Update-AzSentinelEntityQuery
Updates the entity query.
Syntax
Update-AzSentinelEntityQuery
-EntityQueryId <String>
-ResourceGroupName <String>
-WorkspaceName <String>
[-SubscriptionId <String>]
[-Content <String>]
[-Description <String>]
[-Disabled]
[-Enabled]
[-EntitiesFilter <ActivityEntityQueriesPropertiesEntitiesFilter>]
[-InputEntityType <EntityType>]
[-QueryDefinitionQuery <String>]
[-RequiredInputFieldsSet <String[]>]
[-TemplateName <String>]
[-Title <String>]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-Confirm]
[-WhatIf]
[<CommonParameters>] Update-AzSentinelEntityQuery
-InputObject <ISecurityInsightsIdentity>
[-Content <String>]
[-Description <String>]
[-Disabled]
[-Enabled]
[-EntitiesFilter <ActivityEntityQueriesPropertiesEntitiesFilter>]
[-InputEntityType <EntityType>]
[-QueryDefinitionQuery <String>]
[-RequiredInputFieldsSet <String[]>]
[-TemplateName <String>]
[-Title <String>]
[-DefaultProfile <PSObject>]
[-AsJob]
[-NoWait]
[-Confirm]
[-WhatIf]
[<CommonParameters>] Description
Updates the entity query.
Examples
Example 1: Update an Entity Query
Update-AzSentinelEntityQuery -ResourceGroupName "myResourceGroupName" -WorkspaceName "myWorkspaceName" -EntityQueryId "4a21e485-75ae-48b3-a7b9-e6a92bcfe434" -Title "myEntityQuery Title"This command updates an entity query.
Parameters
-AsJob
Run the command as a job
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Content
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with Azure.
| Type: | PSObject |
| Aliases: | AzureRMContext, AzureCredential |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Description
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Disabled
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Enabled
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EntitiesFilter
To construct, see NOTES section for ENTITIESFILTER properties and create a hash table.
| Type: | ActivityEntityQueriesPropertiesEntitiesFilter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EntityQueryId
The Id of the Entity Query.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-InputEntityType
| Type: | EntityType |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-InputObject
Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.
| Type: | ISecurityInsightsIdentity |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-NoWait
Run the command asynchronously
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-QueryDefinitionQuery
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RequiredInputFieldsSet
| Type: | String[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ResourceGroupName
The Resource Group Name.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SubscriptionId
Gets subscription credentials which uniquely identify Microsoft Azure subscription. The subscription ID forms part of the URI for every service call.
| Type: | String |
| Position: | Named |
| Default value: | (Get-AzContext).Subscription.Id |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TemplateName
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Title
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WorkspaceName
[Alias('DataConnectionName')] The name of the workspace.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
Outputs
Notes
ALIASES
COMPLEX PARAMETER PROPERTIES
To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.
ENTITIESFILTER <ActivityEntityQueriesPropertiesEntitiesFilter>:
[(Any) <String[]>]: This indicates any property can be added to this object.
INPUTOBJECT <ISecurityInsightsIdentity>: Identity Parameter
[ActionId <String>]: Action ID[AlertRuleTemplateId <String>]: Alert rule template ID[AutomationRuleId <String>]: Automation rule ID[BookmarkId <String>]: Bookmark ID[ConsentId <String>]: consent ID[DataConnectorId <String>]: Connector ID[EntityId <String>]: entity ID[EntityQueryId <String>]: entity query ID[EntityQueryTemplateId <String>]: entity query template ID[Id <String>]: Resource identity path[IncidentCommentId <String>]: Incident comment ID[IncidentId <String>]: Incident ID[MetadataName <String>]: The Metadata name.[Name <String>]: Threat intelligence indicator name field.[RelationName <String>]: Relation Name[ResourceGroupName <String>]: The name of the resource group. The name is case insensitive.[RuleId <String>]: Alert rule ID[SentinelOnboardingStateName <String>]: The Sentinel onboarding state name. Supports - default[SettingsName <String>]: The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba[SourceControlId <String>]: Source control Id[SubscriptionId <String>]: The ID of the target subscription.[WorkspaceName <String>]: The name of the workspace.
Collaborate with us on GitHub
The source for this content can be found on GitHub, where you can also create and review issues and pull requests. For more information, see our contributor guide.
Azure PowerShell
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for