How do I export a list of Analytics from the Defender Products

Kentucky Mike 51 Reputation points
2023-07-10T17:55:53.18+00:00

As a MSSP for Microsoft Sentinel we have the Defender MDO Data connectors enabled and we're creating Incidents based on the Alerts that are created from each of the different MDO's

  1. Defender for Identity
  2. Defender for Office 365
  3. Defender for Endpoint
  4. Defender for Cloud
  5. Defender for Cloud App
  6. Azure AD Identity Protection

What I am in need of is to get a list of the Analytic Rules that exist in each of the above Security Rule Types.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,040 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
118 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sedat SALMAN 13,265 Reputation points
    2023-07-10T18:14:11.6766667+00:00

    To extract the list of Analytics rules from each of the above-mentioned Microsoft Defender products, you can utilize the Azure Sentinel REST API or Azure PowerShell cmdlets.

    Get-AzSentinelAlertRule -ResourceGroupName 'your_resource_group' -WorkspaceName 'your_workspace_name'

    https://video2.skills-academy.com/en-us/powershell/module/az.securityinsights/get-azsentinelalertrule?view=azps-10.0.0

    This will return a list of all Analytic Rules present in the workspace. This list will contain rules from all data sources (not just Defender products). If you want to filter out rules related to only Microsoft Defender products, you'll have to inspect each rule's details to see what data source it's associated with.

  2. Andrew Blumhardt 9,831 Reputation points Microsoft Employee
    2023-07-10T20:39:03.7733333+00:00

    Each of these solutions takes a slightly different approach to alert rule transparency. Many like MDI and MDFC have a published alerts list in the official documentation. In some cases, the alert names are dynamic or considered proprietary. For most of these solutions, the criteria are considered proprietary or the result of dynamic processes. Sentinel rules are fully customizable and you can see all of the deployed rules and templates including the criteria. Though a majority of the incidents seen in Sentinel are forwarded from other solutions like MDE where the rule logic resides.

    You could come up with your own list, if you just need a distinct list of incident titles. For example, query the past 90 days of incidents in Sentinel. Maybe create a playbook to keep a running list of every distinct incident name in a watchlist as they are encountered.