In some environments there may be many routing rules configured in Sentinel to do things like forward events via Sentinel link, tag events, or forward to another syslog host. If you have multiple Sentinel servers in the enterprise, you may need to set up the same rules on each server...a manual process is tedious and error prone. It would be nice if there was a way to export\import selected routing rules in the webUI or in the solution designer.
by: Eric L. | over a year ago | Configuration
Comments
The REST API allows you to automate such settings in an enterprise with multiple servers: https://sentinel:8443/SentinelRESTServices/apidoc/en/api-ref/Events/event-routing-rule-list.html
Eric, is what Norbert is referring to adequate for automating these tasks?
Solution Designer would be preferred for me as well. On tool to copy all custom content out of SIEM. I have a client that has a master SIEM that needs to replicate content to other SIEM's easily.