Feature Request: Optimise Rule checking in Import-AzSentinelAlertRule

[MathiasVandePol]

Summary of the new feature/enhancement

I want to use this commandlet to import a couple of hundred rules from one workspace to another.

1. Currently the command will iterate accross all rules in an array and do a separate API call for every rule in that array to see if it already exists or not. You could optimise this by providing your own command Get-AzSentinelAlertRule with an array of Rulenames, reducing it to 1 call.

A second optimisation is to not fetch the alertruleaction (playbookname) for that rule if we simply want to know if the rule exists or not.
I see that in a later phase, that fetched playbookname of that alertruleaction is used to verify if a rule has changed playbookname. It might be useful to provide a flag 'UpdatePlaybooks' to either enable or disable this feature as we use separate AlertAction files to enable a certain playbook for a certain customer, meaning that we do not care about playbooks while importing a set of new rules.

        foreach ($item in $analytics) {
            try {
                $content = Get-AzSentinelAlertRule @arguments -RuleName $($item.displayName) -ErrorAction SilentlyContinue
                if ($content) {
                    Write-Output "Rule $($item.displayName) exists in Azure Sentinel"
...
                else {
                    Write-Verbose -Message "Rule $($item.displayName) doesn't exist in Azure Sentinel"
...
                }
            }

[pkhabazi]

hi @MathiasVandePol thanks for the great feedback and sorry for late response! Just updated the import function to first get all the rules instead of in the for each loop. Great performance boost. The second point is an interesting idea, I haven't thought about it before and haven't heard it before from the community. So basically you would like to have a flag for skipping the whole playbook configuration for the rules, is that correct?

[MathiasVandePol]

Thanks for the reply. Yes indeed!