How to generate Sentinel incidents to test playbooks?

[ReccoB]

Is there a tool or way to generate specific incidents in Sentinel so that we can test playbooks?

Right now I am having to actually attempt to brute force a resource to generate an incident, is there not an easier way?

[#2]

@ReccoB You can use the script found here https://gallery.technet.microsoft.com/PowerShell-script-to-0823e09d with some modifications to upload some dummy data into a custom log, create an analytics rule that looks for that information, and then assign a Playbook to that rule.

Keep in mind that this can only write to a custom log hence the need for a new analytics rule (or change an existing one to look at the custom log)

[#3]

@ReccoB You could also try this one:

https://secureinfra.blog/2020/08/13/azure-sentinel-analytics-rule-to-keep-track-of-cloud-shell/

All you have to do is initiate a Cloud Shell instance and an Incident will be created with the entities you need for investigations, automation, etc.

[#4]

I found this article interesting on how to test playbooks.
https://azsec.azurewebsites.net/2020/01/19/notify-azure-sentinel-alert-to-your-email-automatically/

[#5]

@Singanna Just remember there are two types of playbooks (the incident based ones came out after that article was written) and, as of right now, only those that use the Alert trigger can be triggered manually but those cannot be added to Automation rules.

The playbooks that use the incident trigger cannot be triggered manually but can be added to Automation rules.

[#6]

Hi Gary,
Thanks for the clarification.

[#7]

This link is bad now.

[#8]

Which one?

Here's the Analytics Rule: https://github.com/rod-trent/SentinelKQL/blob/master/AR-CloudShellExecution.txt

Sending emails: https://azurecloudai.blog/2020/09/23/sentinel-email-notification-logic-app/

[#9]

Another option is to use the "datatable" command in a dummy analytic rule that will generate exactly what you need to test in your playbook and then switch to your real analytic rule when your testing is complete.

[#10]

You can use my tool to generate sample CEF logs in a Linux machine but you'll need it connected to Sentinel.

https://github.com/mlaraibkhan/CEF-LogGenerator