Export Microsoft Sentinel artifacts like Analytical Rules, Hunting Queries, Workbooks in order to support new feature Repositories CI/CD Pipeline
- Currently supporting
- Scheduled Analytical Rules
- Automation Rules
- Parsers (Saved Searches - KQL Functions)
- Workbooks
-
Extract the folder and open "Export_Sentinel_Artifacts.ps1" either in Visual Studio Code/PowerShell(Admin)
Note
The script runs from the user's machine. You must allow PowerShell script execution. To do so, run the following command:Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
-
Run the script using the following command
.\Export_Sentinel_Artifacts.ps1 -TenantID xxxx `
Post here.
Contributions are welcome! 👏