Forum Discussion
How to sync automation rules from Github to Sentinel
Hi,
As for the analytics rule synced from Github to Sentinel, we could just simply export the rules and import it to github. However, I am not able to export the automation rules to json file and could not find the guide for the sync.
Could you provide some guidance on it? Thanks
- Have you looked at using a MS Sentinel repository to push all the rules (I am guessing you when you say repo you mean a Github repo and not MS Sentinel repository).
BTW, I wrote some PowerShell scripts to extract automation rules and a blog post about it. https://www.garybushey.com/2022/05/08/get-or-export-microsoft-sentinel-automation-rules/
Steven_Su It does not look like the MS Sentinel PowerShell (https://www.powershellgallery.com/packages/Az.SecurityInsights/1.1.0) has added the functionality for automation yet so you would need to use the REST API. You can go to azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-10-01-preview at main ยท Azure/azure-rest-api-specs (github.com) to get the information on how to make the calls.
I would think you would need to make a call to LIST all the automation rules and then either break apart the returned JSON to save each one individually or just use it to get the individual rule's ID. Then you can make a call to GET each individual rule and save it.
- Hi Gary,Thanks for your prompt reply.
Actually what we want to do is to use repo in github to deploy and maintain the analytic rules and automation rules attached. It is easy for analytic rules but difficult for automation rules.
We only have few playbooks like creating ticket but we will applied it to each analytics rule. So we wanna see if there is any approach to do so.- Have you looked at using a MS Sentinel repository to push all the rules (I am guessing you when you say repo you mean a Github repo and not MS Sentinel repository).
BTW, I wrote some PowerShell scripts to extract automation rules and a blog post about it. https://www.garybushey.com/2022/05/08/get-or-export-microsoft-sentinel-automation-rules/
