16
16
. SYNOPSIS
17
17
List Actions by Alert Rule
18
18
#>
19
- function Get-AzSentineAlertRulelAction -ListByAlertRule
19
+ function Get-AzSentinelAlertRuleAction -ListByAlertRule
20
20
{
21
21
22
22
$LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
23
+ $TriggerUri = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
23
24
$LogicAppResourceId2 = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
25
+ $TriggerUri2 = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Get-MDATPInvestigationPackage" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
24
26
25
27
# Create Alert Rule
26
- $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuprressionDuration " PT5H " - SuprressionEnabled $false
28
+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan - Hours 5 ) - SuppressionEnabled $false - Severity Low - Query " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan - Hours 5 ) - QueryPeriod ( New-TimeSpan - Hours 5 ) - TriggerThreshold 10
27
29
# Create Alert Rule Action
28
- $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId
30
+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri ( $TriggerUri .value )
29
31
# Create Alert Rule Action
30
- $action2 = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId2
32
+ $action2 = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId2 - TriggerUri ( $TriggerUri2 .value )
31
33
32
34
# Get Alert Rule Actions
33
35
$actions = Get-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
@@ -46,11 +48,12 @@ function Get-AzSentinelAlertRuleAction-GetAction
46
48
{
47
49
48
50
$LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
51
+ $TriggerUri = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
49
52
50
53
# Create Alert Rule
51
- $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuprressionDuration " PT5H " - SuprressionEnabled $false
54
+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan - Hours 5 ) - SuppressionEnabled $false - Severity Low - Query " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan - Hours 5 ) - QueryPeriod ( New-TimeSpan - Hours 5 ) - TriggerThreshold 10
52
55
# Create Alert Rule Action
53
- $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId
56
+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri ( $TriggerUri .value )
54
57
55
58
# Get Alert Rule Action
56
59
$action = Get-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId ($action.Name )
@@ -68,11 +71,12 @@ Create Action
68
71
function New-AzSentinelAlertRuleAction-Create
69
72
{
70
73
$LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
74
+ $TriggerUri = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
71
75
72
76
# Create Alert Rule
73
- $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuprressionDuration " PT5H " - SuprressionEnabled $false
77
+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan - Hours 5 ) - SuppressionEnabled $false - Severity Low - Query " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan - Hours 5 ) - QueryPeriod ( New-TimeSpan - Hours 5 ) - TriggerThreshold 10
74
78
# Create Alert Rule Action
75
- $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId
79
+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri ( $TriggerUri .value )
76
80
77
81
# Validate
78
82
Validate- Action $action
@@ -88,15 +92,17 @@ Update Action
88
92
function Set-AzSentinelAlertRuleAction-Update
89
93
{
90
94
$LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
95
+ $TriggerUri = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
91
96
$LogicAppResourceId2 = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
97
+ $TriggerUri2 = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Get-MDATPInvestigationPackage" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
92
98
93
99
# Create Alert Rule
94
- $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuprressionDuration " PT5H " - SuprressionEnabled $false
100
+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan - Hours 5 ) - SuppressionEnabled $false - Severity Low - Query " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan - Hours 5 ) - QueryPeriod ( New-TimeSpan - Hours 5 ) - TriggerThreshold 10
95
101
# Create Alert Rule Action
96
- $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId
102
+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri ( $TriggerUri .value )
97
103
98
104
# update action
99
- $action = Set= AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId2
105
+ $action = Set= AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name ) - LogicAppResourceId $LogicAppResourceId2 - TriggerUri ( $TriggerUri2 .value )
100
106
101
107
# Validate
102
108
Validate- Action $action
@@ -112,11 +118,13 @@ Delete Action
112
118
function Remove-AzSentinelAlertRuleAction-Delete
113
119
{
114
120
$LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
121
+ $TriggerUri = Get-AzLogicAppTriggerCallbackUrl - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered"
115
122
116
123
# Create Alert Rule
117
- $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuprressionDuration " PT5H " - SuprressionEnabled $false
124
+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind Scheduled - Enabled $true - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan - Hours 5 ) - SuppressionEnabled $false - Severity Low - Query " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan - Hours 5 ) - QueryPeriod ( New-TimeSpan - Hours 5 ) - TriggerThreshold 10
118
125
# Create Alert Rule Action
119
- $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId
126
+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri ($TriggerUri.value )
127
+ # delete
120
128
Remove-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - ActionId ($action.Name )
121
129
# Validate
122
130
Validate- Action $action
0 commit comments