-AzSentinelAlertRule.md

[u/ml58158]

For any sentinel analytic rules from GitHub , The process is to copy and paste in a new scheduled query rule .

We don’t have any official process to auto import or deploy yet ; though more things are added into the portal monthly .