Forum Discussion

JMSHW0420's avatar
JMSHW0420
Iron Contributor
May 18, 2024

How to clone or duplicate an Analytic Rule in Microsoft Sentinel using PowerShell

How can you clone or duplicate an Analytic Rule that resides in Microsoft Sentinel using either PowerShell or Azure CLI?

The cloned Analytic Rule will require a new ruleId and name but all other properties can remain the same.

I have tried using the Sentinel-related PowerShell module and functions...

$resourceGroupName = "XYZ"
$workspaceName = "abc"

# Get all analytic rules
$analyticRules = Get-AzSentinelAlertRule -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName

foreach ($rule in $analyticRules) {

# Duplicate each rule
$newRule = $rule
$newRule.DisplayName = "_" + $rule.DisplayName
$newRule.Id = $null # Clear ID for new rule creation

# Create the duplicated rule
# /// New-AzOperationalInsightsSavedSearch -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName -Properties $newRule.Properties
#? New-AzSentinelAlertRule ? parameters to add

}

Resources