AZSentinel
AZSentinel copied to clipboard
Import-AzSentinelAlertRule with invalid rule does not cause exception
Environment
Windows build number: Microsoft Windows [Version 10.0.22000.795] PowerShell version 7,2,5
Steps to reproduce
- Enable Sentinel in a subscription
- Take AZSentinel/examples/AlertRules.json] and attempt to import it
Import-AzSentinelAlertRule -SettingsFile .\alertrules.json -WorkspaceName "foo"
`WARNING: Unable to find LogicApp playbook01 under Subscription Id: (redacted)
Import-AzSentinelAlertRule: Unable to invoke webrequest for rule AlertRule01 with error message: Unable to create Action for Rule: with Playbook playbook01 Error: Response status code does not indicate success: 400 (Bad Request).
WARNING: "AlertRule02" configuration is not following the official API schema, consider updating the incident and grouping configuration.
Import-AzSentinelAlertRule: Unable to invoke webrequest for rule AlertRule02 with error message: Response status code does not indicate success: 400 (Bad Request).
WARNING: "AlertRule03" configuration is not following the official API schema, consider updating the incident and grouping configuration.`
Expected behavior
Exception thrown at the first invalid rule
Actual behavior
- Rules import continues regardless
- Rules actually appear in console, despite errors shown on output
I'm unsure if we have nothing actually wrong with the rule definitions in this repos' sample file, and a bug in the import commandlet here, and/or an issue with raising exceptions.
Thanks