Blog Post

Microsoft Sentinel Blog
1 MIN READ

Azure Sentinel PowerShell Module Az.SecurityInsights has been released to GA!

Tiander Turpijn's avatar
Tiander Turpijn
Icon for Microsoft rankMicrosoft
May 26, 2021

We have just released our official Azure Sentinel PowerShell module Az.SecurityInsights which already has over 22.000 downloads and counting!

You can download it from here.

 

The Azure Sentinel Az.SecurityInsights PowerShell module helps you in automating your daily operational tasks, like interacting with incidents (assign owners, change severity, add comments, etc.), but also for creating and configuring analytics rules, data connectors and bookmarks.

 

Documentation including samples can be found here

Additional examples can be found on our Azure Sentinel GitHub repo

 

A frequent asked question is if our PowerShell module supports Azure Sentinel preview features.

Since our PowerShell module is officially supported, we support released features only at this point.

As soon as the preview features are released, we will support them through an update.

 

A big thank you to our customers, partners, MVP's, members of our security communities (like Tech Community) and our attendees joining our security events who have asked for this module and supported us in our journey to our release!

 

 

 

Updated Nov 03, 2021
Version 2.0
microsoft sentinel
powershell
security
  • ReganDangerCarey's avatar
    ReganDangerCarey
    Brass Contributor
    May 31, 2021

    Are there any plans for an official Sentinel CI/CD pipeline in something like Azure DevOps that uses this module? Would love to integrate the creation and deployment of connectors/analytics rules with some git workflows.

  • Jaa9H's avatar
    Jaa9H
    Copper Contributor
    Mar 29, 2022

    We are using the Microsoft Sentinel Powershell module to import and update Analytics Rules from downloaded YAML Templates in the https://github.com/Azure/Azure-Sentinel repo. These templates have added a new property to add Alert Enrichment, for example on Entity Mapping and Alert Override:

     

    entityMappings:
      - entityType: IP
         fieldMappings:
             - identifier: Address
               columnName: IPCustomEntity
    customDetails:
       NumberOfDenies: Count

    alertDetailsOverride:
       alertDisplayNameFormat: Some text
       alertDescriptionFormat: 'Some text'

     

    When will these properties be supported by the New-AzSentinelAlertRule and Update-AzSentinelAlertRule cmdlets?

     

    Jonny