Question

Your SOC deployed the Microsoft Sentinel solution for 'Microsoft Entra ID' from Content Hub three months ago, which installed several analytics rule templates. Since then, Microsoft has published updated versions of those rule templates with improved query logic. Your team has been manually editing the deployed active rules to tune thresholds. You want to apply Microsoft's newest template improvements while keeping your workspace's customizations visible and controllable. What should you do?

Accepted Answer

In Content Hub, check for the solution update and review each analytics rule template that shows an available update, then create or update active rules from the new template versions and re-apply your tuning

Answer

Delete the existing solution and reinstall it from Content Hub so all rules are recreated with the latest logic

Answer

Manually copy the improved KQL from Microsoft's GitHub repository into each active rule, ignoring Content Hub versioning

Answer

Enable auto-update on the workspace so all active analytics rules created from templates automatically overwrite with the newest template logic