Skip to content

Get-AzSentinelAlertRuleAction doesn't return playbookName in 0.6.6 #101

Description

@pemontto

Environment

PS /tmp> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.3
PSEdition                      Core
GitCommitId                    7.0.3
OS                             Darwin 18.7.0 Darwin Kernel Version 18.7.0: Tue Aug 20 16:57:14 PDT 2019; root:xnu-4903.271.2~2/RELEASE_X86_64
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Steps to reproduce

Try to fetch a rule or multiple rules with Get-AzSentinelAlertRule.

Expected behavior

Rules are fetched with playbook name/information

Actual behavior

The playbook name does not get retrieved and errors are encountered pulling down multiple rules at once.

# Grab the rule action specifically - OK
PS /tmp> Get-AzSentinelAlertRuleAction -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
id         : /subscriptions/<redacted>
name       : <redacted>
etag       : <redacted>
type       : Microsoft.SecurityInsights/alertRules/actions
properties : @{workflowId=<redacted>}

# Grab the rule specifically - no playbookName returned
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
lastModifiedUtc       : 17/9/2020 12:16:11 pm
name                  : <redacted>
etag                  : <redacted>
id                    : <redacted>
kind                  : Scheduled
playbookName          :

# Grab the rule specifically using 0.6.5 - Works OK
PS /tmp> Import-Module -RequiredVersion 0.6.5 AzSentinel
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X -RuleName "MyAnalytic"
<SNIP>
lastModifiedUtc       : 17/9/2020 12:16:11 pm
name                  : <redacted>
etag                  : <redacted>
id                    : <redacted>
playbookName          : MyPlaybook

# Grab multiple rules at once on 0.6.6 - Returns errors "Cannot index into a null array."
PS /tmp> Import-Module -RequiredVersion 0.6.6 AzSentinel
PS /tmp> Get-AzSentinelAlertRule -Verbose -SubscriptionId X -WorkspaceName X
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |
2766 |$playbook = Get-AzSentinelAlertRuleAction @arguments -Rul …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot index into a null array.
<SNIP>
InvalidOperation: /Users/test/.local/share/powershell/Modules/AzSentinel/0.6.6/AzSentinel.psm1:2766
Line |
2766 |$playbook = Get-AzSentinelAlertRuleAction @arguments -Rul …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot index into a null array.
<SNIP>

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions