Sentinel - Analytic Rules updates
Sentinel Analytic Rule Updates
Query
let CloudAdmins = _GetWatchlist('CloudAdmins')
| project ['AccountUPN'];
SentinelAudit
| where TimeGenerated > ago(180d)
| where Description == "Create or update analytics rule."
| extend CallerIpAddress = tostring(ExtendedProperties.CallerIpAddress)
| extend CallerName = tostring(ExtendedProperties.CallerName)
| extend enabled = tostring(parse_json(tostring(parse_json(tostring(ExtendedProperties.OriginalResourceState)).properties)).enabled)
| project TimeGenerated, SentinelResourceType, SentinelResourceName, CallerIpAddress, CallerName, enabled
| where CallerName !in (CloudAdmins)About this query
Explanation
The first query retrieves information about all updates made to Sentinel analytic rules. It includes details such as the time the update was generated, the type and name of the Sentinel resource, the IP address and name of the caller, and whether the rule is enabled.
The second query is similar to the first one, but it filters out updates made by users listed in the CloudAdmins watchlist.
The third query specifically lists deleted analytic rules. It includes details such as the time the deletion was generated, the type and name of the Sentinel resource, and the IP address and name of the caller.