/Azure_Sentinel

Bulk turn on Analytic rules in Azure Sentinel

Primary LanguagePython

Azure Sentinel Hackathon 2021

Azure Resource Manager (ARM) Templates and ARM Template Editor for Bulk Activation and Modification of Azure Sentinel Analytics Rules.

The following process enables optimized deployment and modification of Azure Sentinel Analytics Rules. By accelerating the configuration of Analytics Rules, this process enables the Administrator to save time and resources.

How to bulk activate the default Azure Sentinel Analytics Rules

Operating Instructions:

Prerequisites:

  • Active Azure Subscription.
  • Resource group with Azure Sentinel service created.

Create a free subscription with 200 USD

Procedure:

  1. Download a ZIP file of the rules from the repository using the green "Code" button. Extract the file.
  2. Login to Microsoft Azure.
  3. Search for "Azure Sentinel" using the search bar at the top of the window.
  4. Select "Azure Sentinel" under Services.
  5. Select the appropriate Resource group for your organization.
  6. Select "Analytics" under the Configuration section.
  7. Locate and select the "Import" button near the top of the window.
  8. Select the preferred JSON file from the previously downloaded and extracted file.
  9. The Deployment process will start.

How to edit the Azure Sentinel Analytics Rules to fit your organization's requirements

ARM Template Editor for Analytics Rules

Description:

Python script to modify properties of ARM templates for bulk modification of Azure Sentinel Analytics Rules. Currently capable of modifying Rule Status (Enabled/Disabled), Rule Frequency, and Rule Period for any number of Azure Sentinel Analytics Rules contained within any number of ARM template files.

Notes from Azure Sentinel:

  • The Rule Frequency (queryFrequency) value must be between 5 minutes and 14 days.
  • The Rule Period (queryPeriod) value must be between 5 minutes and 14 days.
  • The Rule Frequency must be less than, or equal to, the Rule Period.
  • When the Rule Period is greater than, or equal to, 2 days, the Rule Frequency must be greater than, or equal to, 1 hour.

Operating Instructions:

Prerequisites:

  • Python 3 Interpreter. (see Microsoft Docs/ Microsoft Learn for validation or install instructions)
  • Path to ARM template/ ARM template file address in directory.

Procedure:

  1. Open the AZ_Sentinel_Analytics_Rules_Editor.py using a Python 3 Interpreter.
  2. Enter the path to the ARM template file(s) (i.e. C:\fakepath\AZ_Sentinel\Vectra_Detect_AZ_Sentinel_Analytics_Rules.json), or drag-and-drop each file, one at a time. Separate each file using a comma (,).
  3. Select options by entering the number associated with the option.
  4. Enter requested data based on constraints specified in the program and in the Notes from Azure Sentinel.
  5. Once the process is completed, a new file or new files will be created at the same address as the original file(s) with the user-specified prefix appended as the prefix of the filename(s). You will now have two files for each ARM template, the orignal and the new file.

Watch this video for a detailed explanation

ARM Templates for Default Analytics Rules

Default ARM templates for most of Azure Sentinel's built-in Scheduled Analytics Rules.

  • Rule Frequency = Default
  • Rule Period = Default

Analytics Rules:

ARM Templates for Quick Response Analytics Rules

ARM templates for most of Azure Sentinel's built-in Scheduled Analytics Rules, modified for quick response.

  • Rule Frequency = 10 minutes
  • Rule Period = 30 minutes

Analytics Rules:

Disclaimer: The Analytics rules above do not include all the available rules in Azre Sentinel. They do not include any rules that monitor activity from a third party Data Connectors or any rules that require a pre-created data tables. The remaining rules will need to be created and configured based on the Organization's specification.