Copy a Microsoft Azure Sentinel profile

Copy an existing profile and its associated settings instead of creating a profile. When you create multiple profiles, you can reuse the settings of an existing profile by copying these profiles.

Before you begin

Role required: sn_si.ingestion_profile_admin

Note:

Users with the sn_si.admin role can perform all operations available to a profile admin, as the sn_si.admin role inherits the required permissions by default.

About this task

When you copy a profile, the profile name is initially modified to avoid creating duplicate profiles. The copied profile is also turned off (set to false) to ensure that you don't accidentally activate it before you complete the configuration. You can copy the profiles and use existing maps for security incidents that you have already previewed and verified.

Procedure

1. Navigate to All > Microsoft Azure Sentinel Integration > Azure Sentinel Profile.
2. In the Azure Sentinel Profiles list, select a profile that you want to copy, and then from the Actions on selected rows list, click Copy as shown in the following example.

   Figure 1. Copying a profile

   

   The profile is copied and displayed on the list as shown in the following example. The copy has all the settings of the original profile including the mapping and scheduling configuration. The name of the profile contains the word "copy." Although the original profile is enabled (true), the copy is turned off at this point (false). You may prefer to edit values of the copied profile and rename them so that the configuration settings apply to the new profile as required.

   Figure 2. Viewing the copied incident profiles

   

   You have successfully copied the settings from an existing profile to a new profile. The Active column status is set to false, which means that the profile must be activated.