Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Automation Rule → Delete

AI-generated

Overview

This node operation deletes an Automation Rule in Microsoft Sentinel. It is useful for managing and maintaining Sentinel automation by removing outdated or unnecessary automation rules. For example, a security analyst might use this node to delete an automation rule that is no longer relevant to their incident response workflow.

Use Case Examples

  1. Deleting an automation rule by specifying its UUID to clean up Sentinel configurations.
  2. Automating the removal of deprecated automation rules as part of a Sentinel maintenance script.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Automation Rule ID The UUID of the automation rule to delete, required for this operation.
Debug Enable or disable debug mode for the node to log request and response details.
Request Options Additional request options such as batching, SSL certificate validation, proxy settings, and timeout configuration.

Output

JSON

  • success - Indicates whether the deletion of the automation rule was successful.
  • message - Additional information or status message related to the deletion operation.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.

Troubleshooting

  • Ensure the Automation Rule ID is a valid UUID; otherwise, the deletion request will fail.
  • Verify that the Sentinel Instance details are correctly formatted and accessible.
  • Check that the OAuth2 credentials have sufficient permissions to delete automation rules in the specified Sentinel workspace.
  • If SSL issues occur, consider enabling the 'Ignore SSL Issues' option, but be aware of security implications.
  • Timeouts can occur if the server is slow to respond; adjust the timeout setting as needed.

Links

Discussion