Azure / Azure/azure-powershell
[Feature]: Ability to set multiple EntityMappings and Tactics with Update-AzSentinelAlertRule and New-AzSentinelAlertRule
Open
act-codegen-extensibility-squad
customer-reported
feature-request
SecurityInsights
Service Attention
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description of the new feature
It should be possible to use _EntityMapping[]_ and _AttackTactic[]_ as inputs to the _-EntityMapping_ and _-Tactic_ parameters in the **Update-AzSentinelAlertRule** and **New-AzSentinelAlertRule** cmdlets.
### Proposed implementation details (optional)
_No response_
Contributor guide
Research direction
Start by locating the Update-AzSentinelAlertRule and New-AzSentinelAlertRule cmdlet entry points and inspect how their -EntityMapping and -Tactic parameters are typed and passed through. Confirm the existing alert-rule tests or cmdlet validation, then verify that arrays of EntityMapping and AttackTactic values are accepted by both cmdlets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100