AzSentinel – Version 0.6.6

Version 0.6.6 is available in PowerShell Gallery with bunch of bugfixes and new features.

Support for multiple rules

From this version you can manage all type of Analytics rules from one template. The import and New-AzsentinelAlertRule functions are also optimized to import new rules much faster.

The layout of JSON file is updated to add support for the following Analytics rules:

  • Scheduled
  • Fusion
  • MLBehaviorAnalytics
  • MicrosoftSecurityIncidentCreation

JSON schema:

As you can see you can define all the rule types in the same template file. For each rule type you can find the properties on the following link. Below an example of a setting file containing all types of Analytic rules

You can also use the New-AzSentinelAlertrule function to create this kind of rules. You have now the switch “-Kind” that you can use to create other type of analytic rules.The default value is Scheduled rule. Below some examples:

Add-AzSentinelIncidentComment

New function to add comment to Azure Sentinel incidnent

Get-AzSentinelAlertRuleTemplates

Thanks to ramirezversion, This function return all the the Analytics rule templates

List of other fixes:

Issue/PR IDFix by
#91 Update-AzSentinelIncident deletes various incident properties #89
https://github.com/jholtmann
#87 Fixed an issue that caused enabled in alert groupingConfiguration to be set to true everytime due to an error in the codehttps://github.com/ThijsLecomte
#78 Handle nextLink for Playbookshttps://github.com/stehod

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.