Forum Discussion
Documenting an existing Sentinel configuration
Does anyone have any suggestions about good approaches for documenting an existing Sentinel configuration, e.g., creating a report that lists all of the connectors, active rules, watchlists, automation rules, workbooks, notebooks etc.?
The follow up question is, does anyone have any good suggestions for documenting changes to the configuration?
1 Reply
- You can open the "Workspace Usage" workbook from within the Azure Sentinel UI, it has the majority, there is also a "Data connectors" workbook as well.
