I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for Microsoft Sentinel. It uses PowerShell 7, Az.SecurityInsights and KQL.

Repo: sentinel-kql-toolkit

The problem it solves

Analytics rules built in the portal are hard to track. Who changed what? Is there a backup?

Data connectors can also stop sending data without much noise. Then your detections see nothing.

This toolkit treats rules as code. It also checks that data still flows.

Highlight scripts

Export-SentinelAnalyticsRule.ps1

Exports analytics rules to JSON, one file per rule. Put them in Git for backup and review.

. / Export - SentinelAnalyticsRule . ps1 - Kind Scheduled

Enter fullscreen mode

Exit fullscreen mode

New-SentinelRuleFromKql.ps1

Creates or updates a Scheduled rule from a .kql file. Each detection has a metadata header.…