Bug Report

[secalert170925]

Environment

Windows build number: Microsoft Windows [Version 10.0.19042.985]
PowerShell version (if applicable): 7.1.3

Steps to reproduce

Run "Get-AzSentinelHuntingRule".

Expected behavior

Hunting Rule information is output.

Actual behavior

Log Analytics workspace function information is output.

[pemontto]

Can you provide more detail, what was the output? What was the full command you ran?

[secalert170925]

I ran bellow command.

Get-AzSentinelHuntingRule -WorkspaceName $WorkSpaceName -SubscriptionId $SubscriptionId | format-table

And its output is bellow.

Category DisplayName Query

---

function testFunction2 Heartbeat… TEST testFunction dynamic({… Log Management All Events Event | sort by TimeGenerated desc… Log Management Count of Events containing the word "started" grouped by EventID search in (Event) "started" | summarize AggregatedValue = count() by EventID… Log Management Count of Events grouped by Event Log Event | summarize AggregatedValue = count() by EventLog… Log Management Count of Events grouped by Event Source Event | summarize AggregatedValue = count() by Source… Log Management Count of Events grouped by Event ID Event | summarize AggregatedValue = count() by EventID… Log Management All Events with level "Warning" Event | where EventLevelName == "warning" | sort by TimeGenerated desc… Log Management Count of Events with level "Warning" grouped by Event ID Event | where EventLevelName == "warning" | summarize AggregatedValue = count() by EventID… Log Management How many connections to Operations Manager's SDK service by day Event | where EventID == 26328 and EventLog == "Operations Manager" | summarize AggregatedValue = count() by bin(TimeGe… Log Management Events in the Operations Manager Event Log whose Event ID is in the range between 2000 and 3000 Event | where EventLog == "Operations Manager" and EventID >= 2000 and EventID <= 3000 | sort by TimeGenerated desc… Log Management When did my servers initiate restart? search in (Event) "shutdown" and EventLog == "System" and Source == "User32" and EventID == 1074 | sort by TimeGenerate… Log Management Windows Firewall Policy settings have changed Event | where EventLog == "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" and EventID == 2008 | so… Log Management On which machines and how many times have Windows Firewall Policy settings changed Event | where EventLog == "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" and EventID == 2008 | su… Log Management All IIS Log Entries search * | extend Type = $table | where Type == W3CIISLog | sort by TimeGenerated desc… Log Management Shows breakdown of response codes search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by scStatus… Log Management Find the maximum time taken for each page search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = max(TimeTaken) by csUriStem… Log Management Shows which pages people are getting a 404 for search scStatus == 404 | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by csUriS… Log Management Average HTTP Request time by HTTP Method search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = avg(TimeTaken) by csMethod… Log Management Shows servers that are throwing internal server error search scStatus == 500 | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by sCompu… Log Management Count of IIS Log Entries by HTTP Request Method search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by csMethod… Log Management Count of IIS Log Entries by HTTP User Agent search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by csUserAgent… Log Management Count of IIS Log Entries by Client IP Address search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by cIP… Log Management IIS Log Entries for a specific client IP Address (replace with your own) search cIP == "192.168.0.1" | extend Type = $table | where Type == W3CIISLog | sort by TimeGenerated desc | project csU… Log Management Count of IIS Log Entries by URL requested by client (without query strings) search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by csUriStem… Log Management Count of IIS Log Entries by Host requested by client search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count() by csHost… Log Management Count of IIS Log Entries by URL for the host "www.contoso.com" (replace with your own) search csHost == "www.contoso.com" | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = count… Log Management Total Bytes sent by Client IP Address search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = sum(csBytes) by cIP… Log Management Total Bytes received by each Azure Role Instance search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = sum(csBytes) by RoleInstance… Log Management Total Bytes received by each IIS Computer search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = sum(csBytes) by Computer | limi… Log Management Total Bytes responded back to clients by each IIS ServerIP Address search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = sum(scBytes) by sIP… Log Management Total Bytes responded back to clients by Client IP Address search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = sum(scBytes) by cIP… Log Management Average HTTP Request time by Client IP Address search * | extend Type = $table | where Type == W3CIISLog | summarize AggregatedValue = avg(TimeTaken) by cIP… Log Management All Syslogs Syslog | sort by TimeGenerated desc… Log Management All Syslog Records with Errors Syslog | where SeverityLevel == "error" | sort by TimeGenerated desc… Log Management All Syslog Records grouped by Facility Syslog | summarize AggregatedValue = count() by Facility… Log Management All Syslog Records grouped by ProcessName Syslog | summarize AggregatedValue = count() by ProcessName… General Exploration Which Management Group is generating the most data points? search * | summarize AggregatedValue = count() by ManagementGroupName… General Exploration Distribution of data Types search * | extend Type = $table | summarize AggregatedValue = count() by Type… General Exploration All Computers with their most recent data search not(ObjectName == "Advisor Metrics" or ObjectName == "ManagedSpace") | summarize AggregatedValue = max(TimeGener… General Exploration Stale Computers (data older than 24 hours) search not(ObjectName == "Advisor Metrics" or ObjectName == "ManagedSpace") | summarize lastdata = max(TimeGenerated) b…