You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/migration-qradar-detection-rules.md
+23-19Lines changed: 23 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,19 +1,18 @@
1
1
---
2
2
title: Migrate QRadar detection rules to Microsoft Sentinel | Microsoft Docs
3
-
description: Identify, compare, and migrate your QRadar detection rules to Microsoft Sentinel built-in rules.
3
+
description: Identify, compare, and migrate your QRadar detection rules to Microsoft Sentinel analytics rules using Content Hub solutions.
4
4
author: cwatson-cat
5
5
ms.author: cwatson
6
6
ms.topic: how-to
7
-
ms.date: 05/03/2022
7
+
ms.date: 07/03/2025
8
8
9
-
10
-
#Customer intent: As a security engineer, I want to migrate QRadar detection rules to Microsoft Sentinel so that analysts can leverage machine learning analytics and built-in rules for more efficient threat detection and incident response.
9
+
#Customer intent: As a security engineer, I want to migrate QRadar detection rules to Microsoft Sentinel so that analysts can leverage machine learning analytics and content from Content Hub solutions for more efficient threat detection and incident response.
11
10
12
11
---
13
12
14
13
# Migrate QRadar detection rules to Microsoft Sentinel
15
14
16
-
This article describes how to identify, compare, and migrate your QRadar detection rules to Microsoft Sentinel built-in rules.
15
+
This article describes how to identify, compare, and migrate your QRadar detection rules to Microsoft Sentinel analytics rules available through Content Hub solutions.
17
16
18
17
## Identify and migrate rules
19
18
@@ -24,11 +23,11 @@ Microsoft Sentinel uses machine learning analytics to create high-fidelity and a
24
23
- Check that you understand the [rule terminology](#compare-rule-terminology).
25
24
- Review any rules that haven't triggered any alerts in the past 6-12 months, and determine whether they're still relevant.
26
25
- Eliminate low-level threats or alerts that you routinely ignore.
27
-
- Use existing functionality, and check whether Microsoft Sentinel’s [built-in analytics rules](https://github.com/Azure/Azure-Sentinel/tree/master/Detections) might address your current use cases. Because Microsoft Sentinel uses machine learning analytics to produce high-fidelity and actionable incidents, it’s likely that some of your existing detections won’t be required anymore.
26
+
- Use existing functionality available through Content Hub solutions. Browse the [Content Hub](https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog) to find solutions that contain analytics rule templates addressing your current use cases. Because Microsoft Sentinel uses machine learning analytics to produce high-fidelity and actionable incidents, it's likely that some of your existing detections won't be required anymore.
28
27
- Confirm connected data sources and review your data connection methods. Revisit data collection conversations to ensure data depth and breadth across the use cases you plan to detect.
29
-
- Explore community resources such as the [SOC Prime Threat Detection Marketplace](https://my.socprime.com/platform-overview/) to check whether your rules are available.
28
+
- Explore community resources such as the [SOC Prime Threat Detection Marketplace](https://my.socprime.com/platform-overview/) to check whether your rules are available.
30
29
- Consider whether an online query converter such as Uncoder.io might work for your rules.
31
-
- If rules aren’t available or can’t be converted, they need to be created manually, using a KQL query. Review the [rules mapping](#map-and-compare-rule-samples) to create new queries.
30
+
- If rules aren't available or can't be converted, they need to be created manually, using a KQL query. Review the [rules mapping](#map-and-compare-rule-samples) to create new queries.
32
31
33
32
Learn more about [best practices for migrating detection rules](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/best-practices-for-migrating-detection-rules-from-arcsight/ba-p/2216417).
34
33
@@ -42,25 +41,29 @@ Learn more about [best practices for migrating detection rules](https://techcomm
42
41
43
42
1.**Confirm that you have any required data sources connected,** and review your data connection methods.
44
43
45
-
1. Verify whether your detections are available as built-in templates in Microsoft Sentinel:
44
+
1. Verify whether your detections are available through Content Hub solutions in Microsoft Sentinel:
46
45
47
-
-**If the built-in rules are sufficient**, use built-in rule templates to create rules for your own workspace.
46
+
-**If suitable analytics rule templates are available in Content Hub solutions**, install the relevant solutions and use the templates to create rules for your workspace.
48
47
49
-
In Microsoft Sentinel, go to the **Configuration > Analytics > Rule templates** tab, and create and update each relevant analytics rule.
48
+
1. In Microsoft Sentinel, go to **Content management > Content hub**.
49
+
2. Search for and install solutions that contain analytics rules relevant to your security scenarios.
50
+
3. After installing solutions, go to **Configuration > Analytics > Rule templates** tab.
51
+
4. Filter by solution name to find the templates from your installed solutions.
52
+
5. Create and configure each relevant analytics rule from the templates.
50
53
51
-
For more information, see [Create scheduled analytics rules from templates](create-analytics-rule-from-template.md).
