Who created "the Analytics Rule" that is enabled?

Question

I can't seem to locate the history of an "Alert Analytics rule definition" such as : who created it or when it was created.

I can only see last modified, ...without who modified it.

Can you help me locate this "history"?

Also, how could I setup an alert to notify when an Analytics alert rule is created and by whom?

Thanks,

~Joshua

Answer 1

@Lovett, Joshua C

Thank you for your post!

I understand that you're trying to see the history of a custom analytics rule within Microsoft Sentinel to determine who created it and when it was created. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

---

Findings:

• To locate the history of an Analytics rule definition such as who created it or when it was created, you should be able to leverage the SentinelAudit table to search for these events. For more info - SentinelAudit table columns schema.

When it comes to a KQL query to notify you when an analytics alert rule is created and who created it - I created a template query that will hopefully help point you in the right direction.

Create a custom analytics rule with a scheduled query:

1. From the Microsoft Sentinel navigation menu, select Analytics.
2. In the action bar at the top, select +Create and select Scheduled query rule. This opens the Analytics rule wizard.
3. Once on the Set rule logic tab, you can input the query below to hopefully help.
4. Use the Entity mapping configuration as needed to map parameters from the query to Microsoft Sentinel.

//This query uses the SentinelAudit table
//Searching for any ...alertRules/Write operations which indicates a create or update to an alert rule(s)
//The query will project the time, who performed the operation, analytics rule name, and additional properties.

SentinelAudit
| where OperationName == "Microsoft.SecurityInsights/alertRules/Write"
| project TimeGenerated, ExtendedProperties.CallerName, SentinelResourceName, SentinelResourceType, ExtendedProperties.UpdatedResourceState

---

Additional Links:

• Understanding SentinelHealth and SentinelAudit table events
• Create a custom analytics rule with a scheduled query
• SentinelAudit table columns schema
• SentinelAudit table columns schema - Extended properties
• Microsoft.SecurityInsights

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.