sentinel-arm-generator

Generate Microsoft Sentinel Analytic Rule ARM templates from KQL queries.

4|Updated Mar 9, 2026

Search Tags:#azure #security automation #sentinel #arm template #kql #detection rule

Ready to run

npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-arm-generator

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sentinel-arm-generator
Source: https://github.com/dstreefkerk/claude-skills/tree/main/plugins/sentinel/skills/sentinel-arm-generator
Command: npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-arm-generator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kql_analyzer, mitre_attack_mapper, entity_extractor, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of Microsoft Sentinel Analytic Rule ARM templates, transforming tested KQL queries into deployment-ready files and significantly reducing manual configuration effort.

Core Features & Use Cases

Automated ARM Template Generation: Converts KQL queries into compliant ARM templates for Sentinel.
Intelligent Metadata Inference: Auto-generates rule names, descriptions, severity, and MITRE ATT&CK mappings.
Entity Extraction: Analyzes KQL to map entities like Accounts, IPs, and Hosts.
Use Case: You have a KQL query that successfully detects suspicious PowerShell activity. Use this Skill to generate the full ARM template, including MITRE mappings for Lateral Movement and Execution, and entity mappings for Account and Host, ready for deployment in your Sentinel workspace.

Quick Start

Use the sentinel-arm-generator skill to create an ARM template for the provided KQL query.

Frequently Asked Questions about sentinel-arm-generator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I convert a KQL query to a Sentinel ARM template?▼

To convert a KQL query to a Sentinel ARM template, you need to generate a deployment-ready file that includes detection rule metadata. This process automates the creation of rule names, severity assignments, and entity mappings for the Sentinel workspace.

How does automated entity extraction work for KQL detection rules?▼

Automated entity extraction for KQL detection rules works by analyzing the query syntax to identify and map security entities like Accounts, IPs, and Hosts. This ensures the generated ARM template properly configures entity mapping for Sentinel analytics.

Can I automatically generate MITRE ATT&CK mappings from KQL queries?▼

Yes, you can automatically generate MITRE ATT&CK mappings from KQL queries. The generation process analyzes the detection logic to infer relevant tactics and techniques, embedding them directly into the ARM template for Microsoft Sentinel.

What is the best way to deploy multiple KQL detection rules to Microsoft Sentinel?▼

The best way to deploy multiple KQL detection rules to Microsoft Sentinel is converting them into ARM templates for the 2023-12-01-preview API version. This approach enables efficient, automated security rule deployment and management at scale.

Do I need to manually configure severity and rule names for Sentinel detection rules?▼

No, you do not need to manually configure severity and rule names for Sentinel detection rules. Intelligent metadata inference analyzes your KQL query to auto-generate rule names, descriptions, and severity assignments within the ARM template.