Sentinel Entity Query Templates

Copper Contributor

Hello,

 

I've been trying to write a script for enabling Microsoft Sentinel Entity Behavior templates via API and I'm stuck. I'm using this API call to get all the templates Entity Query Templates - List - REST API (Azure Sentinel) | Microsoft Docs, but I cannot figure out, how to see if any of these activities are already enabled. I've tried Listing and Getting specific Entity with Entity Queries - Get - REST API (Azure Sentinel) | Microsoft Docs, but I do not get a property "templateName", I also tried older versions of the API. I've tried comparing "queryTemplate" in Entities with "queryDefinitions.query" in EntityTemplates. No luck. 

How can I automatically enable entity query templates that aren't in use? 

 

Thanks

0 Replies