Stats
Actions
Tags
From sentinel
Generates deployment-ready Microsoft Sentinel Analytic Rule ARM templates from KQL detection queries. Use when the user asks to create, export, or package a Sentinel analytics rule, convert a KQL query into an ARM template, or generate rule deployment files with MITRE ATT&CK mappings and entity extraction.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sentinel:sentinel-arm-generatorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Transform tested KQL detection queries into complete, deployment-ready Microsoft Sentinel Analytic Rule ARM templates. Eliminates manual overhead by intelligently inferring rule names, MITRE ATT&CK mappings, entity mappings, and metadata from your KQL query and conversation context.
Transform tested KQL detection queries into complete, deployment-ready Microsoft Sentinel Analytic Rule ARM templates. Eliminates manual overhead by intelligently inferring rule names, MITRE ATT&CK mappings, entity mappings, and metadata from your KQL query and conversation context.
CRITICAL: Before generating any ARM template, you MUST read the files in the
references/folder. They contain required technical specifications for entity mappings, MITRE patterns, ARM schema, and validation rules.
@sentinel-arm-generator
I've been working on this KQL query for detecting suspicious Azure AD sign-ins:
SigninLogs
| where ResultType != "0"
| where AppDisplayName != "Microsoft Authentication Broker"
| summarize FailedAttempts = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 5m)
| where FailedAttempts >= 5
| project TimeGenerated, UserPrincipalName, IPAddress, FailedAttempts
Generate the ARM template for deployment.
Skill will automatically:
@sentinel-arm-generator
Generate ARM template for this KQL detecting file creation in temp directories:
DeviceFileEvents
| where FolderPath contains "\\Temp\\"
| where FileOriginReferrerUrl startswith "http"
| project TimeGenerated, DeviceName, FileName, FolderPath, FileOriginUrl
Use severity: Medium
Add custom description: Detects potentially suspicious file downloads to temp folders
@sentinel-arm-generator
Generate ARM templates for all three KQL queries we discussed:
1. The brute force detection query
2. The privilege escalation detection query
3. The data exfiltration detection query
sentinel-rule-{rule-name}.jsonLocated in scripts/ folder:
scripts/generate_arm_template.py: Main template generation enginescripts/mitre_attack_mapper.py: MITRE ATT&CK framework mappingscripts/entity_extractor.py: KQL query parser for entity identificationscripts/kql_analyzer.py: Query analysis for severity/frequency recommendationsAutomatically identifies and maps Sentinel entity types from KQL output columns:
Constraint: Maximum 5 entity mappings, each type used only once.
Required: Consult references/ENTITY_MAPPINGS.md for complete column patterns and identifiers.
Auto-maps tactics and techniques based on detection patterns:
Required: Consult references/MITRE_MAPPINGS.md for complete tactic/technique mappings.
| Level | Triggers |
|---|---|
| High | Credential compromise, privilege escalation, lateral movement, exfiltration, malware |
| Medium | Policy violations, suspicious behavior, config changes, failed security events |
| Low | Compliance monitoring, audit events, baseline deviations |
| Informational | Usage statistics, inventory changes, routine events |
Critical: Always set queryPeriod > queryFrequency to handle ingestion lag.
| Detection Type | Frequency | Period |
|---|---|---|
| Real-Time Critical | PT5M | PT10M |
| Real-Time Standard | PT5M | PT15M |
| Hourly | PT1H | PT2H |
| Daily | P1D | P1D (with TimeGenerated filter) |
Surface KQL columns into incidents without alertDescriptionFormat limits:
"customDetails": {
"RiskLevel": "RiskLevel",
"ProcessName": "ProcessName",
"TargetResource": "TargetResource"
}
| Aggregation | Use When |
|---|---|
| SingleAlert | Threshold-based detections, correlation rules |
| AlertPerResult | Each row is distinct incident |
Critical constraints enforced by Azure:
| Constraint | Limit | Impact |
|---|---|---|
| alertDescriptionFormat parameters | Max 3 | Deployment fails |
| entityMappings | Max 5 | Deployment fails |
| Entity type | Once per type | Deployment fails |
| templateVersion (custom rules) | Must NOT include | Deployment fails |
Required: Consult references/BEST_PRACTICES.md for validation rules and Sentinel table reference.
az deployment group create \
--resource-group <rg-name> \
--template-file sentinel-rule-{rule-name}.json \
--parameters workspace=<workspace-name>
New-AzResourceGroupDeployment `
-ResourceGroupName <rg-name> `
-TemplateFile sentinel-rule-{rule-name}.json `
-workspace <workspace-name>
IMPORTANT: You MUST read and apply the reference files when generating ARM templates. These contain critical technical specifications that are NOT duplicated in this file.
| File | Purpose | When to Use |
|---|---|---|
| references/ARM_TEMPLATE.md | Template structure, schema, JSON escaping | Every generation - contains ARM schema requirements |
| references/ENTITY_MAPPINGS.md | Entity types, identifiers, column patterns | Every generation - required for entity extraction |
| references/MITRE_MAPPINGS.md | Tactics, techniques, detection patterns | Every generation - required for MITRE mapping |
| references/BEST_PRACTICES.md | Quality checks, limitations, Sentinel tables | Every generation - required for validation |
Failure to consult these references will result in incorrect or invalid ARM templates.
Microsoft.SecurityInsights: 2023-12-01-preview
npx claudepluginhub dstreefkerk/claude-skills --plugin sentinelExpert guidance for Azure Sentinel: troubleshooting connectors, KQL/ASIM, Logic Apps playbooks, UEBA, multi-tenant MSSP, deployment, and cost optimization.
Configures Microsoft Sentinel as a cloud-native SIEM with multi-cloud connectors, KQL detection queries, and automated response playbooks.
Deploys Microsoft Sentinel as cloud-native SIEM/SOAR for multi-cloud security ops. Configures data connectors for AWS/Azure/GCP logs, KQL detection queries, Logic Apps playbooks, and petabyte-scale threat hunting.