SOLVED

Export and Import Saved Queries and Functions from one Sentinel Workspace to Another

%3CLINGO-SUB%20id%3D%22lingo-sub-1910930%22%20slang%3D%22en-US%22%3EExport%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1910930%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20been%20getting%20so%20much%20value%20out%20of%20Azure%20Sentinel%2C%20custom%20log%20types%2C%20and%20custom%20functions%20to%20parse%20logs%20and%20make%20them%20easy%20to%20query%20in%20KQL%20(I%20have%20Sysmon%2C%20Suricata%20and%20Zeek%20among%20others).%20I've%20spent%20a%20lot%20of%20time%20creating%20and%20fine-tuning%20saved%20queries%20and%20functions%20in%20one%20workspace%2C%20and%20now%20I'd%20like%20to%20easily%20export%20all%20of%20those%20saved%20queries%20and%20functions%20into%20another%20workspace.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20much%20of%20Sentinel%20is%20built%20on%20APIs%2C%20it%20seems%20like%20there%20should%20be%20a%20programatic%20way%20to%20export%20these%20into%20a%20json%20structure%20(or%20something)%20and%20then%20import%20those%20into%20another%20workspace%2C%20but%20I%20can't%20find%20it%20in%20the%20documentation.%20I%20know%20that%20I%20can%20take%20these%20one%20at%20a%20time%2C%20copy%20and%20paste%20from%20one%20workspace%20into%20another.%20That%20would%20be%20OK%20with%20one%20or%20two%20custom%20functions%2C%20but%20I%20have%20over%2030.%20I'd%20like%20to%20automate%20this%20if%20possible.%20Does%20anyone%20know%20a%20way%20to%20get%20that%20done%3F%20I'm%20comfortable%20with%20writing%20custom%20code%20if%20needed.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1912974%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1912974%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F875348%22%20target%3D%22_blank%22%3E%40rpargman%3C%2FA%3E%26nbsp%3BYou%20need%20to%20use%20the%20Log%20Analytics%20REST%20API%20to%20get%20access%20to%20those.%26nbsp%3B%20Take%20a%20look%20at%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Frest%2Fapi%2Floganalytics%2Fsavedsearches%3C%2FA%3E%26nbsp%3B%20to%20get%20started%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1913052%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1913052%22%20slang%3D%22en-US%22%3EThank%20you!%20That%20Log%20Analytics%20API%20is%20amazing.%20I%20didn't%20realize%20that%20it%20could%20get%20the%20queries%2C%20too.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1942479%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1942479%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F875348%22%20target%3D%22_blank%22%3E%40rpargman%3C%2FA%3E%26nbsp%3B%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3A%26nbsp%3B%20the%26nbsp%3B%3CSPAN%20data-preserver-spaces%3D%22true%22%3Epowershell%20cmdlets%20might%20be%20an%20easier%20start%20than%20the%20API%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Faz.operationalinsights%2Fnew-azoperationalinsightssavedsearch%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ecreate%3C%2FA%3E%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Faz.operationalinsights%2Fremove-azoperationalinsightssavedsearch%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eremove%3C%2FA%3E%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Faz.operationalinsights%2Fget-azoperationalinsightssavedsearch%3Fview%3Dazps-4.3.0%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eget%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1942533%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1942533%22%20slang%3D%22en-US%22%3EOh%20thank%20you!%20I'll%20check%20those%20out%2C%20too.%20I%20appreciate%20the%20tip.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1944947%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1944947%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F875348%22%20target%3D%22_blank%22%3E%40rpargman%3C%2FA%3EI%20had%20to%20do%20this%20the%20other%20day%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3E%23%20Get-AzContext%20-ListAvailable%0A%23%20Set%20the%20source%20workspace%0ASet-AzContext%20-Subscription%20%22%3CSOURCE%20subscription%3D%22%22%3E%22%0A%24ResourceGroup%20%3D%20%22%3CSOURCE%20rg%3D%22%22%3E%22%0A%24WorkspaceName%20%3D%20%22%3CSOURCE%20workspace%3D%22%22%3E%22%0A%24ResourceGroup%20%3D%20%22%3CDEST%20rg%3D%22%22%3E%22%0A%24WorkspaceName%20%3D%20%22%3CDEST%20workspace%3D%22%22%3E%3C%2FDEST%3E%3C%2FDEST%3E%3C%2FSOURCE%3E%3C%2FSOURCE%3E%3C%2FSOURCE%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2357757%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2357757%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20very%20useful%2C%20but%20I'd%20appreciate%20some%20help%20doing%20this%20slightly%20differently%20please%3A%3CBR%20%2F%3E1.%20dump%20searches%20to%20a%20file%3CBR%20%2F%3E2.%20import%20the%20file%20back%20to%20sentinel%20(say%20after%20making%20some%20changes)%3CBR%20%2F%3Eeg%3A%3CBR%20%2F%3EGet-AzOp....%20%26gt%3B%20outfile%3CBR%20%2F%3ENew-AzOp...%20%26lt%3B%20outfile%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20can't%26nbsp%3B%20figure%20out%20the%20correct%20format%20for%20outfile%20and%20I%20don't%20know%20the%20import%20command%20using%20a%20file.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2361111%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20and%20Import%20Saved%20Queries%20and%20Functions%20from%20one%20Sentinel%20Workspace%20to%20Another%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2361111%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F434938%22%20target%3D%22_blank%22%3E%40bobsyouruncle%3C%2FA%3E%26nbsp%3Bjust%20use%20JSON%20to%20serialise%20it%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3Eexport-searches.ps1%20(.%2Fexport-searches.ps1%20myRG%20myWorkspace%20%26gt%3B%20searches.json)%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3E%24ResourceGroup%20%3D%20%20%24args%5B0%5D%0A%24WorkspaceName%20%3D%20%20%24args%5B1%5D%0A%0A(Get-AzOperationalInsightsSavedSearch%20-ResourceGroupName%20%24ResourceGroup%20-WorkspaceName%20%24WorkspaceName).Value.Properties%20%7C%20ConvertTo-Json%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20easily%20add%2C%20remove%2C%20update%20queries%20in%20the%20JSON%20file%20then%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3Eimport-searches.ps1%20(.%2Fimport-searches.ps1%20myRG%20myWorkspace%20searches.json)%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3E%24ResourceGroup%20%3D%20%20%24args%5B0%5D%0A%24WorkspaceName%20%3D%20%20%24args%5B1%5D%0A%24InputFile%20%3D%20%24args%5B2%5D%0A%0Aforeach%20(%24search%20in%20%20Get-Content%20%24InputFile%20%7C%20ConvertFrom-Json)%20%7B%0A%20%20%20%20%24id%20%3D%20%24search.Category%20%2B%20%22%7C%22%20%2B%20%24search.DisplayName%0A%20%20%20%20Write-Output%20%22Importing%20%24(%24search.DisplayName)%20(%24(%24search.Category))%22%0A%20%20%20%20New-AzOperationalInsightsSavedSearch%20-Force%20-ResourceGroupName%20%24ResourceGroup%20-WorkspaceName%20%24WorkspaceName%20-SavedSearchId%20%24id%20-DisplayName%20%24search.DisplayName%20-Category%20%24search.Category%20-Query%20%24search.Query%20-Version%20%24search.Version%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I have been getting so much value out of Azure Sentinel, custom log types, and custom functions to parse logs and make them easy to query in KQL (I have Sysmon, Suricata and Zeek among others). I've spent a lot of time creating and fine-tuning saved queries and functions in one workspace, and now I'd like to easily export all of those saved queries and functions into another workspace.

