Sentinel Use Case Documentor

Sentinel Use Case Documentor

Transforms Sentinel ARM template exports into standardized SOC use case documentation.

When to Use

• User provides a Sentinel ARM template JSON file
• User asks to "document" a detection rule or analytics rule
• User wants SOC/SIEM use case documentation

Example: Document this Sentinel rule: @rule.json

Two Modes

Workflow

Step 0: Load References

Read these files to understand expected output:

1. expected_output.md - Complete example
2. references/TEMPLATE.md - Copyable template

Step 1: Ask Mode

Use AskUserQuestion: "How would you like to document this rule?"

• Quick Mode - Generate with placeholders
• Guided Mode - Interactive Q&A

Step 2: Parse ARM Template

Extract from resources[0].properties:

Step 3: Analyze KQL Query

Identify from query field:

• Tables: Map to connectors (see references/REFERENCE.md for full mapping)
• Thresholds: count() >= N, where X > N
• Time windows: bin(TimeGenerated, Xm), ago(Xd)
• Embedded docs: // DESCRIPTION:, // INVESTIGATION STEPS:, // FALSE POSITIVE:

Step 4: Infer Missing Sections

Apply inference rules from references/REFERENCE.md:

• Problem Statement <- tactic
• Kill Chain Phase <- tactic
• Compliance Frameworks <- technique

Step 5: Generate Documentation

Copy references/TEMPLATE.md and fill placeholders.

Quick Mode: Fill what you can, mark gaps with [HUMAN INPUT REQUIRED]

Guided Mode: Ask for each gap:

• "What security problem does this detection address?"
• "Who owns this detection?"
• "How should SOC be notified?"
• "What investigation steps should analysts follow?"

Step 6: Write Output

Save to {original_filename}_UseCase.md in the same directory.

Reference Files

MCP Enhancement (Optional)

If available, use these MCP servers to enrich documentation:

• mitreattack - Official MITRE technique descriptions
• MS-Sentinel-MCP-Server - Validate table schemas and KQL
• detection-nexus - Find related detections

See references/MCP_INTEGRATION.md for details.