Azure / Azure/azure-powershell

Az.SecurityInsights create Cmdlets for Watchlist management

Open
#15,718 16 comments 2 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad customer-reported feature-request question SecurityInsights Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

## Description of the new feature

Managing Azure Sentinel from Powershell implies possibility to operate on all items provided by solution.
A key element is watchlist; what can be managed [directly _via_ REST API](https://docs.microsoft.com/en-us/azure/sentinel/watchlist-with-rest-api) already.

New Cmdlets could wrap all API endpoints for watchlists.

## Proposed implementation details (optional)

**`New-AzSentinelWatchlist`** to create watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `rawCSVContent`, `content`
- output : `Boolean` (action succeeded)

**`Get-AzSentinelWatchlist`** to fetch watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`
- output : `Microsoft.Azure.Commands.SecurityInsights.Models.Watchlist.PSSentinelWatchlist`

**`Remove-AzSentinelWatchlist`** to remove watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`
- output : `Boolean` (action succeeded)

**`Update-AzSentinelWatchlist`** to update watchlist as a whole
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `content`
- output : `Boolean` (action succeeded)

**`Update-AzSentinelWatchlistItem`** to update watchlist item
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`, `value`
- output : `Boolean` (action succeeded)

**`Add-AzSentinelWatchlistItem`** to add watchlist item to existing Watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`, `value`
- output : `Boolean` (action succeeded)

**`Remove-AzSentinelWatchlistItem`** to remove watchlist item to existing Watchlist
- param : `watchlistAlias`, `resourceGroup`, `subscriptionId`, `workspaceName`, `watchlistItemId`
- output : `Boolean` (action succeeded)

Where:
- `content` as `PSSentinelWatchlist`, every other param as String.

Resources: https://docs.microsoft.com/en-us/answers/questions/518881/is-it-possible-to-manipulate-azure-sentinel-watchl.html

I cen help to contribute... Even though I'm newbie to azure-powershell.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked Azure Sentinel watchlist REST API and the existing Az.SecurityInsights module entry points. Compare the proposed New, Get, Remove, Update, Add, and item-management cmdlets with the API endpoints, parameter types, and requested outputs; done means the watchlist operations are implemented and covered by the module's tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
cli, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.