 

So much of Sentinel is built on APIs, it seems like there should be a programatic way to export these into a json structure (or something) and then import those into another workspace, but I can't find it in the documentation. I know that I can take these one at a time, copy and paste from one workspace into another. That would be OK with one or two custom functions, but I have over 30. I'd like to automate this if possible. Does anyone know a way to get that done? I'm comfortable with writing custom code if needed.

10 Replies
best response confirmed by rpargman (Occasional Contributor)
Solution

@rpargman You need to use the Log Analytics REST API to get access to those.  Take a look at: https://docs.microsoft.com/en-us/rest/api/loganalytics/savedsearches  to get started

Thank you! That Log Analytics API is amazing. I didn't realize that it could get the queries, too.

@rpargman , @Gary Bushey :  the powershell cmdlets might be an easier start than the API: createremoveget

Oh thank you! I'll check those out, too. I appreciate the tip.

@rpargmanI had to do this the other day

 

# Get-AzContext -ListAvailable
# Set the source workspace
Set-AzContext -Subscription "<Source Subscription>"
$ResourceGroup = "<Source RG>"
$WorkspaceName = "<Source WorkSpace"

# Only export saved queries from these categories
$Categories = ("sec", "usage", "proxy", "win", "o365")

$ExportedSearches = (Get-AzOperationalInsightsSavedSearch -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName).Value.Properties | Where-Object { $Categories -contains $_.Category }

# Set the destination workspace
Set-AzContext -Subscription "<Dest Subscription>"
$ResourceGroup = "<Dest RG>"
$WorkspaceName = "<Dest WorkSpace"

# Import Saved Searches
foreach ($search in $ExportedSearches) {
    $id = $search.Category + "|" + $search.DisplayName
    New-AzOperationalInsightsSavedSearch -Force -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName -SavedSearchId $id -DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
}

This is very useful, but I'd appreciate some help doing this slightly differently please:
1. dump searches to a file
2. import the file back to sentinel (say after making some changes)
eg:
Get-AzOp.... > outfile
New-AzOp... < outfile

 

I can't  figure out the correct format for outfile and I don't know the import command using a file.

@bobsyouruncle just use JSON to serialise it:

 

export-searches.ps1 (./export-searches.ps1 myRG myWorkspace > searches.json)

 

$ResourceGroup =  $args[0]
$WorkspaceName =  $args[1]

(Get-AzOperationalInsightsSavedSearch -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName).Value.Properties | ConvertTo-Json

 

 

 

You can easily add, remove, update queries in the JSON file then:

import-searches.ps1 (./import-searches.ps1 myRG myWorkspace searches.json)

 

$ResourceGroup =  $args[0]
$WorkspaceName =  $args[1]
$InputFile = $args[2]

foreach ($search in  Get-Content $InputFile | ConvertFrom-Json) {
    $id = $search.Category + "|" + $search.DisplayName
    Write-Output "Importing $($search.DisplayName) ($($search.Category))"
    New-AzOperationalInsightsSavedSearch -Force -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName -SavedSearchId $id -DisplayName $search.DisplayName -Category $search.Category -Query $search.Query -Version $search.Version
}

 

 

 

 

Thanks @pemontto , I love you man :D.

Seriously much appreciated I needed that convert-to/from json example.

 

Hey thanks for the great input in this thread. I wanted to check in before I go about trying to do this with functions. My question is basically the same. I was hoping to find a way to do this with the az-cli and core functions. Not so much as exporting, which would be a bonus. But editing and saving. I went through and did this in the GUI yesterday and it was a time consuming to say the least. Would you by chance have any guidance on that?

@arkscout Not quite sure what your requirements are, but if you want to update/overwrite you could probably use Set-AzOperationalInsightsSavedSearch. However I think using New-AzOperationalInsightsSavedSearch with -Force overwrites/updates based on the id.