Question

Your SOC recently onboarded a new Palo Alto Networks firewall and wants to deploy vendor-provided analytics rules, workbooks, hunting queries, and a data connector together as a maintained package that receives updates. A junior analyst suggests manually copying individual KQL rules from a GitHub repository into the workspace. As the security operations analyst, what is the most efficient supported approach to deploy and keep this content current in Microsoft Sentinel?

Accepted Answer

Install the Palo Alto Networks solution from the Microsoft Sentinel Content hub, which packages the connector, analytics rules, workbooks, and hunting queries with update support

Answer

Manually import each KQL query as a scheduled analytics rule and paste workbook JSON from the community GitHub repository

Answer

Create a custom data connector using the Codeless Connector Platform and author all analytics rules from scratch

Answer

Use Workspace manager to push the Palo Alto content from a central workspace before any content exists to distribute