Conversion of Existing SIEM(QRadar, Arcsight) rule to Sentinel

[vijayyadav351]

The key challenge which we are facing is to migrate existing SIEM(QRadar, ArcSight) solution use cases to Sentinel Use cases. We tried uncoder.io but even that is not helpful to 1%. Please support if some one is having good way to execute it.  

[#2]

You can convert only the queries. Use cases in ArcSight ESM or QRadar has to be rebuilt on Sentinel manually.

[#3]

@vijayyadav351 You can also check places like SocPrime that have a repository of alert rules to see if the ones you need in your other system are present and then export those as Azure Sentinel rules.

[#4]

@mergene but I am unable to convert query also. You mean using undecoder.io or there is other way available.  

[#5]

This article covers the related best practices comprehensively.

Best practices for migrating detection rules from ArcSight, Splunk and QRadar to Azure Sentinel
https://techcommunity.microsoft.com/t5/azure-sentinel/best-practices-for-migrating-detection-rules-f...