Search code examples
powershellazure-sentinel

Is it possible to manipulate Azure Sentinel Watchlists through Powershell/API

is it possible to administrate Azure Sentinel Watchlists through Powershell, like Rules with Az.SecurityInsights?

Aim is to keep Watchlist references in outer VCS for simpler manipulation, and sync it with Powershell to remote.

Thanks,

Solution

  • Work on this seems to be coming, recently announced Microsoft Sentinel Repositories allows your VCS (GitHub or Azure DevOps) to sync to Sentinel:

    https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enable-continuous-deployment-natively-with-microsoft-sentinel/ba-p/2929413

    With some small modifications, (edit the files in the .sentinel/ folder you can deploy watchlist as well. at this moment only additions are processed through this trick, but real support might be coming.

    Some more info: https://www.oppedijk.com/2021/11/18/Sentinel-CD-Repository.html