{"id":"7f78c63d-d811-45d5-bda4-f338d4016913","task":"Manage Microsoft Sentinel analytics rules programmatically via the REST API","domain":"learn.microsoft.com","steps":["Authenticate with Entra ID using a service principal and obtain a token for the Azure management audience (management.azure.com).","List existing alert rules with GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules?api-version=2025-09-01.","Create or update a scheduled analytics rule with PUT to the same base path appended with /{ruleId}, supplying a JSON body with kind, displayName, query, queryFrequency, queryPeriod, triggerOperator, triggerThreshold, severity, and tactics fields.","Enable or disable a rule by PATCHing the enabled property on the rule object.","Export rules to ARM JSON for GitOps: retrieve each rule via GET, strip read-only fields, and store the body as a parameterized ARM template in version control."],"gotchas":["API versions change regularly; transition to api-version 2025-09-01 or later before June 2026 to avoid service disruption on repository-connection APIs.","The queryFrequency and queryPeriod fields use ISO 8601 duration strings (e.g., PT5M); malformed durations fail silently on some older API versions and produce no detection.","Analytics rules that reference custom tables require the table to already exist in the workspace; deploying the rule before the table causes the rule to be created in a disabled or errored state."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:48.523Z"},"url":"https://mcp.waymark.network/r/7f78c63d-d811-45d5-bda4-f338d4016913"}