Sentinel Analytics Rule Linter
Paste an exported Sentinel analytics rule and get the gaps flagged: a lookback shorter than the run interval, missing entity mappings, no MITRE tactics, alert storms.
✓ runs 100% in your browser — no data leaves this page
Export from the Analytics page (select the rule → Export) to get the ARM template, or
GET /providers/Microsoft.SecurityInsights/alertRules/{ruleId}?api-version=2024-09-01.
Rule JSON contains no secrets, and it never leaves your browser regardless.
Frequently asked
Where do I get the rule JSON?
On the Analytics page, select the rule and choose Export — that produces the ARM template. Or call the REST API: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{ws}/providers/Microsoft.SecurityInsights/alertRules?api-version=2024-09-01. Both paste in as-is.
Can I paste the YAML from the Sentinel GitHub repo?
Not directly — this tool reads JSON. Import the YAML into Sentinel and export it as ARM, or convert it yourself. The detection logic is the same either way.
Why does a lookback equal to the interval get flagged?
Because ingestion isn't instant. A rule that runs hourly and looks back exactly one hour never sees a record whose TimeGenerated falls in the window but which arrived in the workspace after the run. Overlapping the windows costs nothing except duplicate matches, which alert grouping absorbs.
Is the rule JSON sensitive?
It contains your detection logic and table names, not credentials. It's analyzed entirely in your browser regardless.