Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Alert Rule → Get Template
AI-generatedOverview
This node operation retrieves the template of a specific alert rule from a Microsoft Sentinel instance. It is useful for scenarios where users need to obtain the predefined structure or configuration of an alert rule for inspection, duplication, or modification purposes. For example, a security analyst might use this operation to fetch the template of an alert rule to understand its criteria and actions before applying it to another Sentinel workspace.
Use Case Examples
- Fetching the template of an alert rule by providing its UUID to review its configuration.
- Using the template data to create a similar alert rule in a different Sentinel instance.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified either by subscription ID, resource group, and workspace name path, a full Azure Portal/Management URL, or selected from a list of available Sentinel instances. |
| Alert Rule ID | The UUID of the alert rule whose template is to be retrieved. |
| Options | Additional options for the request, including whether to simplify the response data. |
Output
JSON
alertRuleTemplate- The template data of the specified alert rule, either in raw or simplified form depending on the options.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Alert Rule ID is a valid UUID; invalid IDs will cause request failures.
- Verify that the Sentinel Instance is correctly specified in one of the accepted formats; incorrect instance details will lead to authentication or resource not found errors.
- If the 'Simplify' option is enabled, the response may omit some raw data fields; disable it to get full raw data for debugging.