Forum Discussion
Automating detection engineering for MS 365 Defender
Is it time yet? There is a POST available to create Detection Rules, but the docs aren't really that great.
We've seem to have done a 1:1 conversion of existing DRs into POST requests and still more than 50% of them fail to deploy because of 'reasons unknown' as we get a 400 error code with no actual information on why they had failed.
It would really help if there was an 'export' button similar to sentinel, then we could actually see what we are doing wrong when re-creating them manually.
I agree docs could be better. Main source of our 400 errors was whitespace in the ATT&CK tactics. Note when creating rules over API, whitespace needs to be removed from the detectionAction.alertTemplate.category e.g. "Initial Access" -> "InitialAccess", "Lateral Movement" -> "LateralMovement" etc. To troubleshoot, write a problem detection in the web console and GET to review required JSON.