Blog Post

Microsoft Sentinel Blog
15 MIN READ

Deploying and Managing Microsoft Sentinel as Code

Javier-Soriano's avatar
Javier-Soriano
Icon for Microsoft rankMicrosoft
Jan 28, 2020
  Philippe Zenhaeusern and Javier Soriano co-author this blog post.   This blog post serves as a guideline for implementing Sentinel as Code. You may need to update the scripts for your env...
clipboard_image_1.png
Updated Mar 06, 2025
Version 19.0
microsoft sentinel
security
aabnxtech's avatar
aabnxtech
Copper Contributor
Oct 13, 2021

Javier-Soriano 

I am seeing jobs completed. but nothing getting deployed. i see following warnings

Same happening with analytics rules as well. I created variable group, service connection  and SP has contributor access to resource group. I cannot find this and part. if that is any issue at all.

Some logs are here

 

##[debug]Loading module from path 'C:\Modules\azure_2.1.0\AzureRM.profile\2.1.0\.\Microsoft.Azure.Commands.Profile.dll'.
##[debug]Loading module from path 'C:\Modules\azure_2.1.0\AzureRM.profile\2.1.0\AzureRM.Profile.psm1'.
##[warning]Both Az and AzureRM modules were detected on this machine. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide
##[debug]Processed: ##vso[task.logissue type=warning]Both Az and AzureRM modules were detected on this machine. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide
##[debug]Loading module from path 'C:\Modules\az_6.4.0\Az.Accounts\2.5.3\Microsoft.Azure.PowerShell.Cmdlets.Accounts.dll'.
 
