Skip to content
PowerShell module for Azure Sentinel
Branch: master
Clone or download
pkhabazi Bug fixes - version 0.6.1 (#24)
Release version 0.6.1
Latest commit a9f791f Oct 15, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.vscode removed recommended extensions as most don't help the project Sep 6, 2019
AzSentinel Bug fixes - version 0.6.1 (#24) Oct 15, 2019
Tests Revert "Build" Oct 13, 2019
docs Revert "Build" Oct 13, 2019
examples Bug fixes - version 0.6.1 (#24) Oct 15, 2019
.gitignore init release v 0.0.1 Sep 5, 2019
LICENSE Bug fixes - version 0.6.1 (#24) Oct 15, 2019

Azure Sentinel

Azure Sentinel is a cloud-native SIEM that provides intelligent security analytics for your entire enterprise at cloud scale. Get limitless cloud speed and scale to help focus on what really matters. Easily collect data from all your cloud or on-premises assets, Office 365, Azure resources, and other clouds. Effectively detect threats with built-in machine learning from Microsoft’s security analytics experts. Automate threat response, using built-in orchestration and automation playbooks. read more

Why this PowerShell Module

At the moment there is no documented API, ARM or PowerShell module to configure Azure Sentinel. After doing some research we were able to find the API's that are currently being used by the Azure Portal and based on that we've written a PowerShell module to manage Azure Sentinel through PowerShell.

Getting Started

These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system.



You can install the latest version of AzSentinel module from PowerShell Gallery

Install-Module AzSentinel -Scope CurrentUser -Force



See docs folder for documentation regarding the Functions and the available parameters

JSON format

To create a Azure Sentinel Rule, use the following JSON format.

  "analytics": [
      "displayName": "string",
      "description": "string",
      "severity": "High",
      "enabled": true,
      "query": "SecurityEvent | where EventID == \"4688\" | where CommandLine contains \"-noni -ep bypass $\"",
      "queryFrequency": "5H",
      "queryPeriod": "5H",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 5,
      "suppressionDuration": "6H",
      "suppressionEnabled": false,
      "tactics": [

Property values

The following tables describe the values you need to set in the schema.

Name Type Required Allowed Values Example
displayName string yes * DisplayName
description string yes * Description
severity string yes Medium, High, Low, Informational Medium
enabled bool yes true, false true
query string yes special character need to be escaped by \ SecurityEvent | where EventID == "4688" | where CommandLine contains \"-noni -ep bypass $\"
queryFrequency string yes Value must be between 5 minutes and 24 hours 5H
queryPeriod string yes Value must be between 5 minutes and 24 hours 1440M
triggerOperator string yes GreaterThan, FewerThan, EqualTo, NotEqualTo GreaterThan
triggerThreshold int yes The value must be between 0 and 10000 5
suppressionDuration string yes Value must be between 5 minutes and 24 hours 11H
suppressionEnabled bool yes true, false true
tactics array yes InitialAccess, Persistence,Execution,PrivilegeEscalation,DefenseEvasion,CredentialAccess,LateralMovement,Discovery,Collection,Exfiltration,CommandAndControl,Impact true

Find us


Please read for details on our code of conduct, and the process for submitting pull requests to us.



See also the list of contributors who participated in this project.


We use SemVer for versioning. For the versions available, see the tags on this repository.


This project is licensed under the MIT License - see the LICENSE file for details


  • Hat tip to anyone whose code was used!
You can’t perform that action at this time.