Conversion of Existing SIEM(QRadar, Arcsight) rule to Sentinel

New Contributor

The key challenge which we are facing is to migrate existing SIEM(QRadar, ArcSight) solution use cases to Sentinel Use cases. We tried but even that is not helpful to 1%. Please support if some one is having good way to execute it.  

4 Replies
You can convert only the queries. Use cases in ArcSight ESM or QRadar has to be rebuilt on Sentinel manually.

@vijayyadav351 You can also check places like SocPrime that have a repository of alert rules to see if the ones you need in your other system are present and then export those as Azure Sentinel rules.

@mergene but I am unable to convert query also. You mean using or there is other way available.  

This article covers the related best practices comprehensively.

Best practices for migrating detection rules from ArcSight, Splunk and QRadar to Azure Sentinel