New-AzSentinelAlertRule
Syntax
FusionMLTI (Default)
New-AzSentinelAlertRule
-ResourceGroupName <String>
-WorkspaceName <String>
-Kind <String>
-AlertRuleTemplate <String>
[-SubscriptionId <String>]
[-RuleId <String>]
[-Enabled]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
NRT
New-AzSentinelAlertRule
-ResourceGroupName <String>
-WorkspaceName <String>
-Kind <String>
-Query <String>
-DisplayName <String>
-Severity <String>
[-SubscriptionId <String>]
[-RuleId <String>]
[-Enabled]
[-AlertRuleTemplateName <String>]
[-Description <String>]
[-SuppressionDuration <TimeSpan>]
[-SuppressionEnabled]
[-Tactic <String[]>]
[-CreateIncident]
[-GroupingConfigurationEnabled]
[-ReOpenClosedIncident]
[-LookbackDuration <TimeSpan>]
[-MatchingMethod <String>]
[-GroupByAlertDetail <String[]>]
[-GroupByCustomDetail <String[]>]
[-GroupByEntity <String[]>]
[-EntityMapping <EntityMapping[]>]
[-AlertDescriptionFormat <String>]
[-AlertDisplayNameFormat <String>]
[-AlertSeverityColumnName <String>]
[-AlertTacticsColumnName <String>]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Scheduled
New-AzSentinelAlertRule
-ResourceGroupName <String>
-WorkspaceName <String>
-Kind <String>
-Query <String>
-DisplayName <String>
-Severity <String>
-QueryFrequency <TimeSpan>
-QueryPeriod <TimeSpan>
-TriggerOperator <String>
-TriggerThreshold <Int32>
[-SubscriptionId <String>]
[-RuleId <String>]
[-Enabled]
[-AlertRuleTemplateName <String>]
[-Description <String>]
[-SuppressionDuration <TimeSpan>]
[-SuppressionEnabled]
[-Tactic <String[]>]
[-CreateIncident]
[-GroupingConfigurationEnabled]
[-ReOpenClosedIncident]
[-LookbackDuration <TimeSpan>]
[-MatchingMethod <String>]
[-GroupByAlertDetail <String[]>]
[-GroupByCustomDetail <String[]>]
[-GroupByEntity <String[]>]
[-EntityMapping <EntityMapping[]>]
[-AlertDescriptionFormat <String>]
[-AlertDisplayNameFormat <String>]
[-AlertSeverityColumnName <String>]
[-AlertTacticsColumnName <String>]
[-EventGroupingSettingAggregationKind <String>]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
MicrosoftSecurityIncidentCreation
New-AzSentinelAlertRule
-ResourceGroupName <String>
-WorkspaceName <String>
-Kind <String>
-ProductFilter <String>
[-SubscriptionId <String>]
[-RuleId <String>]
[-Enabled]
[-AlertRuleTemplateName <String>]
[-Description <String>]
[-DisplayNamesFilter <String[]>]
[-DisplayNamesExcludeFilter <String[]>]
[-SeveritiesFilter <String[]>]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Description
Examples
Example 1: Create the Fusion Alert rule
$AlertRuleTemplateName = "f71aba3d-28fb-450b-b192-4e76a83015c8"
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Kind Fusion -Enabled -AlertRuleTemplateName $AlertRuleTemplateName
This command creates an Alert Rule of the Fusion kind based on the template "Advanced Multistage Attack Detection"
Example 2: Create the ML Behavior Analytics Alert Rule
$AlertRuleTemplateName = "fa118b98-de46-4e94-87f9-8e6d5060b60b"
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Kind MLBehaviorAnalytics -Enabled -AlertRuleTemplateName $AlertRuleTemplateName
This command creates an Alert Rule of the MLBehaviorAnalytics kind based on the template "Anomalous SSH Login Detection"
Example 3: Create the Threat Intelligence Alert Rule
$AlertRuleTemplateName = "0dd422ee-e6af-4204-b219-f59ac172e4c6"
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Kind ThreatIntelligence -Enabled -AlertRuleTemplateName $AlertRuleTemplateName
This command creates an Alert Rule of the ThreatIntelligence kind based on the template "Microsoft Threat Intelligence Analytics"
Example 4: Create a Microsoft Security Incident Creation Alert Rule
$AlertRuleTemplateName = "a2e0eb51-1f11-461a-999b-cd0ebe5c7a72"
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -Kind MicrosoftSecurityIncidentCreation -Enabled -AlertRuleTemplateName $AlertRuleTemplateName -ProductFilter "Azure Security Center for IoT"
This command creates an Alert Rule of the MicrosoftSecurityIncidentCreation kind based on the template for Create incidents based on Azure Security Center for IoT alerts.
