0

I'm trying to deploy sentinel alerts into sentinel using Azure Runbook by using the below command:

Import-AzSentinelAlertRule -WorkspaceName "xxx" -SettingsFile "test_alert.json" 

The SettingsFile of this command expects a path of json as parameter. How we can pass the json file to runbook?

Erik Oppedijk
  • 3,496
  • 4
  • 31
  • 42
dev333
  • 713
  • 2
  • 17
  • 38

1 Answers1

1

How we can pass the json file to runbook?

I have reproduced in my environment and I followed Microsoft-Document and I got expected results as below:

Param(
[parameter(Mandatory=$true)]
[object]$json
)
$json = $json | ConvertFrom-Json

enter image description here

Then save and publish runbook.

Then open your local windows PowerShell and follow below steps:

Step1:

Connect-AzAccount

enter image description here

Step2:

 $json =  (Get-content -path "C:Downloads\xy.json") | Out-string
 

enter image description here

Step3:

$RBParams = @{
     AutomationAccountName = 'rithwikrunning'
     ResourceGroupName = 'XX'
     Name = 'xy'
     Parameters = $JsonParams
}

XX- Name of the resource Group xy- Name of the runbook

enter image description here

Step4:

$job = Start-AzAutomationRunbook @RBParams

enter image description here

Now the json file is passed to run book and it got started:

enter image description here

Now the content of the file or file is in $json variable in runbook.

References:

RithwikBojja
  • 5,069
  • 2
  • 3
  • 7
  • Hi Rithwik .. Can you please look this link ?https://stackoverflow.com/questions/74715980/unable-to-find-type-microsoft-azure-powershell-cmdlets-securityinsights-models – dev333 Dec 07 '22 at 11:34