Microsoft AzureKnown publisherAzure/Azure-Sentinel/.cursor/rules/sentinel-xdr-migration.mdc

Azure-Sentinel / rules

Cursor rule6.2k starsChanged 16 days agoMITView on GitHub

Canonical Sentinel-to-Defender-XDR migration and authoring workflow

Files

sentinel-xdr-migration.mdc

---
description: Canonical Sentinel-to-Defender-XDR migration and authoring workflow
globs:
  - "Solutions/**"
  - "Tools/SentinelToXDRMigration/**"
  - "Tools/Create-Azure-Sentinel-Solution/**"
alwaysApply: false
---

For Sentinel-to-Defender-XDR migration, XDR Detection authoring, hybrid
packaging, or AR/CD qualification, read and follow
`Tools/SentinelToXDRMigration/agent-workflows/end-to-end-migration.md`.

That document is canonical. Use repository CLIs for deterministic behavior,
default to the authoring profile, and ask before optional qualification.
Qualification deployment, mock ingestion, and parity are not publishing
requirements. Use V3.1 through `package-v3-1` for Sentinel and XDR solution
packages. Resume persisted workflow state and require approval before writes.

Download now (ZIP)

Aug 9, 2024Logs automated export into Azure Storage Account and/or Log Analytics Workspace — pulumi/pulumi-cloud-requests2 reactions · 1 comment
Jun 11, 2022**Describe the bug** — octocat/Spoon-Knife2 reactions
Jul 8, 2026Feature 1 — redaliscbe/Azure-Sentinel1 reaction
Dec 3, 2020Updat the Entity eum to include all the new types — wortell/AZSentinel1 reaction
Oct 29, 2026Daily catalog: Iwatobi, SCuBA, AI scanning, and GCP detections — amcamillo/Cybersecurity_Tools0 reactions

38 more on GitHub

Oct 15, 2026Support reviewed workbook updates with clean public artifacts and local audit evidence — oferInbar/Azure-Sentinel0 reactions
Sep 28, 2026Mxdr 5375 v1 sentinel ccf multitenant — V1ManagedServices/Azure-Sentinel0 reactions
Sep 22, 2026Main to master — idoshabi07/Azure-Sentinel0 reactions
Sep 22, 2026Main — idoshabi07/Azure-Sentinel0 reactions
Sep 15, 2026Release/3.75.0 — ccx-mss/Azure-Sentinel0 reactions
Sep 14, 2026Release/3.75.0 — ccx-mss/Azure-Sentinel0 reactions · 1 comment
Sep 9, 2026Create connector-builder-agent configuration — fuqing04/Azure-Sentinel0 reactions
Aug 16, 2026Add dual-signal containment gate community plugin — Azure/Security-Copilot0 reactions
Aug 16, 2026Add dual_signal_containment_gate custom function — phantomcyber/playbooks0 reactions
Aug 10, 2026Semperis Lightning 4.1.0: merge CCF into existing offer (Function App + CCF) — MitchellGulledge3/Azure-Sentinel0 reactions · 5 comments
Aug 10, 2026RFPD-77178: log ingestion api (v3.0) — recordedfuture/Azure-Sentinel0 reactions
Jun 4, 2026Change api — adutt-commvault/Azure-Sentinel0 reactions
May 21, 2026Update README with contribution guidelines and resources — vikorium/Azure-Sentinel0 reactions
May 18, 2026Add weekly Azure Sentinel connector report workflow — fuqing04/sentinel-agent-runner0 reactions
Mar 17, 2026Feat sar 46819 — sonraisecurity/Azure-Sentinel0 reactions
Feb 27, 2026Update requirements.txt — daneshelias01/Azure-Sentinel0 reactions
Jan 20, 2026test — BC-47/Azure-Sentinel0 reactions
Jan 16, 2026Add new entry to ExclusionListForASimTests.csv — v-sabiraj/Azure-Sentinel0 reactions
Mar 13, 2025Create Cholitas — GravityFallsInc/GravityFalls_Sentinel0 reactions
Sep 10, 2024Patch-1 — mpmisha/Azure-Sentinel0 reactions
Jul 11, 2024 - added metadata tags to incident description — synack/Azure-Sentinel0 reactions
Jan 12, 2024Added local changes for test — SmitR01/Azure-Sentinel0 reactions
Nov 9, 2023Create dsdsadasda — aviatam/Azure-Sentinel0 reactions · 1 comment
Aug 24, 2023Praveenthepro patch 1 1 — praveenthepro/Azure-Sentinel0 reactions
Jul 31, 2023seraphic security connector — LihiAtzmoni1/Azure-Sentinel0 reactions · 1 comment
Jun 1, 2023Automation test — cohesity/Azure-Sentinel0 reactions
May 4, 2023Just a demo branch to show right structure of the installation and co… — cohesity/Azure-Sentinel0 reactions
Dec 6, 2022Cmmc2.0 — cwling75/AzureSentinel0 reactions
Dec 2, 2022Just initialize this new branch for Cohesity internal collaboration/r… — cohesity/Azure-Sentinel0 reactions · 4 comments
Aug 5, 2022Create intrigus-lgtm.txt — intrigus-lgtm/Azure-Sentinel0 reactions
Jun 7, 2022Yaronfr/log4j 1 — qusaiismail/Sentinel0 reactions
May 30, 2022test new script — sivanguetta/Azure-Sentinel0 reactions · 1 comment
May 30, 2022test — sivanguetta/Azure-Sentinel0 reactions · 1 comment
May 26, 2022Run ASIM testers on 'eco-connector-test' workspace — sivanguetta/Azure-Sentinel0 reactions · 1 comment
May 19, 2022Run ASIM testers on 'eco-connector-test' workspace — sivanguetta/Azure-Sentinel0 reactions · 1 comment
May 2, 2022[Asim] test kqlFuncYaml2Arm on ASimProcessEvent folder — sivanguetta/Azure-Sentinel0 reactions · 1 comment
Apr 26, 2022Test GitHub action that generates ARM templates from KQL — sivanguetta/Azure-Sentinel0 reactions
Feb 14, 2022Google Workspace connector: Don't use pickle — r4vi/Azure-Sentinel0 reactions