Example 5: Create a Scheduled Alert Rule
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Kind Scheduled -Enabled -DisplayName "Powershell Execution Alert (Several Times per Hour)" -Severity Low -Query "SecurityEvent | where EventID == 4688" -QueryFrequency (New-TimeSpan -Hours 1) -QueryPeriod (New-TimeSpan -Hours 1) -TriggerThreshold 10
This command creates an Alert Rule of the Scheduled kind.
Please note that that query (parameter -Query) needs to be on a single line as as string.
Example 6: Create a Near Realtime Alert Rule
New-AzSentinelAlertRule -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Kind NRT -Enabled -DisplayName "Break glass account accessed" -Severity High -Query "let Break_Glass_Account = _GetWatchlist('break_glass_account')\n|project UPN;\nSigninLogs\n| where UserPrincipalName in (Break_Glass_Account)"
This command creates an Alert Rule of the NRT kind.
Please note that that query (parameter -Query) needs to be on a single line as as string.
Parameters
Creates the alert rule.
Type: String
Default value: None Supports wildcards: False DontShow: False
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Creates the alert rule.
Type: String
Default value: None Supports wildcards: False DontShow: False
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-AlertRuleTemplate
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
FusionMLTI
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-AlertRuleTemplateName
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-AlertSeverityColumnName
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-AlertTacticsColumnName
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-AsJob
Run the command as a job
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: cf
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-CreateIncident
Creates the alert rule.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with Azure.
Parameter properties
Type: PSObject
Default value: None Supports wildcards: False DontShow: False Aliases: AzureRMContext, AzureCredential
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Description
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DisplayName
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DisplayNamesExcludeFilter
Creates the alert rule.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DisplayNamesFilter
Creates the alert rule.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Enabled
Creates the alert rule.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-EntityMapping
'Account', 'Host', 'IP', 'Malware', 'File', 'Process', 'CloudApplication', 'DNS', 'AzureResource', 'FileHash', 'RegistryKey', 'RegistryValue', 'SecurityGroup', 'URL', 'Mailbox', 'MailCluster', 'MailMessage', 'SubmissionMail'
Parameter properties
Type: EntityMapping [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-EventGroupingSettingAggregationKind
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-GroupByAlertDetail
Creates the alert rule.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-GroupByCustomDetail
Creates the alert rule.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-GroupByEntity
Creates the alert rule.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-GroupingConfigurationEnabled
Creates the alert rule.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Kind
Kind of the the data connection
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-LookbackDuration
Creates the alert rule.
Parameter properties
Type: TimeSpan
Default value: New-TimeSpan -Hours 5 Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-MatchingMethod
Creates the alert rule.
Parameter properties
Type: String
Default value: AllEntities Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-NoWait
Run the command asynchronously
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ProductFilter
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Query
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-QueryFrequency
Creates the alert rule.
Parameter properties
Type: TimeSpan
Default value: None Supports wildcards: False DontShow: False
Parameter sets
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-QueryPeriod
Creates the alert rule.
Parameter properties
Type: TimeSpan
Default value: None Supports wildcards: False DontShow: False
Parameter sets
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ReOpenClosedIncident
Creates the alert rule.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ResourceGroupName
The Resource Group Name.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-RuleId
[Alias('RuleId')]
The Id of the Rule.
Parameter properties
Type: String
Default value: (New-Guid).Guid Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-SeveritiesFilter
High, Medium, Low, Informational
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
MicrosoftSecurityIncidentCreation
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Severity
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-SubscriptionId
Gets subscription credentials which uniquely identify Microsoft Azure subscription.
The subscription ID forms part of the URI for every service call.
Parameter properties
Type: String
Default value: (Get-AzContext).Subscription.Id Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-SuppressionDuration
Creates the alert rule.
Parameter properties
Type: TimeSpan
Default value: New-TimeSpan -Hours 5 Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-SuppressionEnabled
Creates the alert rule.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Tactic
InitialAccess, Execution, Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Collection, Exfiltration, CommandAndControl, Impact, PreAttack
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
NRT
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
Scheduled
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-TriggerOperator
Creates the alert rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-TriggerThreshold
Creates the alert rule.
Parameter properties
Type: Int32
Default value: None Supports wildcards: False DontShow: False
Parameter sets
Scheduled
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: wi
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-WorkspaceName
The name of the workspace.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters .
Outputs
