What are the required fields for the analytics rule arm template?

Jonathan Canlas 0 Reputation points
2024-08-19T10:55:57.9066667+00:00

Referring to this guide,

https://github.com/Azure/Azure-Sentinel/wiki/Query-Style-Guide

I can't find any official documentation on the required fields for the .yaml files?

We want to implement pre-commit checks that ensure the templates entering the CI/CD process abide by the expected requirements when deploying.

Azure Automation
Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,256 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,135 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Marilee Turscak-MSFT 36,846 Reputation points Microsoft Employee
    2024-08-19T23:11:08.28+00:00

    Hi Jonathan Canlas ,

    Are you looking for the required parameters for the analytics rules? If so, you can use Import-AzSentinelAlertRule to input the file where all the rules' properties are specified.

     

    1 person found this answer helpful.
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.