Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Alert Rule → Get

AI-generated

Overview

This node operation retrieves a specific alert rule from a Microsoft Sentinel instance using the alert rule's UUID. It is useful for scenarios where you need to fetch detailed information about a particular alert rule configured in Sentinel, such as for monitoring, auditing, or automation purposes.

Use Case Examples

  1. Fetch an alert rule by its ID to review its configuration and status.
  2. Use the alert rule details to trigger further automated workflows based on specific security alerts.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Alert Rule ID The UUID of the alert rule to retrieve.
Options Additional options for the request, such as whether to return a simplified version of the response.

Output

JSON

  • alertRuleId - The unique identifier of the alert rule.
  • name - The name of the alert rule.
  • description - Description of the alert rule.
  • severity - Severity level of the alert rule.
  • enabled - Indicates if the alert rule is enabled.
  • query - The query associated with the alert rule.
  • actions - Actions configured to be triggered by the alert rule.

Dependencies

  • An API key credential for Microsoft Sentinel OAuth2 authentication

Troubleshooting

  • Ensure the Alert Rule ID is a valid UUID; invalid IDs will cause errors.
  • Verify that the Sentinel Instance details are correctly formatted and accessible.
  • Check API permissions and OAuth2 credentials if authentication errors occur.
  • If the 'Simplify' option is enabled, some raw data fields may be omitted, which is expected behavior.

Discussion