Issue with deploying 100 ASIM rules playbook

[jusso-dev]

Hey all,

Trying to deploy the rules you provided here - https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fsoc.cyber.wa.gov.au%2Fonboarding%2Fwasoc-sentinel-rules-deployment.json - but the ARM template just failed over and over again.

I suspect it's related to this issue - Azure/Azure-Sentinel#8623

Are you seeing this happen on your end?

[adonm]

Hi jusso, yep I believe the issue you linked will mean there are some failures depending on the ASIM state in target tenant. We are currently re-architecting our standard rules to utilise https://learn.microsoft.com/en-us/azure/sentinel/ci-cd?tabs=github and once tested will switch our guidance over to using that process - will link this issue to appropriate merge once we complete the change.

[adonm]

Hi @jusso-dev,

We have adjusted our docs to follow the content hub approach for deployment in the interim, see https://soc.cyber.wa.gov.au/baselines/data-sources/#51-improving-microsoft-sentinel-detection-coverage

Kind Regards,
Adon