New-AzSentinelBookmark
Syntax
CreateExpanded (Default)
New-AzSentinelBookmark
-ResourceGroupName <String>
-WorkspaceName <String>
[-Id <String>]
[-SubscriptionId <String>]
[-DisplayName <String>]
[-EventTime <DateTime>]
[-IncidentInfoIncidentId <String>]
[-IncidentInfoRelationName <String>]
[-IncidentInfoSeverity <String>]
[-IncidentInfoTitle <String>]
[-Label <String[]>]
[-Note <String>]
[-Query <String>]
[-QueryEndTime <DateTime>]
[-QueryResult <String>]
[-QueryStartTime <DateTime>]
[-UpdatedByEmail <String>]
[-UpdatedByName <String>]
[-DefaultProfile <PSObject>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
CreateViaJsonFilePath
New-AzSentinelBookmark
-ResourceGroupName <String>
-WorkspaceName <String>
-JsonFilePath <String>
[-Id <String>]
[-SubscriptionId <String>]
[-DefaultProfile <PSObject>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
CreateViaJsonString
New-AzSentinelBookmark
-ResourceGroupName <String>
-WorkspaceName <String>
-JsonString <String>
[-Id <String>]
[-SubscriptionId <String>]
[-DefaultProfile <PSObject>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Description
Examples
Example 1: Create a Bookmark
$queryStartTime = (Get-Date).AddDays(-1).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
$queryEndTime = (Get-Date).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
New-AzSentinelBookmark -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Id ((New-Guid).Guid) -DisplayName "Incident Evidence" -Query "SecurityEvent | take 1" -QueryStartTime $queryStartTime -QueryEndTime $queryEndTime -EventTime $queryEndTime
DisplayName : Incident Evidence
CreatedByName : John Contoso
CreatedByEmail : john@contoso.com
Name : 6a8d6ea6-04d5-49d7-8169-ffca8b0ced59
Note : my notes
This command creates a Bookmark.
Parameters
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: cf
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DefaultProfile
The DefaultProfile parameter is not functional.
Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.
Parameter properties
Type: PSObject
Default value: None Supports wildcards: False DontShow: False Aliases: AzureRMContext, AzureCredential
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DisplayName
The display name of the bookmark
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-EventTime
The bookmark event time
Parameter properties
Type: DateTime
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Id
Bookmark ID
Parameter properties
Type: String
Default value: (New-Guid).Guid Supports wildcards: False DontShow: False Aliases: BookmarkId
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-IncidentInfoIncidentId
Incident Id
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-IncidentInfoRelationName
Relation Name
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-IncidentInfoSeverity
The severity of the incident
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-IncidentInfoTitle
The title of the incident
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-JsonFilePath
Path of Json file supplied to the Create operation
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateViaJsonFilePath
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-JsonString
Json string supplied to the Create operation
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateViaJsonString
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Label
List of labels relevant to this bookmark
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Note
The notes of the bookmark
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Query
The query of the bookmark.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-QueryEndTime
The end time for the query
Parameter properties
Type: DateTime
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-QueryResult
The query result of the bookmark.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-QueryStartTime
The start time for the query
Parameter properties
Type: DateTime
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ResourceGroupName
The name of the resource group.
The name is case insensitive.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-SubscriptionId
The ID of the target subscription.
Parameter properties
Type: String
Default value: (Get-AzContext).Subscription.Id Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-UpdatedByEmail
The email of the user.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-UpdatedByName
The name of the user.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
CreateExpanded
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: wi
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-WorkspaceName
The name of the workspace.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters .
Outputs
