Az.SecurityInsights Updates

[dicolanl]

trafficstars

Updates per design review and comment on https://github.com/Azure/azure-powershell/pull/18790#issuecomment-1188735810

Checklist

• [X] Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD select appropriate branch. Cmdlets from Autorest.PowerShell should go to generation branch.
• SHOULD make the title of PR clear and informative, and in the present imperative tense.
• SHOULD update ChangeLog.md file(s) appropriately
  • For any service, the ChangeLog.md file can be found at src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md
  • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense. Add changelog in description section if PR goes into generation branch.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD have approved design review for the changes in this repository (Microsoft internal only) with following situations
  • Create new module from the scratch
  • Create new resource types which are not easy to conform to Azure PowerShell Design Guidelines
  • Create new resource type which name doesn't use module name as prefix
  • Have design question before implementation
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT introduce breaking changes in Az minor release except preview version.
• SHOULD NOT change version of module in pull request

[msftbot[bot]]

Thank you for your contribution dicolanl! We will review the pull request and get back to you soon.

[dicolanl]

@BethanyZhou per your comments https://github.com/Azure/azure-powershell/pull/18790#issuecomment-1188735810 I have updated the cmdlets and created a new PR

[BethanyZhou]

Thank for your input!

• Parameter Teams of cmdlet New/Update-AzSentinelDataConnector does not follow the enforced naming convention of using a singular noun for a parameter name.","Consider using a singular noun for the parameter name.

  • Please update Teams -> Team in New/Update-AzSentinelDataConnector as well.

• Please see tests in https://github.com/Azure/azure-powershell/blob/3ec00cc46e5e378eef84476924b5d8f90c0ff1bc/src/SecurityInsights/test/Update-AzSentinelIncidentRelation.Tests.ps1#L19

• https://github.com/Azure/azure-powershell/blob/3ec00cc46e5e378eef84476924b5d8f90c0ff1bc/src/SecurityInsights/test/Update-AzSentinelBookmarkRelation.Tests.ps1#L19

• https://github.com/Azure/azure-powershell/blob/3ec00cc46e5e378eef84476924b5d8f90c0ff1bc/src/SecurityInsights/test/New-AzSentinelAutomationRule.Tests.ps1#L24

• https://github.com/Azure/azure-powershell/blob/3ec00cc46e5e378eef84476924b5d8f90c0ff1bc/src/SecurityInsights/test/New-AzSentinelBookmark.Tests.ps1#L19

  • The Id is not contained in the syntax of New-AzSentinelBookmark, New-AzSentinelAutomationRule and New-AzSentinelIncident could you check it?

• I saw the test for Invoke-AzSentinelDataConnectorsCheckRequirement, but I didn't find it is a command included in current module. Could you check?

• Please check the Disable parameter in New-AzSentinelAlertRule.Tests.ps1 and https://github.com/Azure/azure-powershell/blob/3ec00cc46e5e378eef84476924b5d8f90c0ff1bc/src/SecurityInsights/test/New-AzSentinelAlertRuleAction.Tests.ps1#L19. It's not recognized in New-AzSentinelAlertRule

• A parameter cannot be found that matches parameter name 'EntityQueryId'.

  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\New-AzSentinelEntityQuery.Tests.ps1: line 30

• A parameter cannot be found that matches parameter name 'DataConnectorId'.

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Remove-AzSentinelDataConnector.Tests.ps1: line 19

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Remove-AzSentinelDataConnector.Tests.ps1: line 25

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\New-AzSentinelDataConnector.Tests.ps1: line 19

• A parameter cannot be found that matches parameter name 'Disabled'. at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelAlertRule.Tests.ps1: line 19

• Cannot bind argument to parameter 'SubscriptionId' because it is null.

  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelDataConnector.Tests.ps1: line 19
  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelDataConnector.Tests.ps1: line 27
  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelEntityQuery.Tests.ps1: line 19
  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelEntityQuery.Tests.ps1: line 26
  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelSetting.Tests.ps1: line 19
  • at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelSetting.Tests.ps1: line 26

• A parameter cannot be found that matches parameter name 'Id'.

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelIncidentRelation.Tests.ps1: line 19

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelIncidentRelation.Tests.ps1: line 28

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\New-AzSentinelIncidentTeam.Tests.ps1: line 19

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelBookmarkRelation.Tests.ps1: line 19

• at <ScriptBlock>, D:\a\1\s\artifacts\Debug\Az.SecurityInsights\test\Update-AzSentinelBookmarkRelation.Tests.ps1: line 27

  • please add SubscriptionId as their parameter to resolve this issue.

[dicolanl]

@BethanyZhou Updated code see comments below:

-Parameter Teams of cmdlet New/Update-AzSentinelDataConnector does not follow the enforced naming convention of using a singular noun for a parameter name.","Consider using a singular noun for the parameter name. --This parameter is referencing Microsoft Teams. Changing it to Team will confuse customers.

-Please see tests in: The Id is not contained in the syntax of New-AzSentinelBookmark, New-AzSentinelAutomationRule and New-AzSentinelIncident could you check it? --Fixed -I saw the test for Invoke-AzSentinelDataConnectorsCheckRequirement, but I didn't find it is a command included in current module. Could you check? --Fixed. We hide the command as its not useful in powershell, removed the test.

-Please check the Disable parameter in New-AzSentinelAlertRule.Tests.ps1 and --Fixed

-A parameter cannot be found that matches parameter name 'EntityQueryId'. --Fixed

-A parameter cannot be found that matches parameter name 'DataConnectorId'. --Fixed

-A parameter cannot be found that matches parameter name 'Disabled'. --Fixed

-Cannot bind argument to parameter 'SubscriptionId' because it is null. please add SubscriptionId as their parameter to resolve this issue. --SubscrptionId is an optional parameter for all cmdlets. Its uses 'Script = '(Get-AzContext).Subscription.Id' So its required to login before running the tests.

I also reran all tests in record mode so there was some new recording files.

[isra-fel]

Memo (for myself):

1. When we think this PR is OK, run a "generation" pipeline from this branch to share/SecurityInsights
2. Submit a PR from share/SecurityInsights to Az.SecurityInsights-preview branch
3. If the CI fails, fix the issues in THIS PR, go to 1
4. Merge this PR and the PR in 2
5. Release the preview from Az.SecurityInsights-preview branch
6. (In Major release) merge preview branch to main

[wyunchi-ms]

/azp run

[azure-pipelines[bot]]

Azure Pipelines successfully started running 2 pipeline(s).

[dicolanl]

@VeryEarly i have fixed the items from comment here and per email , both are in the lastest commit.