Azure Sentinel PowerShell Module Az.SecurityInsights has been released to GA!

[Tiander Turpijn]

We have just released our official Azure Sentinel PowerShell module Az.SecurityInsights which already has over 22.000 downloads and counting!

You can download it from here.

The Azure Sentinel Az.SecurityInsights PowerShell module helps you in automating your daily operational tasks, like interacting with incidents (assign owners, change severity, add comments, etc.), but also for creating and configuring analytics rules, data connectors and bookmarks.

Documentation including samples can be found here

Additional examples can be found on our Azure Sentinel GitHub repo

A frequent asked question is if our PowerShell module supports Azure Sentinel preview features.

Since our PowerShell module is officially supported, we support released features only at this point.

As soon as the preview features are released, we will support them through an update.

A big thank you to our customers, partners, MVP's, members of our security communities (like Tech Community) and our attendees joining our security events who have asked for this module and supported us in our journey to our release!

[ReganDangerCarey]

Are there any plans for an official Sentinel CI/CD pipeline in something like Azure DevOps that uses this module? Would love to integrate the creation and deployment of connectors/analytics rules with some git workflows.

[Jaa9H]

We are using the Microsoft Sentinel Powershell module to import and update Analytics Rules from downloaded YAML Templates in the https://github.com/Azure/Azure-Sentinel repo. These templates have added a new property to add Alert Enrichment, for example on Entity Mapping and Alert Override:

entityMappings:
  - entityType: IP
     fieldMappings:
         - identifier: Address
           columnName: IPCustomEntity
customDetails:
   NumberOfDenies: Count

alertDetailsOverride:
   alertDisplayNameFormat: Some text
   alertDescriptionFormat: 'Some text'

When will these properties be supported by the New-AzSentinelAlertRule and Update-AzSentinelAlertRule cmdlets?

Jonny