Why do Get-AzSentinelAlertRule/Incident Powershell CLI queries not always provide specified output detail?

Colin Sanders 0 Reputation points
2024-06-24T07:32:41.6366667+00:00

When running the following List-all-alert-rules query, Get-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName"

all specified field key:value pairs are returned for every rule, including the two desired fields Name:{e.g. fdc0dc4b-5f86-48f6-8773-3dce2998f9ab} and DisplayName:{e.g. Scheduled resource WRITE or DELETE}

But as soon as we attempt to search for a specific -RuleId all we get is three values returned, Etag: , Type: and Name: User's image

Similarly with Incident queries.

Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName"

or

Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -Id "f5409f55-7dd8-4c73-9981-4627520b2db"

Instead of the exampled fields being returned:

Title : (Preview) TI map IP entity to AzureActivity
Description : Identifies a match in AzureActivity from any IP IOC from TI
Severity : Medium
Number : 754
Label : {}
ProviderName : Azure Sentinel
Name : f5409f55-7dd8-4c73-9981-4627520b2db

... only two field values are returned, ETag: and Name:

User's image

Why does this happen and how can we get either all the details, or at-least values for the specific fields we want?

The Use Case

What we want/need is the DisplayName: or Title: values to be able to make sense of the events which report only by objectID's for Name:

e.g.
Description: (Message:) The action: Microsoft.SecurityInsights/alertrules/{write} ► was performed by: {AnAdminUserID@MyCompany.com} ► at Brisbane UTC: 2024-06-24T11:50:25.9062812Z ► from IP address: {192.168.132.123} ► for Resource: /subscriptions/{##a#####-#f#b-###d-####-#f##dea##d##}/resourcegroups/{ab-syd-prod-arg-cdef-###}/providers/microsoft.operationalinsights/workspaces/{ab-syd-prod-law-cdef-###}/providers/microsoft.securityinsights/alertrules/fdc0dc4b-5f86-48f6-8773-3dce2998f9ab

we'd like to return the friendly DisplayName: Scheduled resource WRITE or DELETE

Azure Automation
Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,172 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,264 questions
{count} votes