Deploying SecurityAlert and SecurityIncident tables from ARM template

Question

Hi,

We're testing the deployment of custom alert rules in a new Sentinel install, but the SecurityAlert and SecurityIncident tables are not generated unless we manually create a new alert rule. Even then the deployed alert rules are not connected to those tables. Is there a way to automatically generate and connect data to those tables from ARM deployment? Thanks in advance.

Answer 1

Hello @John Farley

A little secret that I find people miss is that the Microsoft managed tables are already there, just hidden. If you navigate to the Log Analytics workspace and press the settings cog in the upper right corner, the settings menu will appear, and you can toggle the switch Show tables with no data.

If you want to manage the tables, such as retention, change the tables type from analytics to basic (though I do not recomend this for SecurityAlert and Security Incident!) or create custom templates, the template references can be found here

https://learn.microsoft.com/en-us/azure/templates/microsoft.operationalinsights/2022-10-01/workspaces/tables?pivots=deployment-language-arm-template

I hope this helps provide you with the information you need. If it does, please make sure to mark the question as answered so it helps other people in future.

Kind regards

Alistair