Jul 19 2022
I've been trying to write a script for enabling Microsoft Sentinel Entity Behavior templates via API and I'm stuck. I'm using this API call to get all the templates Entity Query Templates - List - REST API (Azure Sentinel) | Microsoft Docs, but I cannot figure out, how to see if any of these activities are already enabled. I've tried Listing and Getting specific Entity with Entity Queries - Get - REST API (Azure Sentinel) | Microsoft Docs, but I do not get a property "templateName", I also tried older versions of the API. I've tried comparing "queryTemplate" in Entities with "queryDefinitions.query" in EntityTemplates. No luck.
How can I automatically enable entity query templates that aren't in use?