Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Automation Rule → Create or Update

AI-generated

Overview

This node interacts with Microsoft Sentinel's Automation Rule resource to create or update automation rules within a specified Sentinel instance. It is useful for automating security workflows by enabling users to define or modify rules that trigger automated responses to security incidents. For example, a security analyst can use this node to enable an automation rule that automatically assigns incidents to a specific team or escalates alerts based on certain conditions.

Use Case Examples

  1. Creating a new automation rule to automatically close low-priority incidents.
  2. Updating an existing automation rule to change its execution order or enable/disable it.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL.
Enabled Whether the automation rule is enabled or disabled.
Rule Name The display name of the automation rule.
Order The order of execution of the automation rule; lower numbers run first.
Options Additional options for the automation rule including Automation Rule ID (UUID), custom JSON properties to merge, Etag for concurrency control, and whether to return a simplified response.

Output

JSON

  • id - The unique identifier of the automation rule.
  • name - The name of the automation rule.
  • type - The resource type of the automation rule.
  • properties
    • enabled - Indicates if the automation rule is enabled.
    • displayName - The display name of the automation rule.
    • order - The execution order of the automation rule.
    • customProperties - Custom JSON properties of the automation rule.

Dependencies

  • Microsoft Sentinel API with OAuth2 authentication

Troubleshooting

  • Ensure the Sentinel instance is correctly specified in the required format or URL to avoid validation errors.
  • Verify that the Automation Rule ID (UUID) is valid when updating an existing rule.
  • Check API permissions and OAuth2 credentials to ensure the node can authenticate and perform create or update operations.
  • If the node returns an error related to Etag, ensure the correct Etag value is provided to handle concurrency.

Links

Discussion