You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/siem-migration.md
+18-3Lines changed: 18 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -89,7 +89,12 @@ Here are some of the priorities that are important to us as we continue to devel
89
89
1. Review the analysis of the Splunk export.
90
90
91
91
-**Name** is the original Splunk detection rule name.
92
-
-**Compatibility** indicates if a Sentinel OOTB analytics rule matches the Splunk detection logic.
92
+
-**Translation Type** indicates if a Sentinel OOTB analytics rule matches the Splunk detection logic.
93
+
-**Translation State** has the following values:
94
+
-**Fully Translated** queries in this rule were fully translated to KQL
95
+
-**Partially Translated** queries in this rule weren't fully translated to KQL
96
+
-**Not Translated** indicates an error in translation
97
+
-**Manually Translated** when any rule is reviewed and saved
93
98
94
99
:::image type="content" source="media/siem-migration/configure-rules.png" alt-text="Screenshot showing the results of the automatic rule mapping." lightbox="media/siem-migration/configure-rules.png":::
95
100
@@ -100,12 +105,22 @@ Here are some of the priorities that are important to us as we continue to devel
100
105
101
106
## Deploy the Analytics rules
102
107
103
-
1. Select **Deploy** to start the deployment of analytics rules to your Microsoft Sentinel workspace.
108
+
1. (Optional) Select **Export Templates** to download the Analytics rules as ARM templates for us in your CI/CD or custom deployment processes.
109
+
110
+
:::image type="content" source="media/siem-migration/export-templates.png" alt-text="Screenshot showing the Review and Migrate tab highlighting the Export Templates button.":::
111
+
112
+
1.**Deploy** starts the deployment of the selected analytics rules to your Microsoft Sentinel workspace.
104
113
105
114
The following resources are deployed:
106
115
- For all OOTB matches, the corresponding solutions with the matched analytics rule are installed, and the matched rules are deployed as active analytics rules.
107
116
- All custom rules translated to Sentinel analytics rules are deployed as active analytics rules.
108
117
118
+
1. Before exiting the SIEM Migration experience, **Download Migration Summary** to keep a summary of the Analytics deployment.
119
+
120
+
:::image type="content" source="media/siem-migration/download-migration-summary.png" alt-text="Screenshot showing the Download Migration Summary button from the Review and Migrate tab.":::
121
+
122
+
## Validate and enable rules
123
+
109
124
1. View the properties of deployed rules from Microsoft Sentinel **Analytics**.
110
125
111
126
- All migrated rules are deployed with the Prefix **[Splunk Migrated]**.
@@ -118,7 +133,7 @@ Here are some of the priorities that are important to us as we continue to devel
0 commit comments