Skip to content

Commit 38d98a4

Browse files
add GA features
1 parent cc7b408 commit 38d98a4

File tree

5 files changed

+18
-3
lines changed

5 files changed

+18
-3
lines changed
-76.5 KB
Loading
62.5 KB
Loading
83 KB
Loading
17.1 KB
Loading

articles/sentinel/siem-migration.md

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,12 @@ Here are some of the priorities that are important to us as we continue to devel
8989
1. Review the analysis of the Splunk export.
9090

9191
- **Name** is the original Splunk detection rule name.
92-
- **Compatibility** indicates if a Sentinel OOTB analytics rule matches the Splunk detection logic.
92+
- **Translation Type** indicates if a Sentinel OOTB analytics rule matches the Splunk detection logic.
93+
- **Translation State** has the following values:
94+
- **Fully Translated** queries in this rule were fully translated to KQL
95+
- **Partially Translated** queries in this rule weren't fully translated to KQL
96+
- **Not Translated** indicates an error in translation
97+
- **Manually Translated** when any rule is reviewed and saved
9398

9499
:::image type="content" source="media/siem-migration/configure-rules.png" alt-text="Screenshot showing the results of the automatic rule mapping." lightbox="media/siem-migration/configure-rules.png":::
95100

@@ -100,12 +105,22 @@ Here are some of the priorities that are important to us as we continue to devel
100105

101106
## Deploy the Analytics rules
102107

103-
1. Select **Deploy** to start the deployment of analytics rules to your Microsoft Sentinel workspace.
108+
1. (Optional) Select **Export Templates** to download the Analytics rules as ARM templates for us in your CI/CD or custom deployment processes.
109+
110+
:::image type="content" source="media/siem-migration/export-templates.png" alt-text="Screenshot showing the Review and Migrate tab highlighting the Export Templates button.":::
111+
112+
1. **Deploy** starts the deployment of the selected analytics rules to your Microsoft Sentinel workspace.
104113

105114
The following resources are deployed:
106115
- For all OOTB matches, the corresponding solutions with the matched analytics rule are installed, and the matched rules are deployed as active analytics rules.
107116
- All custom rules translated to Sentinel analytics rules are deployed as active analytics rules.
108117

118+
1. Before exiting the SIEM Migration experience, **Download Migration Summary** to keep a summary of the Analytics deployment.
119+
120+
:::image type="content" source="media/siem-migration/download-migration-summary.png" alt-text="Screenshot showing the Download Migration Summary button from the Review and Migrate tab.":::
121+
122+
## Validate and enable rules
123+
109124
1. View the properties of deployed rules from Microsoft Sentinel **Analytics**.
110125

111126
- All migrated rules are deployed with the Prefix **[Splunk Migrated]**.
@@ -118,7 +133,7 @@ Here are some of the priorities that are important to us as we continue to devel
118133
`triggerThreshold`<br>
119134
`suppressionDuration`
120135

121-
1. Enable rules you've reviewed and verified.
136+
1. Enable rules after you review and verify them.
122137

123138
## Next step
124139

0 commit comments

Comments
 (0)