Sentinel-Rules

Updated Sigma2KQL script written by CodeByHarri

- Clone this repo

git clone https://github.com/SigmaHQ/sigma.git

- Install pysigma-backend-microsoft365defender package

pip install pysigma-backend-microsoft365defender

- Create a folder named "KQL"

- Output format - Analytics Rule

- Workflow - Analytics Rule

The workflow is responsible for converting the generated YAML files into ARM files ready for sentinel deployment.