54
+
For more information, see [Discover and manage Microsoft Sentinel out-of-the-box content](sentinel-solutions-deploy.md) and [Create scheduled analytics rules from templates](create-analytics-rule-from-template.md).
52
55
53
-
-**If you have detections that aren't covered by Microsoft Sentinel's built-in rules**, try an online query converter, such as [Uncoder.io](https://uncoder.io/) to convert your queries to KQL.
56
+
-**If you have detections that aren't covered by Content Hub solutions**, try an online query converter, such as [Uncoder.io](https://uncoder.io/) to convert your queries to KQL.
54
57
55
58
Identify the trigger condition and rule action, and then construct and review your KQL query.
56
59
57
-
-**If neither the built-in rules nor an online rule converter is sufficient**, you'll need to create the rule manually. In such cases, use the following steps to start creating your rule:
60
+
-**If neither Content Hub solutions nor an online rule converter is sufficient**, you'll need to create the rule manually. In such cases, use the following steps to start creating your rule:
58
61
59
62
1.**Identify the data sources you want to use in your rule**. You'll want to create a mapping table between data sources and data tables in Microsoft Sentinel to identify the tables you want to query.
60
63
61
64
1.**Identify any attributes, fields, or entities** in your data that you want to use in your rules.
62
65
63
-
1.**Identify your rule criteria and logic**. At this stage, you may want to use rule templates as samples for how to construct your KQL queries.
66
+
1.**Identify your rule criteria and logic**. At this stage, you may want to examine analytics rule templates from Content Hub solutions as samples for how to construct your KQL queries.
64
67
65
68
Consider filters, correlation rules, active lists, reference sets, watchlists, detection anomalies, aggregations, and so on. You might use references provided by your legacy SIEM to understand [how to best map your query syntax](#map-and-compare-rule-samples).
66
69
@@ -73,7 +76,7 @@ Learn more about [best practices for migrating detection rules](https://techcomm
73
76
Learn more about analytics rules:
74
77
75
78
-[**Scheduled analytics rules in Microsoft Sentinel**](scheduled-rules-overview.md). Use [alert grouping](scheduled-rules-overview.md#alert-grouping) to reduce alert fatigue by grouping alerts that occur within a given timeframe.
76
-
-[**Map data fields to entities in Microsoft Sentinel**](map-data-fields-to-entities.md) to enable SOC engineers to define entities as part of the evidence to track during an investigation. Entity mapping also makes it possible for SOC analysts to take advantage of an intuitive [investigation graph(investigate-cases.md#use-the-investigation-graph-to-deep-dive) that can help reduce time and effort.
79
+
-[**Map data fields to entities in Microsoft Sentinel**](map-data-fields-to-entities.md) to enable SOC engineers to define entities as part of the evidence to track during an investigation. Entity mapping also makes it possible for SOC analysts to take advantage of an intuitive [investigation graph](investigate-cases.md#use-the-investigation-graph-to-deep-dive) that can help reduce time and effort.
77
80
-[**Investigate incidents with UEBA data**](investigate-with-ueba.md), as an example of how to use evidence to surface events, alerts, and any bookmarks associated with a particular incident in the incident preview pane.
78
81
-[**Kusto Query Language (KQL)**](/kusto/query/?view=microsoft-sentinel&preserve-view=true), which you can use to send read-only requests to your [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial) database to process data and return results. KQL is also used across other Microsoft services, such as [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender) and [Application Insights](/azure/azure-monitor/app/app-insights-overview).
79
82
@@ -87,10 +90,11 @@ This table helps you to clarify the concept of a rule in Microsoft Sentinel comp
87
90
|**Criteria**|Define in test condition |Define in KQL |
88
91
|**Trigger condition**|Define in rule |Threshold: Number of query results |
89
92
|**Action**|• Create offense<br>• Dispatch new event<br>• Add to reference set or data<br>• And more |• Create alert or incident<br>• Integrates with Logic Apps |
93
+
|**Rule location**|Built into product |Available through Content Hub solutions |
90
94
91
95
## Map and compare rule samples
92
96
93
-
Use these samples to compare and map rules from QRadar to Microsoft Sentinel in various scenarios.
97
+
Use these samples to compare and map rules from QRadar to Microsoft Sentinel in various scenarios. When creating custom rules in Microsoft Sentinel, consider first checking Content Hub for solutions that might contain similar rule templates.
0 commit comments