 
021-10-13T21:32:50.7220294Z VERBOSE: DownloadPackage' - name='Az.Accounts', version='2.5.4',destination='C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\Az.Accounts.2.5.4\Az.Accounts.2.5.4.nupkg', uri='https://www.powershellgallery.com/api/v2/package/Az.Accounts/2.5.4'
2021-10-13T21:32:50.7258656Z VERBOSE: Downloading 'https://www.powershellgallery.com/api/v2/package/Az.Accounts/2.5.4'.
2021-10-13T21:32:53.6366682Z VERBOSE: Completed downloading 'https://www.powershellgallery.com/api/v2/package/Az.Accounts/2.5.4'.
2021-10-13T21:32:53.6378830Z VERBOSE: Completed downloading 'Az.Accounts'.
2021-10-13T21:32:53.6669457Z VERBOSE: InstallPackageLocal' - name='Az.Accounts', version='2.5.4',destination='C:\Users\VssAdministrator\AppData\Local\Temp\1052273566'
2021-10-13T21:32:53.9337442Z VERBOSE: InstallPackage' - name='AzSentinel', version='0.6.21',destination='C:\Users\VssAdministrator\AppData\Local\Temp\1052273566'
2021-10-13T21:32:53.9342634Z VERBOSE: DownloadPackage' - name='AzSentinel', version='0.6.21',destination='C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\AzSentinel.0.6.21\AzSentinel.0.6.21.nupkg', uri='https://www.powershellgallery.com/api/v2/package/AzSentinel/0.6.21'
2021-10-13T21:32:53.9347267Z VERBOSE: Downloading 'https://www.powershellgallery.com/api/v2/package/AzSentinel/0.6.21'.
2021-10-13T21:32:55.9526874Z VERBOSE: Completed downloading 'https://www.powershellgallery.com/api/v2/package/AzSentinel/0.6.21'.
2021-10-13T21:32:55.9535801Z VERBOSE: Completed downloading 'AzSentinel'.
2021-10-13T21:32:55.9544121Z VERBOSE: InstallPackageLocal' - name='AzSentinel', version='0.6.21',destination='C:\Users\VssAdministrator\AppData\Local\Temp\1052273566'
2021-10-13T21:32:56.0483390Z VERBOSE: Validating the 'Az.Accounts' module contents under 'C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\Az.Accounts.2.5.4' path.
2021-10-13T21:33:02.8021912Z VERBOSE: Test-ModuleManifest successfully validated the module manifest file 'C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\Az.Accounts.2.5.4'.
2021-10-13T21:33:02.8033366Z VERBOSE: Validating the authenticode signature and publisher of the catalog file or module manifest file of the module 'Az.Accounts'.
2021-10-13T21:33:05.0357196Z VERBOSE: Catalog file 'Az.Accounts.cat' is not found in the contents of the module 'Az.Accounts' being installed.
2021-10-13T21:33:05.0732394Z VERBOSE: Valid authenticode signature found in the file 'Az.Accounts.psd1' for the module 'Az.Accounts'.
2021-10-13T21:33:05.3820844Z VERBOSE: For publisher validation, current module 'Az.Accounts' with version '2.5.4' with publisher name 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' from root certificate authority 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'. Is this module signed by Microsoft: 'True'.
2021-10-13T21:33:05.3842742Z VERBOSE: For publisher validation, using the previously-installed module 'Az.Accounts' with version '2.5.3' under 'C:\Modules\az_6.4.0\Az.Accounts\2.5.3' with publisher name 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' from root certificate authority 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'. Is this module signed by Microsoft: 'True'.
2021-10-13T21:33:05.3879889Z VERBOSE: Authenticode issuer 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' of the new module 'Az.Accounts' with version '2.5.4' matches with the authenticode issuer 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' of the previously-installed module 'Az.Accounts' with version '2.5.3'.
2021-10-13T21:33:05.3891858Z VERBOSE: Checking for possible command collisions for the module 'Az.Accounts' commands.
2021-10-13T21:33:16.5989673Z VERBOSE: Installing the dependency module 'Az.Accounts' with version '2.5.4' for the module 'AzSentinel'.
2021-10-13T21:33:16.7228824Z VERBOSE: Module 'Az.Accounts' was installed successfully to path 'C:\Users\VssAdministrator\Documents\PowerShell\Modules\Az.Accounts\2.5.4'.
2021-10-13T21:33:16.7539221Z VERBOSE: Validating the 'AzSentinel' module contents under 'C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\AzSentinel.0.6.21' path.
2021-10-13T21:33:16.9022535Z VERBOSE: Test-ModuleManifest successfully validated the module manifest file 'C:\Users\VssAdministrator\AppData\Local\Temp\1052273566\AzSentinel.0.6.21'.
2021-10-13T21:33:16.9026018Z VERBOSE: Validating the authenticode signature and publisher of the catalog file or module manifest file of the module 'AzSentinel'.
2021-10-13T21:33:16.9171882Z VERBOSE: Catalog file 'AzSentinel.cat' is not found in the contents of the module 'AzSentinel' being installed.
2021-10-13T21:33:16.9736258Z VERBOSE: Checking for possible command collisions for the module 'AzSentinel' commands.
2021-10-13T21:33:17.9455824Z Install-Package: C:\program files\powershell\7\Modules\PowerShellGet\PSModule.psm1:9711
