Forum Discussion
Sentinel workbook
We are creating a workbook to list all the active analytics rules with the source table name. We are able to list the analytics rules using Azure resource manager API but unable to display source tab...
Hello, Take a look in "Workspace Usage" workbook for some ideas, in [regular Checks] Tab --> Weekly --> Rules.
However this is only for rules within the Microsoft GitHub (which has this data to map to the api, which doesnt contain this), so no custom rules you might have will show.
Sorry the method, is buried within groups inside groups. Some of the JSON path formatting isnt great either (you might get blanks or duplicates sometimes).
For Custom Rules, we ended up running an Azure Function hourly to get the missing data from our own Github (where we store the custom rules) and writing that back to a Table, to enable us to query this.