Aug 20 2020 03:05 PM
Is there a tool or way to generate specific incidents in Sentinel so that we can test playbooks?
Right now I am having to actually attempt to brute force a resource to generate an incident, is there not an easier way?
Aug 21 2020 04:27 AM
@ReccoB You can use the script found here https://gallery.technet.microsoft.com/PowerShell-script-to-0823e09d with some modifications to upload some dummy data into a custom log, create an analytics rule that looks for that information, and then assign a Playbook to that rule.
Keep in mind that this can only write to a custom log hence the need for a new analytics rule (or change an existing one to look at the custom log)
Aug 21 2020 04:58 AM
@ReccoB You could also try this one:
https://secureinfra.blog/2020/08/13/azure-sentinel-analytics-rule-to-keep-track-of-cloud-shell/
All you have to do is initiate a Cloud Shell instance and an Incident will be created with the entities you need for investigations, automation, etc.
