Microsoft Sentinel's Out-of-the-Box Content Centralisation is Coming Soon!

🚨Hot Off the Press 🚨

🔥Microsoft Sentinel's Out-of-the-Box Content Centralisation is Coming Soon! 🔥

We are delighted to announce that all Microsoft Sentinel out-of-the-box (OOTB) content and solutions will soon be available in the content hub, allowing customers to easily discover and manage packaged solutions for end-to-end SOC use cases based on products, domains, or industry.

Changes are planned for Q2 FY23 to complete the OOTB content centralisation, with the goal of enabling a consistent and scenario-driven approach to onboarding OOTB content as needed.

In the Microsoft Sentinel content hub, users can now discover and install out-of-the-box (OOTB) content and solutions with ease, all in one simple step. Previously, some of this OOTB content was scattered across various gallery sections of Microsoft Sentinel. Now, all the content templates from the gallery, including data connectors, analytics rule templates, hunting queries, playbook templates, and workbook templates, are available as standalone items or as part of packaged solutions in the content hub.

📝What is changing in Microsoft Sentinel?

✔️Starting Q2 2023 the gallery only content templates will be retired.

✔️The legacy gallery content templates will no longer be updated, and all OOTB content will be up to date on content hub.

✔️To facilitate this transition, we will publish a central tool to reinstate IN USE retired templates from corresponding content hub solutions.

📝What action should I take now?

✔️Install new OOTB content from the content hub and update solutions as needed to have the latest versions of templates.

✔️For existing gallery content templates in use, get future updates by installing the solutions or standalone content items from the content hub. The gallery content in the feature galleries might be out of date.

✔️If you have applications or processes that directly get OOTB content from the Microsoft Sentinel GitHub repository, update the locations to include getting OOTB content from the Solutions folder in addition to existing content folders.

✔️Plan with your organization who will run the tool, and when, after you see the warning banner and the change goes live in Q2 2023.

✔️The tool needs to run once in a workspace to reinstate all IN USE retired templates from the content hub.

Links:

[Coming soon] Microsoft Sentinel out-of-the-box content centralization! - Microsoft Community Hub

Out-of-the-box (OOTB) content centralization changes - Microsoft Sentinel | Microsoft Learn