[Important] The following Azure connectors will be deprecated on March 30th 2027

​@ylandovskyy  thank you for outlining the key details in this post.

As part of my Sentinel playbook, I use the Microsoft Sentinel marketplace integration action “Get Alert Rule Details” to get the KQL query used by the scheduled Sentinel detection. I use that query to run my own searches to display to the investigating analysts. Will this functionality in the Microsoft Sentinel integration still run after March 30th 2027? 

​@donkos I couldn’t find information about this endpoint being deprecated on the side of Azure Sentinel, but nowadays we support integration called “Azure Monitor”, which has an action called “Search Logs”. It allows you to query any log source available in the Azure stack.

So, if you want to be extra safe, then you can migrate to this Azure Monitor integration.

Also, depending on the use case, the Hunting Queries (action “Execute Custom Query”) that are a part of “M365 Defender” integration can be enough to cover your use case, so it’s also worth checking. 

In looking at the features/commands available, it seems like many that are under “Microsoft Defender For Endpoint” are missing from the Microsoft 365 Defender integration. 

Take for instance, the Isolate Machine command. 

Is the intent to move many of those missing commands over before the EOL date?

​@mcv The actions are not affected, only connectors are. The MDE actions are built around MDE API, which is different from Graph, so there is no rush to duplicate this content under M365 Defender integration.

There is no deprecation notice for actions, so you can continue using them.

​@ylandovskyy  

1 - I can see that Azure Monitor is about 8 months old - but there is no documentation for it in the https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/ - I’d need to reference documentation to know what app registrations/permissions are required.

2 - Before we are able to run any queries, currently I use the Microsoft Sentinel “Get Alert Rule Details” action on the ID in the ingested alert title to get back details about the rule such as the KQL query used in the rule itself. I then use that KQL query to run the log searches. Will the  Microsoft Sentinel “Get Alert Rule Details” action itself keep running after still run after March 30th 2027?

​@donkos 

1. Here is the documentation for it: https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-monitor

2. Right now, there is no information on the official Microsoft portal about deprecation of endpoint that is used by that action, but you shouldn’t even need to execute that action as the expectation is that the Alert / Event will contain the kql from the Alert inside of it. If you don’t see it, then let us know.