Azure Sentinel

Microsoft Sentinel is a scalable, cloud-native solution that provides: Security information and event management (SIEM) Security orchestration, automation, and response (SOAR).

Analytics & SIEM · Microsoft Sentinel

Configuration parameters

  • azure_cloud — Azure Cloud
  • limit — Maximum number of incidents per fetch.
  • creds_tenant_id —
  • tenant_id — Tenant ID
  • creds_client_id —
  • credentials —
  • creds_certificate — Certificate Thumbprint
  • certificate_thumbprint — Certificate Thumbprint
  • private_key — Private Key
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • subscriptionID — Default Subscription ID (required)
  • resourceGroupName — Default Resource Group Name (required)
  • workspaceName — Workspace Name (required)
  • isFetch — Fetch incidents
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • min_severity — The minimum severity of incidents to fetch
  • incidentType — Incident type
  • server_url — Server URL
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_additional_info — Additional info to fetch
  • mirror_direction — Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident
  • close_ticket — Close Mirrored Microsoft Sentinel Ticket
  • statuses_to_fetch — Incident Statuses to Fetch
  • incidentFetchInterval — Incidents Fetch Interval
  • look_back — Minutes to look back when fetching

Commands (36)

  • azure-sentinel-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • azure-sentinel-create-alert-rule

    Creates a new alert rule.

  • azure-sentinel-create-incident

    Create a sentinel incident.

  • azure-sentinel-create-update-watchlist-item

    Create or update a watchlist item.

  • azure-sentinel-delete-alert-rule

    Deletes the specified alert rule.

  • azure-sentinel-delete-incident

    Deletes a single incident in Azure Sentinel.

  • azure-sentinel-delete-watchlist

    Delete a watchlist from Azure Sentinel.

  • azure-sentinel-delete-watchlist-item

    Delete a watchlist item.

  • azure-sentinel-get-incident-by-id

    Gets a single incident from Azure Sentinel.

  • azure-sentinel-incident-add-comment

    Adds a comment to an incident in Azure Sentinel.

  • azure-sentinel-incident-delete-comment

    Deletes a comment from incident in Azure Sentinel.

  • azure-sentinel-list-alert-rule

    Gets a list of all alert rules.

  • azure-sentinel-list-alert-rule-template

    Gets a list of all alert rule templates.

  • azure-sentinel-list-incident-alerts

    Gets a list of an incident's alerts from Azure Sentinel.

  • azure-sentinel-list-incident-comments

    Gets the comments of an incident from Azure Sentinel.

  • azure-sentinel-list-incident-entities

    Gets a list of an incident's entities from Azure Sentinel.

  • azure-sentinel-list-incident-relations

    Gets a list of an incident's related entities from Azure Sentinel.

  • azure-sentinel-list-incidents

    Gets a list of incidents from Azure Sentinel.

  • azure-sentinel-list-watchlist-items

    Get a single watchlist item or list of watchlist items.

  • azure-sentinel-list-watchlists

    Gets a list of watchlists from Azure Sentinel.

  • azure-sentinel-resource-group-list

    List all resource groups for a subscription.

  • azure-sentinel-subscriptions-list

    Lists all subscriptions.

  • azure-sentinel-threat-indicator-create

    Creates a new threat indicator.

  • azure-sentinel-threat-indicator-delete

    Deletes an existing threat indicator.

  • azure-sentinel-threat-indicator-list

    Returns a list of threat indicators.

  • azure-sentinel-threat-indicator-query

    Returns a list of threat indicators with specific entities.

  • azure-sentinel-threat-indicator-tags-append

    Appends new tags to an existing indicator.

  • azure-sentinel-threat-indicator-tags-replace

    Replaces the tags of a given indicator.

  • azure-sentinel-threat-indicator-update

    Updates an existing threat indicator.

  • azure-sentinel-update-alert-rule

    Updates an alert rule.

  • azure-sentinel-update-incident

    Updates a single incident in Azure Sentinel.

  • azure-sentinel-watchlist-create-update

    Create or update a watchlist in Azure Sentinel.

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • get-modified-remote-data

    Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes.

  • get-remote-data

    Gets data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.