Lookup of one Analytics Rule in Another

Question

Hi Guys,&nbsp;&nbsp;I am trying to create one new rule in Sentinel Analytics which calls/Lookups another previously created Analytics Rule. How can i achieve that, could you kindly provide an input. It will be of great Help.&nbsp;

garybushey · Answer

kmanish&nbsp; Not really sure what your scenario is here.&nbsp; Do you want a new alert to start only after a different alert is created?&nbsp; &nbsp;Or is it something else?&nbsp;If you just want one alert to use the code from another one you would be better off copying the code and modifying it to fit your needs.

kmanish · Answer

GaryBushey&nbsp;Hi Gary,&nbsp;Thanks for replying. Actually i have already created one rule and wanted its results in the new rule (user_machine) which i have not created yet.&nbsp;&nbsp;One way is to write the query again for the already created rule in the new rule&nbsp; (however that is a tedious task).&nbsp;&nbsp;The feature to call already created rules is there in many SIEM solutions. It will be useful if it is present in Sentinel.&nbsp;

garybushey · Answer

kmanish&nbsp;Thank you for the clarification.&nbsp; The "SecurityAlert" table in the Logs contains all the alerts that have been created.&nbsp; You should be able to query that to get the information you need.

Forum Discussion

Lookup of one Analytics Rule in Another

3 Replies