Blog Post

Microsoft Sentinel Blog
15 MIN READ

Deploying and Managing Microsoft Sentinel as Code

Javier-Soriano's avatar
Javier-Soriano
Icon for Microsoft rankMicrosoft
Jan 28, 2020
  Philippe Zenhaeusern and Javier Soriano co-author this blog post.   This blog post serves as a guideline for implementing Sentinel as Code. You may need to update the scripts for your env...
clipboard_image_1.png
Updated Mar 06, 2025
Version 19.0
microsoft sentinel
security
aabnxtech's avatar
aabnxtech
Copper Contributor
Oct 14, 2021

Javier-Soriano  i can see playbooks getting deployed. but analytics rules or hunting rules are not. i keep getting same message of missing parameters in both cases

 

  1. Starting: Create and Update Alert Rules
    ==============================================================================
    Task : Azure PowerShell
    Description : Run a PowerShell script within an Azure environment
    Version : 4.185.0
    Author : Microsoft Corporation
    Help : https://aka.ms/azurepowershelltroubleshooting
    ==============================================================================
    ## Validating Inputs
    ## Validating Inputs Complete
    ## Initializing Az module
    Import-Module -Name C:\Modules\az_6.4.0\Az.Accounts\2.5.3\Az.Accounts.psd1 -Global
    ##[warning]Both Az and AzureRM modules were detected on this machine. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide
    Clear-AzContext -Scope CurrentUser -Force -ErrorAction SilentlyContinue
    Clear-AzContext -Scope Process
    Connect-AzAccount -ServicePrincipal -Tenant *** -Credential System.Management.Automation.PSCredential -Environment AzureCloud @processScope
    Set-AzContext -SubscriptionId xxxxxxxxxxxxxxxxxxx -TenantId ***
    ## Az module initialization Complete
    ## Beginning Script Execution
    Generating script.
    ========================== Starting Command Output ===========================
    "C:\Program Files\PowerShell\7\pwsh.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\a\_temp\d63227d4-d187-49c2-8d50-5426ca35994b.ps1'"
    Install-Package: C:\program files\powershell\7\Modules\PowerShellGet\PSModule.psm1:9711
    Line |
    9711 | … talledPackages = PackageManagement\Install-Package @PSBoundParameters
    | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    | The following commands are already available on this
    | system:'Get-AzSentinelAlertRule,Get-AzSentinelAlertRuleAction,Get-AzSentinelDataConnector,Get-AzSentinelIncident,New-AzSentinelAlertRule,New-AzSentinelAlertRuleAction,Remove-AzSentinelAlertRule,Remove-AzSentinelAlertRuleAction,Update-AzSentinelIncident'. This module 'AzSentinel' may override the existing commands. If you still want to install this module 'AzSentinel', use -AllowClobber parameter.
     
    ##[warning]A parameter cannot be found that matches parameter name 'and'.
    ## Script Execution Complete
    Finishing: Create and Update Alert Rules