[Sentinel] Upgrade Microsoft Sentinel #5050

necusjz · 2022-06-27T09:16:18Z

Resolves: Azure/azure-cli#21665

Powered by CodeGen v2. Due to current limitation, the following command groups are not generated:

az sentinel entity;
az sentinel watchlist item;

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally?

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
The precondition is to put your code inside this repository and upgrade the version in the pull request but do not modify src/index.json.

yonzhan · 2022-06-27T09:38:57Z

Sentinel

kairu-ms · 2022-06-28T02:02:42Z

src/securityinsight/README.md

+# Azure CLI Securityinsight Extension #
+This is an extension to Azure CLI to manage Securityinsight resources.

-### How to use ###
-Install this extension using the below CLI command
-```
-az extension add --name sentinel
-```
-
-### Included Features ###
-#### sentinel alert-rule ####
-##### Create #####
-```
-az sentinel alert-rule create --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" \
-    --logic-app-resource-id "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts" \
-    --trigger-uri "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature" \
-    --action-id "912bec42-cb66-4c03-ac63-1761b6898c3e" --resource-group "myRg" \
-    --rule-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel alert-rule show --resource-group "myRg" --rule-id "myFirstFusionRule" --workspace-name "myWorkspace"
-```
-##### Show #####
-```
-az sentinel alert-rule show --resource-group "myRg" --rule-id "microsoftSecurityIncidentCreationRuleExample" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel alert-rule show --resource-group "myRg" --rule-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" \
-    --workspace-name "myWorkspace" 
-```
-##### List #####
-```
-az sentinel alert-rule list --resource-group "myRg" --workspace-name "myWorkspace"
-```
-##### Get-action #####
-```
-az sentinel alert-rule get-action --action-id "912bec42-cb66-4c03-ac63-1761b6898c3e" --resource-group "myRg" \
-    --rule-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --workspace-name "myWorkspace" 
-```
-##### Delete #####
-```
-az sentinel alert-rule delete --action-id "912bec42-cb66-4c03-ac63-1761b6898c3e" --resource-group "myRg" \
-    --rule-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --workspace-name "myWorkspace" 
-```
-#### sentinel action ####
-##### List #####
-```
-az sentinel action list --resource-group "myRg" --rule-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" \
-    --workspace-name "myWorkspace" 
-```
-#### sentinel alert-rule-template ####
-##### List #####
-```
-az sentinel alert-rule-template list --resource-group "myRg" --workspace-name "myWorkspace"
-```
-##### Show #####
-```
-az sentinel alert-rule-template show --alert-rule-template-id "65360bb0-8986-4ade-a89d-af3cf44d28aa" \
-    --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-#### sentinel bookmark ####
-##### Create #####
-```
-az sentinel bookmark create --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" --created "2019-01-01T13:15:30Z" \
-    --display-name "My bookmark" --labels "Tag1" --labels "Tag2" --notes "Found a suspicious activity" \
-    --query "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" \
-    --query-result "Security Event query result" --updated "2019-01-01T13:15:30Z" \
-    --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel bookmark show --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### List #####
-```
-az sentinel bookmark list --resource-group "myRg" --workspace-name "myWorkspace"
-```
-##### Delete #####
-```
-az sentinel bookmark delete --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-#### sentinel data-connector ####
-##### Create #####
-```
-az sentinel data-connector create \
-    --office-data-connector etag="\\"0300bf09-0000-0000-0000-5c37296e0000\\"" tenant-id="2070ecc9-b4d5-4ae4-adaa-936fa1954fa8" \
-    --data-connector-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "b96d014d-b5c2-4a01-9aba-a8058f629d42" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "06b3ccb8-1384-4bcc-aec7-852f6d57161b" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "c345bf40-8509-4ed2-b947-50cb773aaf04" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "07e42cb3-e658-4e90-801c-efa0f29d3d44" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "c345bf40-8509-4ed2-b947-50cb773aaf04" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel data-connector show --data-connector-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### List #####
-```
-az sentinel data-connector list --resource-group "myRg" --workspace-name "myWorkspace"
-```
-##### Delete #####
-```
-az sentinel data-connector delete --data-connector-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-#### sentinel incident ####
-##### Create #####
-```
-az sentinel incident create --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" \
-    --description "This is a demo incident" --classification "FalsePositive" \
-    --classification-comment "Not a malicious activity" --classification-reason "IncorrectAlertLogic" \
-    --first-activity-time-utc "2019-01-01T13:00:30Z" --last-activity-time-utc "2019-01-01T13:05:30Z" \
-    --owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" --severity "High" --status "Closed" --title "My incident" \
-    --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel incident show --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### List #####
-```
-az sentinel incident list --orderby "properties/createdTimeUtc desc" --top 1 --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-##### Delete #####
-```
-az sentinel incident delete --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
-#### sentinel incident-comment ####
-##### Create #####
-```
-az sentinel incident-comment create --message "Some message" \
-    --incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" \
-    --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-##### Show #####
-```
-az sentinel incident-comment show --incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" \
-    --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" 
-```
-##### List #####
-```
-az sentinel incident-comment list --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" \
-    --workspace-name "myWorkspace" 
-```
+## How to use ##
+Please add commands usage here.


Please complete this file.

kairu-ms · 2022-06-28T02:04:25Z

src/securityinsight/setup.py

 with open('README.md', 'r', encoding='utf-8') as f:
    README = f.read()
 with open('HISTORY.rst', 'r', encoding='utf-8') as f:
    HISTORY = f.read()

 setup(
-    name='sentinel',


Please don't change the extension name

kairu-ms · 2022-06-28T02:14:51Z

src/securityinsight/azext_securityinsight/azext_metadata.json

@@ -0,0 +1,4 @@
+{
+    "azext.isExperimental": true,
+    "azext.minCliCoreVersion": "2.37.0"


Please wait for the release of "2.38.0"

Suggested change

"azext.minCliCoreVersion": "2.37.0"

"azext.minCliCoreVersion": "2.38.0"

good catch👍

kairu-ms

Please release this extension after azure-cli 2.38.0 is released.

necusjz added 15 commits June 23, 2022 13:46

initial generation

b4a7120

add tests for alert-rule

fe6a1e4

add tests for bookmark

93230fa

add tests for incident

fd9c81e

add tests for incident comment

896ade6

add tests for bookmark relation

dce7292

add tests for incident relation

02a170a

add tests for enrichment

c905f7b

add tests for metadata

eba57b2

add tests for onboarding-state

00e19f2

add tests for automation-rule

70c82f3

add tests for watchlist

4a7ba8e

stage changes

af2f7c9

add tests for threat-indicator

5de29ff

refactoring

bd2d9bf

necusjz added this to the Jun 2022 (2022-07-05) milestone Jun 27, 2022

necusjz requested review from jsntcy and kairu-ms June 27, 2022 09:16

necusjz self-assigned this Jun 27, 2022

ghost added the Auto-Assign Auto assign by bot label Jun 27, 2022

ghost assigned kairu-ms Jun 27, 2022

ghost requested a review from yonzhan June 27, 2022 09:16

ghost added the Code Gen label Jun 27, 2022

add prerequisites

66a537c

kairu-ms reviewed Jun 28, 2022

View reviewed changes

refactoring

8c66c2d

kairu-ms approved these changes Jun 29, 2022

View reviewed changes

upgrade minimal core version

e1468a1

necusjz merged commit 043ac50 into Azure:main Jul 5, 2022

necusjz deleted the feature-sentinel branch July 5, 2022 03:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Sentinel] Upgrade Microsoft Sentinel #5050

[Sentinel] Upgrade Microsoft Sentinel #5050

Uh oh!

necusjz commented Jun 27, 2022 •

edited

Loading

Uh oh!

yonzhan commented Jun 27, 2022

Uh oh!

kairu-ms Jun 28, 2022

Uh oh!

necusjz Jun 28, 2022

Uh oh!

kairu-ms Jun 28, 2022

Uh oh!

kairu-ms Jun 28, 2022 •

edited

Loading

Uh oh!

necusjz Jun 28, 2022

Uh oh!

kairu-ms left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	"azext.minCliCoreVersion": "2.37.0"
	"azext.minCliCoreVersion": "2.38.0"

[Sentinel] Upgrade Microsoft Sentinel #5050

[Sentinel] Upgrade Microsoft Sentinel #5050

Uh oh!

Conversation

necusjz commented Jun 27, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related command

General Guidelines

About Extension Publish

Uh oh!

yonzhan commented Jun 27, 2022

Uh oh!

kairu-ms Jun 28, 2022

Choose a reason for hiding this comment

Uh oh!

necusjz Jun 28, 2022

Choose a reason for hiding this comment

Uh oh!

kairu-ms Jun 28, 2022

Choose a reason for hiding this comment

Uh oh!

kairu-ms Jun 28, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

necusjz Jun 28, 2022

Choose a reason for hiding this comment

Uh oh!

kairu-ms left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

necusjz commented Jun 27, 2022 •

edited

Loading

kairu-ms Jun 28, 2022 •

edited

Loading