pkhabazi/azsentinel-library

In this Repo you can find all the scheduled and hunting rules in the correct format for AzSentinel

Hi there 👋

My name is Pouyan Khabazi, I work on Azure Cloud & Security Solutions

Here are some cool stuff to know about me:

• 🔭 I’m currently working on building a fully automated engine for deploying and managing Microsoft Sentinel
• 🌱 I’m currently learning how to implement micro services model with PowerShell instead of one huge code base. Also on how to build a new company :D
• 👯 I’m looking to collaborate on Microsoft Sentinel automation projects
• 🤔 I’m looking for help with maintaining AzSentinel
• 💬 Ask me about PowerShell, Azure, Azure DevOps and Microsoft Sentinel
• 📫 How to reach me: twitter, LinkedIn, blog
• 😄 Pronouns: EindBaziiii
• ⚡ Fun fact: not today my friend

azsentinel-library's Issues

Template import is not processing the rules

Dear Sir Khabazi,

We appreciate your efforts dearly for making this export available, but the current Template file is not able to be processed.

Would you be so kind to fix this? We would greatly appreciate it if you will. Many Thanks in Advance

It's regarding the Templates_192401_03112020.json

`
PS /home/> wget https://raw.githubusercontent.com/pkhabazi/AzSentinel-library/master/Templates/Templates_192401_03112020.json
--2020-12-04 12:41:10-- https://raw.githubusercontent.com/pkhabazi/AzSentinel-library/master/Templates/Templates_192401_03112020.json
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.36.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.36.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 64695736 (62M) [text/plain]
Saving to: ‘Templates_192401_03112020.json’

Templates_192401_03112020.json 100%[========================================================================================================================================>] 61.70M 172MB/s in 0.4s

2020-12-04 12:41:10 (172 MB/s) - ‘Templates_192401_03112020.json’ saved [64695736/64695736]

PS /home/> Import-AzSentinelAlertRule -SubscriptionId "XXXX-XXXX-XXXXXXX-XXXXX" -WorkspaceName "SOMEWorkspace" -SettingsFile "./Templates_192401_03112020.json"

Import-AzSentinelAlertRule: Unable to initiate class with error: You cannot call a method on a null-valued expression.
`

Yours truly,