CODEWITHSUNDEEP
powershellazure-sentinel
moutonjr
moutonjr

Reputation: 265

Is it possible to manipulate Azure Sentinel Watchlists through Powershell/API

is it possible to administrate Azure Sentinel Watchlists through Powershell, like Rules with Az.SecurityInsights?

Aim is to keep Watchlist references in outer VCS for simpler manipulation, and sync it with Powershell to remote.

Thanks,

Upvotes: 0

Views: 670

Answers (2)

Erik Oppedijk
Erik Oppedijk

Reputation: 3553

Work on this seems to be coming, recently announced Microsoft Sentinel Repositories allows your VCS (GitHub or Azure DevOps) to sync to Sentinel:

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enable-continuous-deployment-natively-with-microsoft-sentinel/ba-p/2929413

With some small modifications, (edit the files in the .sentinel/ folder you can deploy watchlist as well. at this moment only additions are processed through this trick, but real support might be coming.

Some more info: https://www.oppedijk.com/2021/11/18/Sentinel-CD-Repository.html

Upvotes: 1

moutonjr
moutonjr

Reputation: 265

Got the answer: No. In a nutshell, I understand it's not implemented yet. Only API endpoint.

It would be a waste of time if I coded the REST Powershell wrapper in parallel, assuming that target code for this would be Az.SecurityInsights.

I filed an feature request for this : https://github.com/Azure/azure-powershell/issues/15718 .

Reference: https://learn.microsoft.com/en-us/answers/questions/518881/is-it-possible-to-manipulate-azure-sentinel-watchl.html

Upvotes: 0

Related Questions