Forum Discussion
Sentinel Entity Query Templates
Hello,
I've been trying to write a script for enabling Microsoft Sentinel Entity Behavior templates via API and I'm stuck. I'm using this API call to get all the templates https://docs.microsoft.com/en-us/rest/api/securityinsights/preview/entity-query-templates/list?tabs=HTTP, but I cannot figure out, how to see if any of these activities are already enabled. I've tried Listing and Getting specific Entity with https://docs.microsoft.com/en-us/rest/api/securityinsights/preview/entity-queries/get?tabs=HTTP, but I do not get a property "templateName", I also tried older versions of the API. I've tried comparing "queryTemplate" in Entities with "queryDefinitions.query" in EntityTemplates. No luck.
How can I automatically enable entity query templates that aren't in use?
Thanks