skills.rest
dstreefkerk
dstreefkerkCOMMUNITY
Explore all skills by this author →
𝕏@egosumdnsGitHub

sentinel-arm-generator

Generate Microsoft Sentinel Analytic Rule ARM templates from KQL queries.

4|Updated Mar 9, 2026
Search Tags:#azure#security automation#sentinel#arm template#kql#detection rule
One-click install
npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-arm-generator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sentinel-arm-generator
Source: https://github.com/dstreefkerk/claude-skills/tree/main/plugins/sentinel/skills/sentinel-arm-generator
Command: npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-arm-generator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kql_analyzer, mitre_attack_mapper, entity_extractor, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of Microsoft Sentinel Analytic Rule ARM templates, transforming tested KQL queries into deployment-ready files and significantly reducing manual configuration effort.

Core Features & Use Cases

  • Automated ARM Template Generation: Converts KQL queries into compliant ARM templates for Sentinel.
  • Intelligent Metadata Inference: Auto-generates rule names, descriptions, severity, and MITRE ATT&CK mappings.
  • Entity Extraction: Analyzes KQL to map entities like Accounts, IPs, and Hosts.
  • Use Case: You have a KQL query that successfully detects suspicious PowerShell activity. Use this Skill to generate the full ARM template, including MITRE mappings for Lateral Movement and Execution, and entity mappings for Account and Host, ready for deployment in your Sentinel workspace.

Quick Start

Use the sentinel-arm-generator skill to create an ARM template for the provided KQL query.

Frequently Asked Questions about sentinel-arm-generator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert a KQL query to a Sentinel ARM template?▼

To convert a KQL query to a Sentinel ARM template, you need to generate a deployment-ready file that includes detection rule metadata. This process automates the creation of rule names, severity assignments, and entity mappings for the Sentinel workspace.

How does automated entity extraction work for KQL detection rules?▼

Automated entity extraction for KQL detection rules works by analyzing the query syntax to identify and map security entities like Accounts, IPs, and Hosts. This ensures the generated ARM template properly configures entity mapping for Sentinel analytics.

Can I automatically generate MITRE ATT&CK mappings from KQL queries?▼

Yes, you can automatically generate MITRE ATT&CK mappings from KQL queries. The generation process analyzes the detection logic to infer relevant tactics and techniques, embedding them directly into the ARM template for Microsoft Sentinel.

What is the best way to deploy multiple KQL detection rules to Microsoft Sentinel?▼

The best way to deploy multiple KQL detection rules to Microsoft Sentinel is converting them into ARM templates for the 2023-12-01-preview API version. This approach enables efficient, automated security rule deployment and management at scale.

Do I need to manually configure severity and rule names for Sentinel detection rules?▼

No, you do not need to manually configure severity and rule names for Sentinel detection rules. Intelligent metadata inference analyzes your KQL query to auto-generate rule names, descriptions, and severity assignments within the ARM template.

Related Skills

Explore More Software Engineering Skills→
dstreefkerkdstreefkerk
4

sentinel-use-case-documentor

Generate SOC use case documentation from Microsoft Sentinel ARM templates and KQL queries.

Community
Advanced
appliedailearnerappliedailearner

azure-resource-manager

Design, troubleshoot, and deploy Azure Resource Manager solutions with ARM/Bicep templates.

Community
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
Liberty91LTDLiberty91LTD
15

kql-writing

Document KQL best practices for Microsoft Sentinel detection queries.

Official
Intermediate