Why do Get-AzSentinelAlertRule/Incident Powershell CLI queries not always provide specified output detail?
When running the following List-all-alert-rules query, Get-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName"
all specified field key:value pairs are returned for every rule, including the two desired fields Name:{e.g. fdc0dc4b-5f86-48f6-8773-3dce2998f9ab} and DisplayName:{e.g. Scheduled resource WRITE or DELETE}
But as soon as we attempt to search for a specific -RuleId all we get is three values returned, Etag: , Type: and Name:
Similarly with Incident queries.
Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName"
or
Get-AzSentinelIncident -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -Id "f5409f55-7dd8-4c73-9981-4627520b2db"
Instead of the exampled fields being returned:
Title : (Preview) TI map IP entity to AzureActivity
Description : Identifies a match in AzureActivity from any IP IOC from TI
Severity : Medium
Number : 754
Label : {}
ProviderName : Azure Sentinel
Name : f5409f55-7dd8-4c73-9981-4627520b2db
... only two field values are returned, ETag: and Name:
Why does this happen and how can we get either all the details, or at-least values for the specific fields we want?
The Use Case
What we want/need is the DisplayName: or Title: values to be able to make sense of the events which report only by objectID's for Name:
e.g.
Description: (Message:) The action: Microsoft.SecurityInsights/alertrules/{write} ► was performed by: {AnAdminUserID@MyCompany.com} ► at Brisbane UTC: 2024-06-24T11:50:25.9062812Z ► from IP address: {192.168.132.123} ► for Resource: /subscriptions/{##a#####-#f#b-###d-####-#f##dea##d##}/resourcegroups/{ab-syd-prod-arg-cdef-###}/providers/microsoft.operationalinsights/workspaces/{ab-syd-prod-law-cdef-###}/providers/microsoft.securityinsights/alertrules/fdc0dc4b-5f86-48f6-8773-3dce2998f9ab
we'd like to return the friendly DisplayName: Scheduled resource WRITE or DELETE