Triage Microsoft Sentinel Incidents with a PowerShell Workflow
Pull Sentinel incidents, enrich them with related entities, export analytics rules, and feed your SOC a clean morning report.
Microsoft Sentinel is built to be queried, but most SOCs still spend the first hour of the day clicking through the portal to see what happened overnight. That is exactly the kind of work PowerShell should be doing.
The Az.SecurityInsights module gives you full programmatic access to incidents, entities, and analytics rules. PSForge gives you the Sentinel tasks ready to assemble into a triage and reporting workflow.
What a Sentinel triage workflow should produce
- A morning summary of new incidents with severity and assigned owner
- For each incident, the related entities (accounts, hosts, IPs)
- Recent KQL hunting query results for the same entities
- An exported list of currently enabled analytics rules with their last update time
- A diff against last week's rule export so changes are obvious
Why this is a workflow problem, not a query problem
Any single piece of this is a few lines of PowerShell. The value is in stitching them together so the SOC opens one report instead of switching between five blades in the portal.
PSForge lets you build the workflow visually, generate the PowerShell, and run it from Azure Automation or a runbook so the same report lands in the SOC inbox every morning.
Example Sentinel triage workflow
- Connect to the Log Analytics workspace that backs the Sentinel instance
- Pull all incidents created or updated in the last 24 hours
- For each incident, enumerate related entities and recent comments
- Run targeted KQL hunting queries against entities of interest
- Export the current set of analytics rules and their state
- Compare against last week's rule export to highlight changes
- Send the consolidated report to the SOC distribution list
Final thoughts
Sentinel rewards teams that automate the parts of triage that do not need a human.
PSForge makes it straightforward to assemble incident, entity, and analytics-rule tasks into a workflow your SOC can rely on every morning.