Sentinel - Analytic Rules updates
Sentinel Analytic Rule Updates
Query
SentinelAudit
| where TimeGenerated > ago(180d)
| where Description == "Create or update analytics rule."
| extend CallerIpAddress = tostring(ExtendedProperties.CallerIpAddress)
| extend CallerName = tostring(ExtendedProperties.CallerName)
| extend enabled = tostring(parse_json(tostring(parse_json(tostring(ExtendedProperties.OriginalResourceState)).properties)).enabled)
| project TimeGenerated, SentinelResourceType, SentinelResourceName, CallerIpAddress, CallerName, enabledAbout this query
Explanation
The first query retrieves information about all updates made to Sentinel analytic rules. It includes details such as the time the update was generated, the type and name of the Sentinel resource, the IP address and name of the caller, and whether the rule is enabled.
The second query is similar to the first one, but it filters out updates made by users listed in the CloudAdmins watchlist.
The third query specifically lists deleted analytic rules. It includes details such as the time the deletion was generated, the type and name of the Sentinel resource, and the IP address and name of the caller.
Details
Alex Verboon
Released: September 18, 2023
Tables
SentinelAudit
Keywords
SentinelAuditTimeGeneratedDescriptionCreate or update analytics ruleCallerIpAddressCallerNameenabledSentinelResourceTypeSentinelResourceNameCloudAdminsAccountUPNAnalytics rule deleted
Operators
whereago==extendtostringparse_jsonpropertiesprojectin!in_GetWatchlist_SentinelAudit