Remove-AzSentinelEntityQuery

Reference

Module:: Az.SecurityInsights

Delete the entity query.

Syntax

Remove-AzSentinelEntityQuery
      -Id <String>
      -ResourceGroupName <String>
      [-SubscriptionId <String>]
      -WorkspaceName <String>
      [-DefaultProfile <PSObject>]
      [-PassThru]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Remove-AzSentinelEntityQuery
      -InputObject <ISecurityInsightsIdentity>
      [-DefaultProfile <PSObject>]
      [-PassThru]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Description

Delete the entity query.

Examples

Example 1: Remove Entity Query

Remove-AzSentinelEntityQuery -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -Id "myEntityQueryTemplateId"

This command removes a specific entity query based on the entity query Id

Example 2: Remove an Entity Query based on the title

$queryTemplateId = Get-AzSentinelEntityQueryTemplate -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" | Where-Object {$_.Title -eq "The user has created an account"}
Remove-AzSentinelEntityQuery -ResourceGroupName "myResourceGroupName" -workspaceName "myWorkspaceName" -Id $queryTemplateId.Name

This command removes a specific entity query based on the title

Parameters

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

The DefaultProfile parameter is not functional. Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.

Type:	PSObject
Aliases:	AzureRMContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Id

entity query ID

Type:	String
Aliases:	EntityQueryId
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Type:	ISecurityInsightsIdentity
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PassThru

Returns true when the command succeeds

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResourceGroupName

The name of the resource group. The name is case insensitive.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-SubscriptionId

The ID of the target subscription.

Type:	String
Position:	Named
Default value:	(Get-AzContext).Subscription.Id
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WorkspaceName

The name of the workspace.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

ISecurityInsightsIdentity

Outputs

Boolean