Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Import-AzSentinelAlertRule with invalid rule does not cause exception #196

Open
hpemart opened this issue Aug 2, 2022 · 0 comments
Open

Comments

@hpemart
Copy link

hpemart commented Aug 2, 2022

Environment

Windows build number: Microsoft Windows [Version 10.0.22000.795]
PowerShell version 7,2,5

Steps to reproduce

  • Enable Sentinel in a subscription
  • Take AZSentinel/examples/AlertRules.json] and attempt to import it

Import-AzSentinelAlertRule -SettingsFile .\alertrules.json -WorkspaceName "foo"

`WARNING: Unable to find LogicApp playbook01 under Subscription Id: (redacted)

Import-AzSentinelAlertRule: Unable to invoke webrequest for rule AlertRule01 with error message: Unable to create Action for Rule: with Playbook playbook01 Error: Response status code does not indicate success: 400 (Bad Request).

WARNING: "AlertRule02" configuration is not following the official API schema, consider updating the incident and grouping configuration.

Import-AzSentinelAlertRule: Unable to invoke webrequest for rule AlertRule02 with error message: Response status code does not indicate success: 400 (Bad Request).

WARNING: "AlertRule03" configuration is not following the official API schema, consider updating the incident and grouping configuration.`

Expected behavior

Exception thrown at the first invalid rule

Actual behavior

  • Rules import continues regardless

image

  • Rules actually appear in console, despite errors shown on output

I'm unsure if we have nothing actually wrong with the rule definitions in this repos' sample file, and a bug in the import commandlet here, and/or an issue with raising exceptions.

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant