你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Update-AzSentinelBookmark

参考

模块:: Az.SecurityInsights

创建或更新书签。

语法

Update-AzSentinelBookmark
      -Id <String>
      -ResourceGroupName <String>
      [-SubscriptionId <String>]
      -WorkspaceName <String>
      [-DisplayName <String>]
      [-EventTime <DateTime>]
      [-IncidentInfoIncidentId <String>]
      [-IncidentInfoRelationName <String>]
      [-IncidentInfoSeverity <IncidentSeverity>]
      [-IncidentInfoTitle <String>]
      [-Label <String[]>]
      [-Note <String>]
      [-Query <String>]
      [-QueryEndTime <DateTime>]
      [-QueryResult <String>]
      [-QueryStartTime <DateTime>]
      [-DefaultProfile <PSObject>]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Update-AzSentinelBookmark
      -InputObject <ISecurityInsightsIdentity>
      [-DisplayName <String>]
      [-EventTime <DateTime>]
      [-IncidentInfoIncidentId <String>]
      [-IncidentInfoRelationName <String>]
      [-IncidentInfoSeverity <IncidentSeverity>]
      [-IncidentInfoTitle <String>]
      [-Label <String[]>]
      [-Note <String>]
      [-Query <String>]
      [-QueryEndTime <DateTime>]
      [-QueryResult <String>]
      [-QueryStartTime <DateTime>]
      [-DefaultProfile <PSObject>]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

说明

创建或更新书签。

示例

示例 1：更新 Sentinel 书签

$queryStartTime = (Get-Date).AddDays(-1).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 $queryEndTime = (Get-Date).ToUniversalTime() | Get-Date -Format "yyyy-MM-ddThh:00:00.000Z"
 Update-AzSentinelBookmark -ResourceGroupName "myResourceGroup" -WorkspaceName "myWorkspaceName" -Id ((New-Guid).Guid) -DisplayName "Incident Evidence" -Query "SecurityEvent | take 1" -QueryStartTime $queryStartTime -QueryEndTime $queryEndTime -EventTime $queryEndTime

此命令更新书签

参数

-Confirm

提示你在运行 cmdlet 之前进行确认。

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

DefaultProfile 参数不起作用。如果对其他订阅执行 cmdlet，请使用 SubscriptionId 参数。

Type:	PSObject
Aliases:	AzureRMContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DisplayName

书签的显示名称

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EventTime

书签事件时间

Type:	DateTime
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Id

书签 ID

Type:	String
Aliases:	BookmarkId
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-IncidentInfoIncidentId

事件 ID

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IncidentInfoRelationName

关系名称

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IncidentInfoSeverity

事件的严重性

Type:	IncidentSeverity
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IncidentInfoTitle

事件的标题

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-InputObject

要构造的标识参数，请参阅 INPUTOBJECT 属性的 NOTES 部分并创建哈希表。

Type:	ISecurityInsightsIdentity
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-Label

与此书签相关的标签列表

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Note

书签的笔记

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Query

书签的查询。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-QueryEndTime

查询的结束时间

Type:	DateTime
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-QueryResult

书签的查询结果。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-QueryStartTime

查询的开始时间

Type:	DateTime
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResourceGroupName

资源组的名称。此名称不区分大小写。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-SubscriptionId

目标订阅的 ID。

Type:	String
Position:	Named
Default value:	(Get-AzContext).Subscription.Id
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WhatIf

显示运行该 cmdlet 时会发生什么情况。 cmdlet 未运行。

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WorkspaceName

工作区的名称。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

输入

ISecurityInsightsIdentity

输出

IBookmark