Learning Path 9 - Lab 1 - Exercise 11 - Use Repositories in Microsoft Sentinel

Lab scenario

You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You already created Scheduled and Microsoft Security Analytics rules. You need to centralize analytical rules in an Azure DevOps repository. Then connect Sentinel to the Azure DevOps repository and import the content.

Important: The lab exercises for Learning Path #9 are in a standalone environment. If you exit the lab before completing it, you will be required to re-run the configurations again.

Estimated time to complete this lab: 30 minutes

Task 1: Create and export an analytical rule

In this task, you will enable Entity behavior analytics in Microsoft Sentinel.

Log in to WIN1 virtual machine as Admin with the password: Pa55w.rd.
In the Sign in dialog box, copy and paste in the Tenant Email account provided by your lab hosting provider and then select Next.
In the Enter password dialog box, copy and paste in the Tenant Password provided by your lab hosting provider and then select Sign in.
In the Search bar of the Azure portal, type Sentinel, then select Microsoft Sentinel.
Select your Microsoft Sentinel Workspace.
Select Analytics under the Configuration area from the left blade.
Select the Startup RegKey rule that you created earlier.
Select the Export from the toolbar. Hint: You might need to select the ellipsis icon (…) to see it.
The rule is exported to a text file named Azure_Sentinel_analytic_rule.json.
Select Open file below the name of the downloaded file and then select More apps.
Select Notepad and then select OK.
Review the Azure Resource Manager template and the close it when done.

Task 2: Create our Azure DevOps environment

In this task, you will create an Azure DevOps repository.

Open another tab in the browser and navigate to https://aexprodcus1.vsaex.visualstudio.com/me?mkt=en-US.
On the We need a few more details page, select Continue.
On the Get started with Azure DevOps page, select Create new organization and then select Continue.

Note: If this operation doesn’t complete after a minute or more, Refresh (Ctrl-R) the browser page.
On the Almost done… page, enter a name for your DevOps organization that you would not want to use in the future, like for example, your tenant prefix.

Hint: It can be found in the Resources tab of your lab (WWLx…).
Enter characters you see, then Continue.
On the Create a project to get started page, enter My Sentinel Content and then select Create project.
Navigate to Repos on the left pane.
At the bottom of the page in the area Initialize main branch with a README or gitignore, select Initialize.
The page should show the Files for the Repo. the only file is README.me.
On the Files (right side of the page) blade, the toolbar include options Set up build, Clone, … Select the colon icon (:) to show more options.
Select Upload Files.
Select Browse and select the file Azure_Sentinel_analytic_rule.json from your Downloads directory, and select Open.
Select Commit.
Select Azure DevOps on the top left corner of the page. This display your organization and projects.
Select Organization settings from the bottom left of the page.
Select Policies under the Security area of the left blade.
Toggle On Third-party application access via OAuth under the Application connection policies area.

Task 3: Connect Sentinel to Azure DevOps.