Azure / Azure/azure-powershell
Az.SecurityInsights create Cmdlets for Watchlist management
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
## Description of the new feature
Managing Azure Sentinel from Powershell implies possibility to operate on all items provided by solution.
A key element is watchlist; what can be managed [directly _via_ REST API](https://docs.microsoft.com/en-us/azure/sentinel/watchlist-with-rest-api) already.
New Cmdlets could wrap all API endpoints for watchlists.
## Proposed implementation details (optional)
**`New-AzSentinelWatchlist`** to create watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `rawCSVContent`, `content`
- output : `Boolean` (action succeeded)
**`Get-AzSentinelWatchlist`** to fetch watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`
- output : `Microsoft.Azure.Commands.SecurityInsights.Models.Watchlist.PSSentinelWatchlist`
**`Remove-AzSentinelWatchlist`** to remove watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`
- output : `Boolean` (action succeeded)
**`Update-AzSentinelWatchlist`** to update watchlist as a whole
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `content`
- output : `Boolean` (action succeeded)
**`Update-AzSentinelWatchlistItem`** to update watchlist item
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`, `value`
- output : `Boolean` (action succeeded)
**`Add-AzSentinelWatchlistItem`** to add watchlist item to existing Watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`, `value`
- output : `Boolean` (action succeeded)
**`Remove-AzSentinelWatchlistItem`** to remove watchlist item to existing Watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`
- output : `Boolean` (action succeeded)
Where:
- `content` as `PSSentinelWatchlist`, every other param as String.
Resources: https://docs.microsoft.com/en-us/answers/questions/518881/is-it-possible-to-manipulate-azure-sentinel-watchl.html
I cen help to contribute... Even though I'm newbie to azure-powershell.
Contributor guide
Research direction
Start by reviewing the linked Azure Sentinel watchlist REST API and the existing Az.SecurityInsights module entry points. Compare the proposed New, Get, Remove, Update, Add, and item-management cmdlets with the API endpoints, parameter types, and requested outputs; done means the watchlist operations are implemented and covered by the module's tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, powershell
- Domain
- cli, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100