sentinel-use-case-documentor

Generate SOC use case documentation from Microsoft Sentinel ARM templates and KQL queries.

4|Updated Mar 9, 2026

Search Tags:#documentation #use case #sentinel #arm template #soc #kql

Ready to run

npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-use-case-documentor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sentinel-use-case-documentor
Source: https://github.com/dstreefkerk/claude-skills/tree/main/plugins/sentinel/skills/sentinel-use-case-documentor
Command: npx skills add https://github.com/dstreefkerk/claude-skills --skill sentinel-use-case-documentor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of comprehensive Security Operations Center (SOC) use case documentation from Microsoft Sentinel analytics rules, saving significant manual effort and ensuring consistency.

Core Features & Use Cases

ARM Template Parsing: Extracts key details like detection logic, MITRE ATT&CK mappings, and entity mappings directly from Sentinel ARM template exports.
KQL Analysis: Analyzes the detection query to infer context, identify data sources, and extract embedded documentation.
Use Case: When a new Sentinel detection rule is deployed, use this Skill to generate a standardized SOC use case document that includes purpose, problem statement, investigation steps, and false positive guidance.

Quick Start

Use the sentinel-use-case-documentor skill to document the Sentinel rule from the attached file 'MyDetectionRule.json'.

Frequently Asked Questions about sentinel-use-case-documentor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate SOC use case documentation from Microsoft Sentinel analytics rules?▼

To generate SOC use case documentation, provide a Microsoft Sentinel analytics rule ARM template export. The skill parses the ARM template and KQL query to automatically extract detection logic, MITRE ATT&CK mappings, and entity mappings into a standardized document.

What is the best way to document Sentinel KQL queries for a security operations center?▼

Documenting Sentinel KQL queries is best handled by analyzing the detection logic to infer context and identify data sources. This approach automates the extraction of embedded documentation and generates comprehensive use case details like problem statements and investigation steps.

Can I extract MITRE ATT&CK mappings directly from a Sentinel ARM template?▼

Yes, you can extract MITRE ATT&CK mappings directly from a Sentinel ARM template. The skill parses the exported ARM template file to retrieve key details, including detection logic, MITRE ATT&CK mappings, and entity mappings, for your SOC documentation.

Does this Sentinel documentor support guided interactive refinement for critical rules?▼

Yes, the Sentinel documentor supports guided interactive refinement for critical rules. You can choose between quick documentation generation with placeholders or a guided interactive refinement process to ensure comprehensive use case documentation for important detections.

How do I automate the creation of false positive guidance for Sentinel detection rules?▼

Automating the creation of false positive guidance is achieved by parsing the Sentinel ARM template and analyzing the KQL detection query. The skill infers contextual information to automatically generate purpose, problem statements, investigation steps, and false positive guidance.

What limitations exist when generating use case documents from KQL queries?▼

When generating use case documents from KQL queries, the skill relies on inferring context from the detection logic and extracting embedded documentation. If the KQL query lacks clear context or embedded comments, the generated problem statement and investigation steps may require manual refinement.