Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Import-AzSentinelDataConnector doesn't configure AzureSecurityCenter Data Connector #175

Open
rwaal opened this issue Mar 3, 2021 · 0 comments
Labels
bug Something isn't working

Comments

@rwaal
Copy link

rwaal commented Mar 3, 2021

Environment

Mac OS Big Sur 11.2.2.
PowerShell version: 7.1.2
Module version: 0.6.21

Steps to reproduce

I am trying to configure the Azure Defender data connector inside Sentinel. As far as I know, you need to refer to this data connector as AzureSecurityCenter when configuring it programmatically.

I am using the following command:

Import-AzSentinelDataConnector -SubscriptionId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -WorkspaceName myworkspacename -SettingsFile ./settings.json

Expected behavior

I expect the Azure Defender enabled subscription to be connected within the data connector. Like can be seen in the image below.

image

Actual behavior

The command executes without any output. No success or error message, nothing seems to happen. When looking in the Azure portal, no changes have been applied.

I have been successful using the Sentinel REST API directly. That works just fine.

The docs of the AZSentinel module doesn't describe what should be in the settings file. So I am guessing that the contents should be the same as the JSON payload that's used by the Sentinel REST API. For reference, below is the contents of the settings.json file that I used in the command.

{
    "kind": "AzureSecurityCenter",
    "properties": {
        "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "dataTypes": {
            "alerts": {
                "state": "enabled"
            }
        }
    },
    "id": null
}
@pkhabazi pkhabazi added the bug Something isn't working label Aug 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants