I'm trying to deploy sentinel alerts into sentinel using azure runbook by using the below command:
Import-AzSentinelAlertRule -WorkspaceName "xxx" -SettingsFile "test_alert.json"
The SettingsFile of this command expects a path of json as parameter. How we can pass the json file to runbook?
Can anyone please suggest me out ?
CodePudding user response:
How we can pass the json file to runbook?
I have reproduced in my environment and I followed Microsoft-Document and I got expected results as below:
Param(
[parameter(Mandatory=$true)]
[object]$json
)
$json = $json | ConvertFrom-Json
Then save and publish runbook.
Then open your local windows PowerShell and follow below steps:
Step1:
Connect-AzAccount
Step2:
$json = (Get-content -path "C:Downloads\xy.json") | Out-string
Step3:
$RBParams = @{
AutomationAccountName = 'rithwikrunning'
ResourceGroupName = 'XX'
Name = 'xy'
Parameters = $JsonParams
}
XX- Name of the resource Group xy- Name of the runbook
Step4:
$job = Start-AzAutomationRunbook @RBParams
Now the json file is passed to run book and it got started:
Now the content of the file or file is in $json variable in runbook.
References: