1616. SYNOPSIS 
1717List Actions by Alert Rule 
1818#> 
19- function  Get-AzSentinelAlertRuleAction -ListByAlertRule 
19+ function  Get-AzSentineAlertRulelAction -ListByAlertRule 
2020{
2121
2222	$LogicAppResourceId  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" 
23- 	$TriggerUri  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
2423	$LogicAppResourceId2  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage" 
25- 	$TriggerUri2  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Get-MDATPInvestigationPackage" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
2624
2725	# Create Alert Rule
28- 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan   - Hours  5 )  - SuppressionEnabled  $false   - Severity Low  - Query  " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan   - Hours  5 )  - QueryPeriod ( New-TimeSpan   - Hours  5 )  - TriggerThreshold  10 
26+ 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuprressionDuration  " PT5H " - SuprressionEnabled  $false 
2927	# Create Alert Rule Action
30- 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId   - TriggerUri ( $TriggerUri .value ) 
28+ 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId 
3129	# Create Alert Rule Action
32- 	$action2  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId2   - TriggerUri ( $TriggerUri2 .value ) 
30+ 	$action2  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId2 
3331
3432	# Get Alert Rule Actions
3533    $actions  =  Get-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name  )
@@ -48,12 +46,11 @@ function Get-AzSentinelAlertRuleAction-GetAction
4846{
4947
5048	$LogicAppResourceId  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" 
51- 	$TriggerUri  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
5249
5350	# Create Alert Rule
54- 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan   - Hours  5 )  - SuppressionEnabled  $false   - Severity Low  - Query  " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan   - Hours  5 )  - QueryPeriod ( New-TimeSpan   - Hours  5 )  - TriggerThreshold  10 
51+ 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuprressionDuration  " PT5H " - SuprressionEnabled  $false 
5552	# Create Alert Rule Action
56- 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId   - TriggerUri ( $TriggerUri .value ) 
53+ 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId 
5754
5855	# Get Alert Rule Action
5956    $action  =  Get-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name  ) - ActionId ($action.Name  )
@@ -71,12 +68,11 @@ Create Action
7168function  New-AzSentinelAlertRuleAction-Create 
7269{
7370    $LogicAppResourceId  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" 
74- 	$TriggerUri  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
7571
7672	# Create Alert Rule
77- 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan   - Hours  5 )  - SuppressionEnabled  $false   - Severity Low  - Query  " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan   - Hours  5 )  - QueryPeriod ( New-TimeSpan   - Hours  5 )  - TriggerThreshold  10 
73+ 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuprressionDuration  " PT5H " - SuprressionEnabled  $false 
7874	# Create Alert Rule Action
79- 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId   - TriggerUri ( $TriggerUri .value ) 
75+ 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId 
8076
8177	# Validate
8278	Validate- Action $action 
@@ -92,17 +88,15 @@ Update Action
9288function  Set-AzSentinelAlertRuleAction-Update 
9389{
9490	$LogicAppResourceId  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" 
95- 	$TriggerUri  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
9691	$LogicAppResourceId2  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage" 
97- 	$TriggerUri2  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Get-MDATPInvestigationPackage" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
9892
9993	# Create Alert Rule
100- 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan   - Hours  5 )  - SuppressionEnabled  $false   - Severity Low  - Query  " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan   - Hours  5 )  - QueryPeriod ( New-TimeSpan   - Hours  5 )  - TriggerThreshold  10 
94+ 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuprressionDuration  " PT5H " - SuprressionEnabled  $false 
10195	# Create Alert Rule Action
102- 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId   - TriggerUri ( $TriggerUri .value ) 
96+ 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId 
10397
10498	# update action
105- 	$action  =  Set= AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ( $alertRule .Name )  - LogicAppResourceId $LogicAppResourceId2   - TriggerUri ( $TriggerUri2 .value ) 
99+ 	$action  =  Set= AzSentinelAlertRuleAction - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId2 
106100
107101	#  Validate
108102	Validate- Action $action 
@@ -118,13 +112,11 @@ Delete Action
118112function  Remove-AzSentinelAlertRuleAction-Delete 
119113{
120114	$LogicAppResourceId  =  " /subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" 
121- 	$TriggerUri  =  Get-AzLogicAppTriggerCallbackUrl  - ResourceGroupName (Get-TestResourceGroupName ) - Name " Block-AADUser" - TriggerName " When_a_response_to_an_Azure_Sentinel_alert_is_triggered" 
122115
123116	# Create Alert Rule
124- 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Kind  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuppressionDuration ( New-TimeSpan   - Hours  5 )  - SuppressionEnabled  $false   - Severity Low  - Query  " SecurityAlert | take 1 " - QueryFrequency ( New-TimeSpan   - Hours  5 )  - QueryPeriod ( New-TimeSpan   - Hours  5 )  - TriggerThreshold  10 
117+ 	$alertRule  =  New-AzSentinelAlertRule  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - Type  Scheduled - Enabled $true  - DisplayName " PoshModuleTest" - SuprressionDuration  " PT5H " - SuprressionEnabled  $false 
125118	# Create Alert Rule Action
126- 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - AlertRuleId ($alertRule.Name  ) - LogicAppResourceId $LogicAppResourceId  - TriggerUri ($TriggerUri.value  )
127- 	# delete
119+ 	$action  =  New-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - LogicAppResourceId $LogicAppResourceId 
128120	Remove-AzSentinelAlertRuleAction  - ResourceGroupName (Get-TestResourceGroupName ) - WorkspaceName (Get-TestWorkspaceName ) - ActionId ($action.Name  )
129121	#  Validate
130122	Validate- Action $action 
0 commit comments