Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Alert Rule → Create or Update

AI-generated

Overview

This node operation allows users to create or update alert rules in Microsoft Sentinel. It is useful for automating the management of security alert rules within a Sentinel workspace, enabling users to define criteria for triggering alerts based on security data queries. Practical examples include setting up scheduled alert rules to monitor specific security events, configuring severity levels, and customizing alert details to fit organizational needs.

Use Case Examples

  1. Creating a scheduled alert rule that runs a query every hour to detect high-severity security alerts.
  2. Updating an existing alert rule to change its severity or enable suppression settings to avoid alert flooding.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel workspace instance to use, specified by subscription ID, resource group, and workspace name or via a URL or list selection.
Rule Type The type of alert rule to create or update, such as Scheduled, Fusion, ML Behavior Analytics, etc.
Enabled Whether the alert rule is enabled or disabled.
Rule Name The display name for alerts created by this alert rule.
Severity The severity level for alerts created by this alert rule.
Query The query that defines the conditions for creating alerts under this rule.
Query Frequency The frequency in ISO 8601 duration format at which the alert rule runs (for Scheduled rules).
Query Period The time period in ISO 8601 duration format that the alert rule looks at (for Scheduled rules).
Trigger Operator The comparison operator used against the threshold to trigger the alert rule.
Trigger Threshold The numeric threshold that triggers the alert rule.
Additional Fields Optional additional settings for the alert rule, including alert details override, template name, custom details, entity mappings, suppression settings, tactics, techniques, and template version.
Alert Rule Template Name The name of the alert rule template used to create this rule (for certain rule types).
Options Additional options such as alert rule ID, custom properties JSON, etag, and whether to simplify the response.

Output

JSON

  • id - The unique identifier of the alert rule.
  • name - The name of the alert rule.
  • type - The type of the alert rule resource.
  • properties
    • displayName - The display name of the alert rule.
    • enabled - Indicates if the alert rule is enabled.
    • severity - The severity level of the alert rule.
    • query - The query string that defines the alert rule logic.
    • queryFrequency - The frequency at which the alert rule runs (for Scheduled rules).
    • queryPeriod - The time period the alert rule looks at (for Scheduled rules).
    • triggerOperator - The operator used to compare against the trigger threshold.
    • triggerThreshold - The threshold value that triggers the alert.
    • additionalFields - Additional optional fields and configurations for the alert rule.

Dependencies

  • An API key credential for Microsoft Sentinel OAuth2 authentication

Troubleshooting

  • Ensure the Sentinel instance is correctly specified in the required format or URL to avoid invalid format errors.
  • Verify that required fields such as Rule Name, Query, and Severity are provided when applicable to prevent validation errors.
  • Check API permissions and OAuth2 credentials if authentication errors occur.
  • If the alert rule ID (objectId) is provided for update, ensure it is a valid UUID to avoid errors.

Links

Discussion