sentinel-use-case-documentor

To generate SOC use case documentation, provide a Microsoft Sentinel analytics rule ARM template export. The skill parses the ARM template and KQL query to automatically extract detection logic, MITRE ATT&CK mappings, and entity mappings into a standardized document.

Documenting Sentinel KQL queries is best handled by analyzing the detection logic to infer context and identify data sources. This approach automates the extraction of embedded documentation and generates comprehensive use case details like problem statements and investigation steps.

Yes, you can extract MITRE ATT&CK mappings directly from a Sentinel ARM template. The skill parses the exported ARM template file to retrieve key details, including detection logic, MITRE ATT&CK mappings, and entity mappings, for your SOC documentation.

Yes, the Sentinel documentor supports guided interactive refinement for critical rules. You can choose between quick documentation generation with placeholders or a guided interactive refinement process to ensure comprehensive use case documentation for important detections.

Automating the creation of false positive guidance is achieved by parsing the Sentinel ARM template and analyzing the KQL detection query. The skill infers contextual information to automatically generate purpose, problem statements, investigation steps, and false positive guidance.

When generating use case documents from KQL queries, the skill relies on inferring context from the detection logic and extracting embedded documentation. If the KQL query lacks clear context or embedded comments, the generated problem statement and investigation steps may require manual refinement.