Automate Sentinel Alert for Disabled Rules
Budget: £10 – £20 GBP
I need to auto-trigger an event/alert if any rules within my Microsoft Sentinel are disabled or auto-disabled. This includes:
- The creation of KQL script that would specifically output a list of these disabled rules, regardless of who the initiator is.
- I need this to be applicable to all rules, not just specifics or a group of rules.
The ideal candidate for this project will have advanced knowledge and experience in writing and testing KQL scripts. They should have a clear understanding of Microsoft Sentinel's operation, especially in handling rules and alerts. They should be capable of designing and implementing an effective automated response to rule disablement in Sentinel.
- The creation of KQL script that would specifically output a list of these disabled rules, regardless of who the initiator is.
- I need this to be applicable to all rules, not just specifics or a group of rules.
The ideal candidate for this project will have advanced knowledge and experience in writing and testing KQL scripts. They should have a clear understanding of Microsoft Sentinel's operation, especially in handling rules and alerts. They should be capable of designing and implementing an effective automated response to rule disablement in Sentinel.