Edit

Share via

Get-AzSentinelEntityInsight

Module:
Az.SecurityInsights Module

Execute Insights for an entity.

Syntax

Default (Default) 

Get-AzSentinelEntityInsight
    -EntityId <String>
    -ResourceGroupName <String>
    -WorkspaceName <String>
    [-SubscriptionId <String[]>]
    -EndTime <DateTime>
    -StartTime <DateTime>
    [-AddDefaultExtendedTimeRange]
    [-InsightQueryId <String[]>]
    [-DefaultProfile <PSObject>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

Execute Insights for an entity.

Examples

Example 1: Get Insights for an Entity for a given time range

$startTime = (Get-Date).AddDays(-7).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 $endTime = (Get-Date).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 Get-AzSentinelEntityInsight -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -EntityId "myEntityId" -EndTime $endTime -StartTime $startTime

QueryId                    : 4191a4d7-e72b-4564-b2fb-25580630384b
QueryTimeIntervalEndTime   : 12/21/2021 10:00:00 AM
QueryTimeIntervalStartTime : 12/14/2021 10:00:00 AM
TableQueryResultColumn     : {Activity, expectedCount, actualCount, anomalyScore…}
TableQueryResultRow        : {4663 - An attempt was made to access an object. 0 3901 713.91 1 0}

This command gets insights for an Entity for a given time range.

Example 2: Get Insights for an Entity by entity Id for a given time range

$startTime = (Get-Date).AddDays(-7).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 $endTime = (Get-Date).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 $Entity = Get-AzSentinelEntity -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -EntityId "00001111-aaaa-2222-bbbb-3333cccc4444"
 $Entity | Get-AzSentinelEntityInsight -EndTime $endTime -StartTime $startTime

QueryId                    : 4191a4d7-e72b-4564-b2fb-25580630384b
QueryTimeIntervalEndTime   : 12/21/2021 10:00:00 AM
QueryTimeIntervalStartTime : 12/14/2021 10:00:00 AM
TableQueryResultColumn     : {Activity, expectedCount, actualCount, anomalyScore…}
TableQueryResultRow        : {4663 - An attempt was made to access an object. 0 3901 713.91 1 0}

This command gets insights for an Entity by object for a given time range.

Parameters

-AddDefaultExtendedTimeRange

Indicates if query time range should be extended with default time range of the query. Default value is false

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:cf

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Parameter properties

Type:PSObject
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AzureRMContext, AzureCredential

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EndTime

The end timeline date, so the results returned are before this date.

Parameter properties

Type:DateTime
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EntityId

entity ID

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-InsightQueryId

List of Insights Query Id. If empty, default value is all insights of this entity

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-StartTime

The start timeline date, so the results returned are after this date.

Parameter properties

Type:DateTime
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-SubscriptionId

The ID of the target subscription.

Parameter properties

Type:

String[]

Default value:(Get-AzContext).Subscription.Id
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:wi

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WorkspaceName

The name of the workspace.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Outputs

IEntityGetInsightsResponse