1+ # ----------------------------------------------------------------------------------
2+ #
3+ # Copyright Microsoft Corporation
4+ # Licensed under the Apache License, Version 2.0 (the "License");
5+ # you may not use this file except in compliance with the License.
6+ # You may obtain a copy of the License at
7+ # http://www.apache.org/licenses/LICENSE-2.0
8+ # Unless required by applicable law or agreed to in writing, software
9+ # distributed under the License is distributed on an "AS IS" BASIS,
10+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+ # See the License for the specific language governing permissions and
12+ # limitations under the License.
13+ # ----------------------------------------------------------------------------------
14+
15+ <#
16+ . SYNOPSIS
17+ List Actions by Alert Rule
18+ #>
19+ function Get-AzSentinelAlertRuleAction-ListByAlertRule
20+ {
21+ $AlertRuleId = " 1b64dc0e-4bf6-43c4-a503-52cba30b5c47"
22+ $ActionId = " cd9f21e2-1718-4b8b-871e-b8d59c65f317"
23+ $ActionId2 = " ccef9243-4f96-4ec5-8042-9df44e2df452"
24+ $LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
25+ $TriggerUri = " https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
26+ $LogicAppResourceId2 = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
27+ $TriggerUri2 = " https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo"
28+
29+ # Create Alert Rule
30+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId $AlertRuleId - Scheduled - Enabled - DisplayName " PoshModuleTest" - Severity Low - Query " SecurityAlert | take 1" - QueryFrequency (New-TimeSpan - Hours 5 ) - QueryPeriod (New-TimeSpan - Hours 5 ) - TriggerThreshold 10
31+ # Create Alert Rule Action
32+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - ActionId $ActionId - AlertRuleId ($alertRule.Name ) - LogicAppResourceId $LogicAppResourceId - TriggerUri $TriggerUri
33+ # Create Alert Rule Action
34+ $action2 = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - ActionId $ActionId2 - AlertRuleId ($alertRule.Name ) - LogicAppResourceId $LogicAppResourceId2 - TriggerUri $TriggerUri2
35+
36+ # Get Alert Rule Actions
37+ $actions = Get-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
38+ # Validate
39+ Validate- Actions $actions
40+
41+ # Cleanup
42+ Remove-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
43+ }
44+
45+ <#
46+ . SYNOPSIS
47+ Get Action
48+ #>
49+ function Get-AzSentinelAlertRuleAction-GetAction
50+ {
51+ $AlertRuleId = " 77def5f7-ab37-4aaf-8711-904d1ab55787"
52+ $ActionId = " 27dda575-93f0-4925-92b3-039ef4d89cad"
53+ $LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
54+ $TriggerUri = " https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
55+
56+ # Create Alert Rule
57+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId $AlertRuleId - Scheduled - Enabled - DisplayName " PoshModuleTest" - Severity Low - Query " SecurityAlert | take 1" - QueryFrequency (New-TimeSpan - Hours 5 ) - QueryPeriod (New-TimeSpan - Hours 5 ) - TriggerThreshold 10
58+ # Create Alert Rule Action
59+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId $ActionId - LogicAppResourceId $LogicAppResourceId - TriggerUri $TriggerUri
60+
61+ # Get Alert Rule Action
62+ $action = Get-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId ($action.Name )
63+ # Validate
64+ Validate- Action $action
65+
66+ # Cleanup
67+ Remove-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
68+ }
69+
70+ <#
71+ . SYNOPSIS
72+ Create Action
73+ #>
74+ function New-AzSentinelAlertRuleAction-Create
75+ {
76+ $AlertRuleId = " 26501c9d-8f07-419d-8bcb-f9aac8ec1a7f"
77+ $ActionId = " 10d54e5f-8c03-42fc-b1d9-1bd881535af0"
78+ $LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
79+ $TriggerUri = " https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
80+
81+ # Create Alert Rule
82+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId $AlertRuleId - Scheduled - Enabled - DisplayName " PoshModuleTest" - Severity Low - Query " SecurityAlert | take 1" - QueryFrequency (New-TimeSpan - Hours 5 ) - QueryPeriod (New-TimeSpan - Hours 5 ) - TriggerThreshold 10
83+ # Create Alert Rule Action
84+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId $ActionId - LogicAppResourceId $LogicAppResourceId - TriggerUri $TriggerUri
85+
86+ # Validate
87+ Validate- Action $action
88+
89+ # Cleanup
90+ Remove-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
91+ }
92+
93+ <#
94+ . SYNOPSIS
95+ Update Action
96+ #>
97+ function Update-AzSentinelAlertRuleAction-Update
98+ {
99+ $AlertRuleId = " 1584e7a3-802c-435b-9178-5720a44be2f3"
100+ $ActionId = " 91c2ea2f-f40c-4bef-ab3b-43c09e4a9699"
101+ $LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
102+ $TriggerUri = " https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
103+ $LogicAppResourceId2 = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
104+ $TriggerUri2 = " https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo"
105+
106+ # Create Alert Rule
107+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId $AlertRuleId - Scheduled - Enabled - DisplayName " PoshModuleTest" - Severity Low - Query " SecurityAlert | take 1" - QueryFrequency (New-TimeSpan - Hours 5 ) - QueryPeriod (New-TimeSpan - Hours 5 ) - TriggerThreshold 10
108+ # Create Alert Rule Action
109+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId $ActionId - LogicAppResourceId $LogicAppResourceId - TriggerUri $TriggerUri
110+
111+ # update action
112+ $action = Update-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId ($action.Name ) - LogicAppResourceId $LogicAppResourceId2 - TriggerUri $TriggerUri2
113+
114+ # Validate
115+ Validate- Action $action
116+
117+ # Cleanup
118+ Remove-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
119+ }
120+
121+ <#
122+ . SYNOPSIS
123+ Delete Action
124+ #>
125+ function Remove-AzSentinelAlertRuleAction-Delete
126+ {
127+ $AlertRuleId = " d1ae0250-f1d8-4cd2-9806-e2375dd7c4ae"
128+ $ActionId = " 4044b6d3-de80-4c37-81f2-46d96dfdd78b"
129+ $LogicAppResourceId = " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
130+ $TriggerUri = " https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
131+
132+ # Create Alert Rule
133+ $alertRule = New-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId $AlertRuleId - Scheduled - Enabled - DisplayName " PoshModuleTest" - Severity Low - Query " SecurityAlert | take 1" - QueryFrequency (New-TimeSpan - Hours 5 ) - QueryPeriod (New-TimeSpan - Hours 5 ) - TriggerThreshold 10
134+ # Create Alert Rule Action
135+ $action = New-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name ) - ActionId $ActionId - LogicAppResourceId $LogicAppResourceId - TriggerUri $TriggerUri
136+ # delete
137+ Remove-AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - ActionId ($action.Name ) - AlertRuleId ($alertRule.Name )
138+ # Validate
139+ Validate- Action $action
140+
141+ # Cleanup
142+ Remove-AzSentinelAlertRule - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name )
143+ }
144+
145+ <#
146+ . SYNOPSIS
147+ Validates a list of actions
148+ #>
149+ function Validate-Actions
150+ {
151+ param ($actions )
152+
153+ Assert-True { $actions.Count -gt 0 }
154+
155+ Foreach ($action in $actions )
156+ {
157+ Validate- Action $action
158+ }
159+ }
160+
161+ <#
162+ . SYNOPSIS
163+ Validates a single action
164+ #>
165+ function Validate-Action
166+ {
167+ param ($action )
168+
169+ Assert-NotNull $action
170+ }
0 commit comments