SecOps - 41212 - Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarks

[aahmed-spec]

No description provided.

[Copilot]

Pull request overview

Adds a new SecOps assessment (41212) to evaluate whether Microsoft Sentinel hunting is operationalized by checking for the presence of saved hunting queries and/or bookmarks across Sentinel-onboarded Log Analytics workspaces, and generates a per-workspace markdown report for the assessment output.

Changes:

• Introduces Test-Assessment-41212 PowerShell test to query Sentinel workspaces, collect hunting query/bookmark counts, and produce a summarized markdown table.
• Adds the companion markdown documentation page for assessment 41212.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/powershell/tests/Test-Assessment.41212.ps1	New assessment test that queries Sentinel workspaces for saved hunting queries and bookmarks and renders a report.
src/powershell/tests/Test-Assessment.41212.md	New assessment documentation for the hunting operationalization check.

Suppressed comments (1)

src/powershell/tests/Test-Assessment.41212.ps1:239

• After introducing $portalHost for sovereign cloud support, the per-row links should also use it; otherwise the table still points to portal.azure.com in AzureUSGovernment.

        $subLink         = "https://portal.azure.com/#resource/subscriptions/$($result.SubscriptionId)"
        $sentinelId      = "/subscriptions/$($result.SubscriptionId)/resourcegroups/$($result.ResourceGroup)/providers/microsoft.securityinsightsarg/sentinel/$($result.WorkspaceName)"
        $huntingLink     = "https://portal.azure.com/#view/Microsoft_Azure_Security_Insights/MainMenuBlade/~/Hunting/id/$($sentinelId -replace '/', '%2F')"

[Aleksandar Nikolić (alexandair)]

aahmed-spec Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

LGTM