How to find the creation date of each analytical rule on Sentinel

Evangelos Spatharas (CP,UK) 20 Reputation points
2024-06-07T10:28:09.6+00:00

Hi all,

I am aiming to find the number of new analytical rules created per month, as well as the existing total per month on Sentinel for the last 2 months and present it to a Sentinel workbook.

To achieve this, I am considering REST calls against Resource Manager "Alert rules - List" as described on the following link: https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules/list?view=rest-securityinsights-2024-03-01&tabs=HTTP#systemdata

My problem is that a response from this endpoint carries only the "lastModifiedUtc" key, but not the "createdAt" which I am interested on. Looking further into the same link, there is a section "systemData" which refers to "createdAt" as metadata.

Could you help me as to how I would be able to reach to that metadata and map it to a specific rule ?

Note that I do not have access on SentinelAudit table from which I would be able to find a partial solution on the number of rules created, but not existing total.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,165 questions
{count} votes

Accepted answer
  1. Clive Watson 6,601 Reputation points MVP
    2024-06-07T14:07:49.43+00:00

    This data has always been missing, the solution I used in "Workspace Usage" Workbook (look under [Regular Checks] --> Weekly --> Rules) - sorry its nested in lots of groups, if you go looking for the code"

    User's image

    1st query:

    /subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRuleTemplates

    then

    /subscriptions/{Subscription:id}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/AlertRules

    then use a merge to join them - this does assume you are deploying from the Sentinel Github

    User's image


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.