Deploying and Managing Microsoft Sentinel as Code

alexlimabh

Copper Contributor

Apr 07, 2020

Hi Javier-Soriano,

Thank you for the tip.

When I execute the script manually everything working.

However, after change the session workbookSourceId in json to use variables as you can see below:

"workbookSourceId": {

"type": "string",

"defaultValue": "/subscriptions/${SubscriptionId}/resourcegroups/${ResourceGroup}/providers/microsoft.operationalinsights/workspaces/${Workspace}",

"metadata": {

"description": "The id of resource instance to which the workbook will be associated"

}

The pipeline was execute with success and the logs looks like good, but the workbook wasn't created.

PS: I removed the subscriptionId manually.

2020-04-07T13:01:59.7495956Z Folder is: D:\a\1/Workbooks
2020-04-07T13:01:59.7536587Z Files are:  D:\a\1\Workbooks\securityalert.json
2020-04-07T13:02:18.5001829Z 
2020-04-07T13:02:18.5019374Z DeploymentName          : securityalert
2020-04-07T13:02:18.5037233Z ResourceGroupName       : ***
2020-04-07T13:02:18.5057194Z ProvisioningState       : Succeeded
2020-04-07T13:02:18.5082536Z Timestamp               : 4/7/2020 1:02:17 PM
2020-04-07T13:02:18.5116416Z Mode                    : Incremental
2020-04-07T13:02:18.5117206Z TemplateLink            : 
2020-04-07T13:02:18.5135246Z Parameters              : 
2020-04-07T13:02:18.5153321Z                           Name                   Type                       Value     
2020-04-07T13:02:18.5205181Z                           =====================  =========================  ==========
2020-04-07T13:02:18.5219399Z                           workbookDisplayName    String                     Azure Activity
2020-04-07T13:02:18.5236614Z                           workbookType           String                     sentinel  
2020-04-07T13:02:18.5255757Z                           workbookSourceId       String                     /subscriptions/$SubscriptionId/resourcegrou
2020-04-07T13:02:18.5276810Z                           ps/$ResourceGroup/providers/microsoft.operationalinsights/workspaces/$Workspace
2020-04-07T13:02:18.5297694Z                           workbookId             String                     202bf405-ea37-4056-8a92-7727de4dc790
2020-04-07T13:02:18.5318274Z                           
2020-04-07T13:02:18.5332367Z Outputs                 : 
2020-04-07T13:02:18.5353029Z                           Name             Type                       Value     
2020-04-07T13:02:18.5372683Z                           ===============  =========================  ==========
2020-04-07T13:02:18.5391000Z                           workbookId       String                     /subscriptions/XXXXXX-XXX-XXXX-XXX-XX
2020-04-07T13:02:18.5410061Z                           /resourceGroups/***/providers/microsoft.insights/workbooks/202bf405-ea37-4056-8a
2020-04-07T13:02:18.5444302Z                           92-7727de4dc790
2020-04-07T13:02:18.5446523Z                           
2020-04-07T13:02:18.5457200Z DeploymentDebugLogLevel :

If I hard coded everything (SubscriptionId, WorkSpace, ResourceGroups) I can deploy without any issue.

Any clue to fix it?

Blog Post

Deploying and Managing Microsoft Sentinel as Code