On Stack Overflow · 13

Aug 12, 2024How do I search through the in Sentinel Workbooks stored queries?1 vote
Apr 3, 2019Azure log analytics: monitoring successful sign-ins following repeated sign-in failures1 vote
Sep 29, 2024KQL for exfiltration of files/data ...almost there but slightly wrong0 votes · 1 answer
Aug 8, 2024How do I search through the in Sentinel Workbooks stored queries?0 votes
May 1, 2024Trying to set Azure Activity Log from Tenant Root(all subscriptions) getting Resource Provider Error0 votes · 1 answer

8 more on Stack Overflow

Apr 11, 2024Azure Sentinel Incident Trigger in Logic Apps Automation Delay0 votes
Nov 17, 2023Need Assistance with collecting O365 Audit Logs with function app and directing them to Event Hub0 votes · 1 answer
Oct 21, 2022Azure Sentinel Sample data CSV0 votes · 1 answer
Oct 12, 2022AZURE sentinel query to log off Azure remote session for user0 votes
Feb 4, 2022Integration issues with Microsoft Sentinel and ServiceNow and Get Etag0 votes
Dec 13, 2021How to detect when a security incident occurs0 votes
Jul 1, 2021Download multiple file from GitHub public repos without git0 votes
Feb 13, 2020Creating a Pull Request in Azure sentinel Repository0 votes · 1 answer

On Bluesky · 1

Feb 12, 2025📦 Azure / Azure-Sentinel ⭐ 4,774 (+3) 🗒 Python Cloud-native SIEM for intelligent security analytics for your entire enterprise. — @github-trending.bsky.social2 likes and reposts

In this repository30 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/copilot-instructions.mdCopilot instructions
- sentinel-xdr-migrationSkill
- asim-parser-create-parameter-parserSkill
- asim-parser-create-parserSkill
- asim-parser-creator-orchestratorSkill
- asim-parser-filter-validatorSkill
- asim-parser-github-pr-packagerSkill
- asim-parser-la-deployerSkill
- asim-parser-pr-reviewerSkill
- asim-parser-user-prompterSkill
- asim-parser-validatorSkill
- az-cli-command-runnerSkill
- azure-monitor-logs-ingestionSkill
- log-analytics-workspace-queryerSkill
- run-solution-analyzerSkill
- sentinel-solution-mock-data-generationSkill
- sentinel-solution-optional-testingSkill
- sentinel-xdr-alert-parity-validatorSkill
- sentinel-xdr-dependency-helperSkill
- sentinel-xdr-detection-validatorSkill
- sentinel-xdr-end-to-end-orchestratorSkill
- sentinel-xdr-migration-orchestratorSkill
- sentinel-xdr-rule-converterSkill
- sentinel-xdr-solution-deployerSkill
- sentinel-xdr-solution-packagerSkill
- solution-release-notes-updaterSkill
- update-solution-analyzerSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free