az sentinel alert-rule
Note
This reference is part of the sentinel extension for the Azure CLI (version 2.37.0 or higher). The extension will automatically install the first time you run an az sentinel alert-rule command. Learn more about extensions.
Manage alert rule with sentinel.
Commands
Name | Description | Type | Status |
---|---|---|---|
az sentinel alert-rule action |
Manage alert rule action with sentinel. |
Extension | GA |
az sentinel alert-rule action create |
Create the action of alert rule. |
Extension | Experimental |
az sentinel alert-rule action delete |
Delete the action of alert rule. |
Extension | Experimental |
az sentinel alert-rule action list |
Get all actions of alert rule. |
Extension | Experimental |
az sentinel alert-rule action show |
Get the action of alert rule. |
Extension | Experimental |
az sentinel alert-rule action update |
Update the action of alert rule. |
Extension | Experimental |
az sentinel alert-rule create |
Create the alert rule. |
Extension | Experimental |
az sentinel alert-rule delete |
Delete the alert rule. |
Extension | Experimental |
az sentinel alert-rule list |
Get all alert rules. |
Extension | Experimental |
az sentinel alert-rule show |
Get the alert rule. |
Extension | Experimental |
az sentinel alert-rule template |
Manage alert rule template with sentinel. |
Extension | GA |
az sentinel alert-rule template list |
Get all alert rule templates. |
Extension | Experimental |
az sentinel alert-rule template show |
Get the alert rule template. |
Extension | Experimental |
az sentinel alert-rule update |
Update the alert rule. |
Extension | Experimental |
az sentinel alert-rule create
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Create the alert rule.
az sentinel alert-rule create --name
--resource-group
--workspace-name
[--etag]
[--fusion]
[--ml-behavior-analytics]
[--ms-security-incident]
[--nrt]
[--scheduled]
[--threat-intelligence]
Required Parameters
Name of alert rule.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
The name of the workspace.
Optional Parameters
Etag of the azure resource.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Microsoft security incident creation. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel alert-rule delete
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Delete the alert rule.
az sentinel alert-rule delete [--ids]
[--name]
[--resource-group]
[--subscription]
[--workspace-name]
[--yes]
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of alert rule.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
The name of the workspace.
Do not prompt for confirmation.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel alert-rule list
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Get all alert rules.
az sentinel alert-rule list --resource-group
--workspace-name
Required Parameters
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
The name of the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel alert-rule show
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Get the alert rule.
az sentinel alert-rule show [--ids]
[--name]
[--resource-group]
[--subscription]
[--workspace-name]
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of alert rule.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
The name of the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel alert-rule update
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Update the alert rule.
az sentinel alert-rule update [--add]
[--etag]
[--force-string {0, 1, f, false, n, no, t, true, y, yes}]
[--fusion]
[--ids]
[--ml-behavior-analytics]
[--ms-security-incident]
[--name]
[--nrt]
[--remove]
[--resource-group]
[--scheduled]
[--set]
[--subscription]
[--threat-intelligence]
[--workspace-name]
Optional Parameters
Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>
.
Etag of the azure resource.
When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Microsoft security incident creation. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Name of alert rule.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Remove a property or an element from a list. Example: --remove property.list <indexToRemove>
OR --remove propertyToRemove
.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The name of the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
Azure CLI