Skip to content

Commit 2ca6c55

Browse files
remove future promise translate capabilities
1 parent 07317d8 commit 2ca6c55

File tree

1 file changed

+1
-14
lines changed

1 file changed

+1
-14
lines changed

articles/sentinel/siem-migration.md

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -40,25 +40,12 @@ You need the following on the target, Microsoft Sentinel:
4040

4141
At the core of Splunk detection rules is the Search Processing Language (SPL). The SIEM migration experience systematically translates SPL to Kusto query language (KQL) for each Splunk rule. Carefully review translations and make adjustments to ensure migrated rules function as intended in your Microsoft Sentinel workspace. For more information on the concepts important in translating detection rules, see [migrate Splunk detection rules](migration-splunk-detection-rules.md).
4242

43-
Capabilities today:
43+
Capabilities in public preview:
4444

4545
- Translate simple queries with a single data source
4646
- Direct translations listed in the article, [Splunk to Kusto cheat sheet](/azure/data-explorer/kusto/query/splunk-cheat-sheet)
4747
- Review translated query error feedback with edit capability to save time in the detection rule translation process
4848

49-
Capabilities coming soon:
50-
51-
- Splunk Common Information Model (CIM) to Microsoft Sentinel's Advanced Security Information Model (ASIM) translation support
52-
- Translated queries feature a completeness status with translation states
53-
54-
Capabilities on the roadmap:
55-
56-
- Multiple data sources and index
57-
- Rule correlations
58-
- Support for macros
59-
- Support for lookups
60-
- Complex queries with joins
61-
6249
## Start the SIEM migration experience
6350

6451
1. Navigate to Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **Content management**, select **Content hub**.

0 commit comments

Comments
 (0)