2021-10-13T21:33:17.9456606Z Line |
2021-10-13T21:33:17.9462275Z 9711 |  … talledPackages = PackageManagement\Install-Package @PSBoundParameters
2021-10-13T21:33:17.9463117Z      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2021-10-13T21:33:17.9463611Z      | The following commands are already available on this
2021-10-13T21:33:17.9464746Z      | system:'Get-AzSentinelAlertRule,Get-AzSentinelAlertRuleAction,Get-AzSentinelDataConnector,Get-AzSentinelIncident,New-AzSentinelAlertRule,New-AzSentinelAlertRuleAction,Remove-AzSentinelAlertRule,Remove-AzSentinelAlertRuleAction,Update-AzSentinelIncident'. This module 'AzSentinel' may override the existing commands. If you still want to install this module 'AzSentinel', use -AllowClobber parameter.
2021-10-13T21:33:17.9465592Z 
2021-10-13T21:33:17.9959454Z ##[debug]Exit code: 1
2021-10-13T21:33:17.9985000Z ##[debug]Leaving Invoke-VstsTool.
2021-10-13T21:33:18.0017074Z ##[debug]Importing function 'CmdletHasMember'.
2021-10-13T21:33:18.0021781Z ##[debug]Importing function 'Disconnect-AzureAndClearContext'.
2021-10-13T21:33:18.0035079Z ##[debug]Importing function 'Initialize-AzModule'.
2021-10-13T21:33:18.0048176Z ##[debug]Importing function 'Initialize-Azure'.
2021-10-13T21:33:18.0062422Z ##[debug]Importing function 'Initialize-AzureRMModule'.
2021-10-13T21:33:18.0075130Z ##[debug]Importing function 'Remove-EndpointSecrets'.
2021-10-13T21:33:18.0089580Z ##[debug]Importing function 'Update-PSModulePathForHostedAgentWithLatestModule'.
2021-10-13T21:33:18.0160126Z ##[debug]Trying to disconnect from Azure and clear context at process scope
2021-10-13T21:33:18.0213104Z ##[debug]Cannot verify the Microsoft .NET Framework version 4.7.2 because it is not included in the list of permitted versions.
2021-10-13T21:33:18.0232529Z ##[debug]Populating RepositorySourceLocation property for module Az.Accounts.
2021-10-13T21:33:18.0250583Z ##[debug]Loading module from path 'C:\Modules\az_6.4.0\Az.Accounts\2.5.3\Az.Accounts.psm1'.
2021-10-13T21:33:18.2527047Z ##[debug]Unable to disconnect and clear context: A parameter cannot be found that matches parameter name 'and'.
2021-10-13T21:33:18.2536170Z ##[warning]A parameter cannot be found that matches parameter name 'and'.
2021-10-13T21:33:18.2538305Z ##[debug]Processed: ##vso[task.logissue type=warning;]A parameter cannot be found that matches parameter name 'and'.
2021-10-13T21:33:18.2542936Z ## Script Execution Complete
2021-10-13T21:33:18.2941177Z ##[section]Finishing: Create and Update Alert Rules
2021-10-13T21:33:18.2969107Z ##[debug]Evaluating condition for step: 'Checkout secops-sentinel@main to s'
2021-10-13T21:33:18.2971300Z ##[debug]Evaluating: AlwaysNode()
2021-10-13T21:33:18.2971799Z ##[debug]Evaluating AlwaysNode:
2021-10-13T21:33:18.2973205Z ##[debug]=> True
2021-10-13T21:33:18.2973802Z ##[debug]Result: True
2021-10-13T21:33:18.2974451Z ##[section]Starting: Checkout secops@main to s
2021-10-13T21:33:18.3072792Z ==============================================================================
2021-10-13T21:33:18.3073141Z Task         : Get sources
2021-10-13T21:33:18.3073416Z Description  : Get sources from a repository. Supports Git, TfsVC, and SVN repositories.
2021-10-13T21:33:18.3073718Z Version      : 1.0.0
2021-10-13T21:33:18.3073884Z Author       : Microsoft
2021-10-13T21:33:18.3074190Z Help         : [More Information](https://go.microsoft.com/fwlink/?LinkId=798199)
2021-10-13T21:33:18.3074595Z ==============================================================================
2021-10-13T21:33:18.6180557Z Cleaning any cached credential from repository: secops-sentinel (Git)
2021-10-13T21:33:18.6194233Z ##[debug]Repository url=https://xxxxxxx/_git/secops
2021-10-13T21:33:18.6195798Z ##[debug]targetPath=D:\a\1\s
2021-10-13T21:33:18.6268418Z ##[section]Finishing: Checkout secops@main to s
2021-10-13T21:33:18.6323209Z ##[section]Starting: Finalize Job
2021-10-13T21:33:18.6352585Z Cleaning up task key
2021-10-13T21:33:18.6354054Z Start cleaning up orphan processes.
2021-10-13T21:33:18.6421070Z ##[section]Finishing: Finalize Job
2021-10-13T21:33:18.6469095Z ##[debug]Starting diagnostic file upload.
2021-10-13T21:33:18.6469382Z ##[debug]Setting up diagnostic log folders.
2021-10-13T21:33:18.6472238Z ##[debug]Creating diagnostic log files folder.
2021-10-13T21:33:18.6473150Z ##[debug]Creating diagnostic log environment file.
2021-10-13T21:33:18.9244615Z ##[debug]Creating capabilities file.
2021-10-13T21:33:18.9271115Z ##[debug]Copying 1 worker diag logs.
2021-10-13T21:33:18.9299196Z ##[debug]Copying 1 agent diag logs.
2021-10-13T21:33:18.9302153Z ##[debug]Zipping diagnostic files.
2021-10-13T21:33:18.9333772Z ##[debug]Uploading diagnostic metadata file.
2021-10-13T21:33:18.9376654Z ##[debug]Diagnostic file upload complete.
2021-10-13T21:33:18.9409042Z ##[section]Finishing: AgentJob