Azure / Azure/azure-cli-extensions

az sentinel alert-rule list command does not return the expected number of alert rules

Open
#4,199 4 comments 0 reactions 0 assignees View on GitHub
customer-reported sentinel Service Attention
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Describe the bug**
`az sentinel alert-rule list` command does not return the expected number of alert rules. From the portal, we see that we have 181 alert rules enabled, but the az command only returns 143. This is true when using the Azure REST API directly as well.

**To Reproduce**
- see the number of alert-rules enabled from Microsoft Sentinel in the Azure portal.
- request the number of alert rules via the azure cli or via the Azure REST API:
```ps1
$url = "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.OperationalInsights/workspaces//providers/Microsoft.SecurityInsights/alertRules?api-version=2020-01-01"
$method = "GET"
$token = Get-AzAccessToken -ResourceUrl "https://management.azure.com/"
$token = $token.Token
$headers = @{Authorization = "Bearer $token"}
$response = Invoke-RestMethod -Uri $url -Method $method -Headers $headers
$response.value.Count
```

**Expected behavior**
The number of alert-rules should be equal.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.