Skip to content

Old Analytic Rules versions in /solutions/ #11307

Closed

Description

Issues: The version on analytic rules in github has missmatch with content-hub.
Example: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloud%20Identity%20Threat%20Protection%20Essentials/Analytic%20Rules/NewExtUserGrantedAdmin.yaml (version 1.0.3, updated 5 months ago).
Image
Image

Meenwhile, in the content hub the currenct version (of this exact analytic rule) is 1.0.2 (updated recently, marked as "update available").
Screenshoot from my instance, on the analytic rule -> update blade:
Image
Image

That means the versioning between content-hub and github is mitchmatch or github is far behind the correct versions of content hub.
Exported analytic rules from sentinel results in JSON-format has "templateversion" which seems to match the "version" of analytic rules in content hub (and sometimes github).
However, when you list contenthub you ALWAYS get the latest verison available for all content in the in that content package - you dont get your current version of installed analytic rules, for that you have to retrieve/extract all your current analytic rules (JSON) and try to match the values on contentID (in content hub) which is alerttemplaterulename in the analytic (JSON) - but not unique - and version in the content hub vs templateversion in the JSON.

WITH that in mind, you have to build a massive script (which i did) to try to keep track of updates to rules (unless you log in and check an instance of sentinel everyday and it basically just check one instance of sentinel), the script also has to download your analytic rules as a JSON locally and compare with installed content hub packages - this is very limited and PER sentinel instance. So, having multiple instances of sentinel, what i did and wanted was to build a RSS feed that checks the URL of a list of analytic rules (github urls), store the version and check once a month, if a new version:x.x.x is updated it posts the new stuff into an RSS feed and then powerapps/flow to do the rest. But as you can see above, github is not kept up to date with the analytic rules deployed in content hub, so here i am.

Is there a reason for this or is it possible to improve the process when you update content hub/analytic rules to also update this github repo of your own rules? Or have a feed when rules are updated related to your installed analytic rules (unique id's etc).

edit: removed my sidetrack about updating/managing content hub through europe api's, as all locations are not supporting the apis you see in sentinel gui or be able to see the "update available" through API - including version currently/latest - and not only GUI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions