Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get-AzSentinelAlertRuleAction doesn't return playbookName in 0.6.6 #101

Closed
pemontto opened this issue Sep 24, 2020 · 2 comments · Fixed by #102 or #105
Closed

Get-AzSentinelAlertRuleAction doesn't return playbookName in 0.6.6 #101

pemontto opened this issue Sep 24, 2020 · 2 comments · Fixed by #102 or #105
Assignees
Labels
bug Something isn't working

Comments

@pemontto
Copy link
Contributor

Environment

PS /tmp> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.3
PSEdition                      Core
GitCommitId                    7.0.3
OS                             Darwin 18.7.0 Darwin Kernel Version 18.7.0: Tue Aug 20 16:57:14 PDT 2019; root:xnu-4903.271.2~2/RELEASE_X86_64
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Steps to reproduce

Try to fetch a rule or multiple rules with Get-AzSentinelAlertRule.

Expected behavior

Rules are fetched with playbook name/information

Actual behavior

The playbook name does not get retrieved and errors are encountered pulling down multiple rules at once.

# Grab the rule action specifically - OK
PS /tmp> Get-AzSentinelAlertRuleAction -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
id         : /subscriptions/<redacted>
name       : <redacted>
etag       : <redacted>
type       : Microsoft.SecurityInsights/alertRules/actions
properties : @{workflowId=<redacted>}

# Grab the rule specifically - no playbookName returned
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
lastModifiedUtc       : 17/9/2020 12:16:11 pm
name                  : <redacted>
etag                  : <redacted>
id                    : <redacted>
kind                  : Scheduled
playbookName          :

# Grab the rule specifically using 0.6.5 - Works OK
PS /tmp> Import-Module -RequiredVersion 0.6.5 AzSentinel
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
lastModifiedUtc       : 17/9/2020 12:16:11 pm
name                  : <redacted>
etag                  : <redacted>
id                    : <redacted>
playbookName          : MyPlaybook

# Grab multiple rules at once on 0.6.6 - Returns errors "Cannot index into a null array."
PS /tmp> Import-Module -RequiredVersion 0.6.6 AzSentinel
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |
2766 |$playbook = Get-AzSentinelAlertRuleAction @arguments -Rul …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot index into a null array.
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |
2766 |$playbook = Get-AzSentinelAlertRuleAction @arguments -Rul …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot index into a null array.
<SNIP>
@pkhabazi pkhabazi self-assigned this Sep 24, 2020
@pkhabazi pkhabazi added the bug Something isn't working label Sep 24, 2020
@pkhabazi pkhabazi linked a pull request Sep 24, 2020 that will close this issue
8 tasks
@pkhabazi
Copy link
Collaborator

hi @pemontto thanks for your feedback! I have a fix ready for the issue described by you. I will release the fix tonight!

@pemontto
Copy link
Contributor Author

Thanks as always, great work!

@pkhabazi pkhabazi linked a pull request Sep 24, 2020 that will close this issue
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
2 participants