Microsoft XDR (Defender) - How to export - Advanced Hunting - Custom Detection Rules

viri4to 10

Hello everyone,

Our team is trying to export the Custom Detection Rules. We have more than 50 rules, so we need an automated process that allows us to export and import the rules.

Currently, we see that the API function that allows this is still in beta: https://learn.microsoft.com/es-es/graph/api/security-detectionrule-get?view=graph-rest-beta&tabs=http.

We would also like to have version control for these rules. The idea would be to export them, upload them to a version control repository, and be able to sync the rules from there for different Microsoft XDR tenants. This would be similar to what exists with Analytics rules in Sentinel, which can be deployed through GitHub or Azure DevOps.

Any idea how we could achieve this without using the beta version of Graph or if there are plans for the API to launch stable versions?

thx

Wiszowaty, Sebastian 20 Reputation points

2024-11-08T09:52:07.4366667+00:00

Same here, we've tried to 'replicate' said detection rules but are facing 400 errors when actually trying to use POST to push them - without any clear indicators on why they had failed (error is non descript).
Gautam 5 Reputation points Microsoft Employee

2024-11-21T08:22:08.14+00:00

Hello, I'm trying to check in with a few folks if they can comment on when you can confidently use this in production. And also, for suggested documentation and feedback reporting, if you run into issues like how Sebastian mentions.
Gautam 5 Reputation points Microsoft Employee

2024-11-22T11:03:05.3433333+00:00

Hi @viri4to ,your end goal of ver control sounds great. Have you been able to test the beta API to achieve this already? It'd be great to have those steps shared somewhere where the community can re-use too them :).

For an official "when will this be GA" - We don't have a release timeline which we can share just yet. During which time the "do not use in production" would apply.

That said, in that time we're keen to collect feedback and hear about problems you encounter.

@Wiszowaty, Sebastian Please do share additional details of that error situation you hit, with details where possible, via https://developer.microsoft.com/en-us/graph/support
viri4to 10 Reputation points

2024-11-22T13:36:02.9533333+00:00

Hi Gautam,

We have done some testing with the API, but we were waiting to see if there was any official way to download/upload hunting queries to Defender tenants, or if there was any integration with a version control site. From what you’ve mentioned, I understand that there isn’t.

We will try to see if we can use the beta API to download and upload hunting queries and integrate this with GitHub.

Share via

Microsoft XDR (Defender) - How to export - Advanced Hunting - Custom Detection Rules

Your answer