Azure / Azure/azure-powershell

SecurityInsights 3.0.1 New-AzSentinelAlertRule requires DisplayName within internal/back-end, but cannot supply in module

Open
#21,417 6 comments 0 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad bug customer-reported SecurityInsights Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Running the New-AzSentinelAlertRule with the documented parameterset for MicrosoftSecurityIncidentCreation kind rules, results in a missing parameter error due to the required "DisplayName" parameter being limited to only NRT or Scheduled rules through ParameterSets.

Example code to enable Azure AD Identity Protection incident creation rule:

```
New-AzSentinelAlertRule -ResourceGroupName:"resourcegroup" -WorkspaceName:"workspace" `
-Kind:"MicrosoftSecurityIncidentCreation" -Enabled `
-AlertRuleTemplateName:"532c1811-79ee-4d9f-8d4d-6304c840daa1" `
-ProductFilter:"Azure Active Directory Identity Protection"
```

**Expected Result:** "Create incidents based on Azure Active Directory Identity Protection alerts" rule is created

**Actual Result:** Rule not created & errors shown.

**Additional commentary:**

There appears to be several other issues with the MicrosoftSecurityIncidentCreation kind within this module too ($AlertRule.Enabled has the ability to be set to non-switch parameters multiple times - looks like a copy/paste error), which may need reviewing.

A fork of New-AzSentinelAlertRule with DisplayName introduced into the parameterset and associated code to handle within the MSIC codeblock resolves this issue.

### Issue script & Debug output

```PowerShell
DEBUG: 15:26:18 - GetAzureRMContextCommand end processing.
DEBUG: [CmdletBeginProcessing]: Starting command
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: /subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.OperationalInsights/workspaces/[redacted]/providers/Microsoft.
SecurityInsights/alertRules/f556c70e-fcf3-4ca7-81ba-b5debc56e58b?api-version=2021-09-01-preview
DEBUG: RequestCreated: /subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.OperationalInsights/workspaces/[redacted]/providers/Micros
oft.SecurityInsights/alertRules/f556c70e-fcf3-4ca7-81ba-b5debc56e58b?api-version=2021-09-01-preview
DEBUG: HeaderParametersAdded:
DEBUG: BodyContentSet:
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.OperationalInsights/workspaces/[redacted]/providers/M
icrosoft.SecurityInsights/alertRules/f556c70e-fcf3-4ca7-81ba-b5debc56e58b?api-version=2021-09-01-preview

Headers:
x-ms-unique-id : 293,294
x-ms-client-request-id : 5cefdb08-a117-4e20-9aab-98099f50cfb1
CommandName : Az.SecurityInsights.internal\New-AzSentinelAlertRule
FullCommandName : New-AzSentinelAlertRule_Create
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v0.0.0,PSVersion/v5.1.22621.963,Az.SecurityInsights/3.0.0

Body:
{
"kind": "MicrosoftSecurityIncidentCreation",
"properties": {
"productFilter": "Azure Active Directory Identity Protection",
"alertRuleTemplateName": "532c1811-79ee-4d9f-8d4d-6304c840daa1",
"enabled": true
}
}

DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Pragma : no-cache
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-request-id : 3cd4dd4b-c65d-4ea7-a69c-7b6a375c37f5
x-ms-correlation-request-id : 3cd4dd4b-c65d-4ea7-a69c-7b6a375c37f5
x-ms-routing-request-id : UKSOUTH:20230403T142620Z:3cd4dd4b-c65d-4ea7-a69c-7b6a375c37f5
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
Cache-Control : no-cache
Date : Mon, 03 Apr 2023 14:26:20 GMT
Server : Kestrel

Body:
{
"error": {
"code": "BadRequest",
"message": "Required property 'displayName' not found in JSON. Path 'properties', line 3, position 17."
}
}

DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:
Az.SecurityInsights.internal\New-AzSentinelAlertRule : Required property 'displayName' not found in JSON. Path 'properties', line 3, position 17.
At C:\[redacted]\WindowsPowerShell\Modules\Az.SecurityInsights\3.0.1\custom\New-AzSentinelAlertRule.ps1:676 char:13
+ Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSB ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ SubscriptionI...tionAlertRule }:<>f__AnonymousType30`5) [New-AzSentinelAlertRule_Create], Exception
+ FullyQualifiedErrorId : BadRequest,Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Cmdlets.NewAzSentinelAlertRule_Create
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.SecurityInsights:3.0.1; CommandName: New-AzSentinelAlertRule; PSVersion: 5.1.22621.963; IsSuccess: False; Duration: 00:00:00.3842665; Exception: InternalExceptio
n;
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.22621.963
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22621.963
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 2.10.3 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script 5.2.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}
Script 3.0.1 Az.SecurityInsights {Get-AzSentinelAlertRule, Get-AzSentinelAlertRuleAction, Get-AzSentinelAlertRuleTemplate, Get-AzSentinelAutomationRule...}
```

### Error output

```PowerShell
Message : [BadRequest] : Required property 'displayName' not found in JSON. Path 'properties', line 3, position 17.
StackTrace :
Exception : System.Exception
InvocationInfo : {New-AzSentinelAlertRule_Create}
Line : Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSBoundParameters

Position : At C:\[redacted]\WindowsPowerShell\Modules\Az.SecurityInsights\3.0.1\custom\New-AzSentinelAlertRule.ps1:676 char:13
+ Az.SecurityInsights.internal\New-AzSentinelAlertRule @PSB ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 44
```

Contributor guide

Open the contributing guide

Research direction

Inspect New-AzSentinelAlertRule.ps1 around line 676 and the parameter-set definitions for MicrosoftSecurityIncidentCreation. Reproduce the supplied command, trace how its properties are built, and confirm the completed command includes displayName and successfully creates the rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
api, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.