PS /tmp> $PSVersionTable
Name Value
---- -----
PSVersion 7.0.3
PSEdition Core
GitCommitId 7.0.3
OS Darwin 18.7.0 Darwin Kernel Version 18.7.0: Tue Aug 20 16:57:14 PDT 2019; root:xnu-4903.271.2~2/RELEASE_X86_64
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Steps to reproduce
Try to fetch a rule or multiple rules with Get-AzSentinelAlertRule.
Expected behavior
Rules are fetched with playbook name/information
Actual behavior
The playbook name does not get retrieved and errors are encountered pulling down multiple rules at once.
# Grab the rule action specifically - OK
PS /tmp>Get-AzSentinelAlertRuleAction-Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"<SNIP>
id : /subscriptions/<redacted>
name : <redacted>
etag : <redacted>
type : Microsoft.SecurityInsights/alertRules/actions
properties : @{workflowId=<redacted>}
# Grab the rule specifically - no playbookName returned
PS /tmp>Get-AzSentinelAlertRule-Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"<SNIP>
lastModifiedUtc : 17/9/202012:16:11 pm
name : <redacted>
etag : <redacted>
id : <redacted>
kind : Scheduled
playbookName :
# Grab the rule specifically using 0.6.5 - Works OK
PS /tmp>Import-Module-RequiredVersion 0.6.5 AzSentinel
PS /tmp>Get-AzSentinelAlertRule-Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"<SNIP>
lastModifiedUtc : 17/9/202012:16:11 pm
name : <redacted>
etag : <redacted>
id : <redacted>
playbookName : MyPlaybook
# Grab multiple rules at once on 0.6.6 - Returns errors "Cannot index into a null array."
PS /tmp>Import-Module-RequiredVersion 0.6.6 AzSentinel
PS /tmp>Get-AzSentinelAlertRule-Verbose -SubscriptionId X -WorkspaceName X
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |2766| … $playbook=Get-AzSentinelAlertRuleAction@arguments-Rul …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot index into a null array.
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |2766| … $playbook=Get-AzSentinelAlertRuleAction@arguments-Rul …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot index into a null array.
<SNIP>
The text was updated successfully, but these errors were encountered:
Environment
Steps to reproduce
Try to fetch a rule or multiple rules with Get-AzSentinelAlertRule.
Expected behavior
Rules are fetched with playbook name/information
Actual behavior
The playbook name does not get retrieved and errors are encountered pulling down multiple rules at once.
The text was updated successfully, but these errors were encountered: