diff --git a/AzSentinel/Classes/ScheduledAlertProp.ps1 b/AzSentinel/Classes/ScheduledAlertProp.ps1 index c5f4176..c9af247 100644 --- a/AzSentinel/Classes/ScheduledAlertProp.ps1 +++ b/AzSentinel/Classes/ScheduledAlertProp.ps1 @@ -92,10 +92,12 @@ class ScheduledAlertProp { } $this.SuppressionEnabled = if ($suppressionEnabled) { $suppressionEnabled } else { $false } $this.Tactics = $Tactics - $this.PlaybookName = if ($PlaybookName.Split('/').count -gt 1){ - $PlaybookName.Split('/')[-1] - } else { - $PlaybookName + if ($PlaybookName) { + $this.PlaybookName = if ($PlaybookName.Split('/').count -gt 1){ + $PlaybookName.Split('/')[-1] + } else { + $PlaybookName + } } $this.IncidentConfiguration = $IncidentConfiguration $this.eventGroupingSettings = @{ diff --git a/AzSentinel/Public/New-AzSentinelAlertRule.ps1 b/AzSentinel/Public/New-AzSentinelAlertRule.ps1 index ddccbaa..2722514 100644 --- a/AzSentinel/Public/New-AzSentinelAlertRule.ps1 +++ b/AzSentinel/Public/New-AzSentinelAlertRule.ps1 @@ -126,7 +126,7 @@ function New-AzSentinelAlertRule { [string[]]$Tactics, [Parameter(Mandatory = $false)] - [string[]]$PlaybookName = $null, + [string[]]$PlaybookName = '', [Parameter(Mandatory = $false)] [bool]$CreateIncident, @@ -195,7 +195,7 @@ function New-AzSentinelAlertRule { Write-Error $_.Exception.Message break } - + if ($content) { Write-Verbose -Message "Rule $($DisplayName) exists in Azure Sentinel" @@ -271,12 +271,12 @@ function New-AzSentinelAlertRule { if (($compareResult | Where-Object PropertyName -eq "playbookName").DiffValue) { foreach ($playbook in ($body.Properties.PlaybookName)) { - New-AzSentinelAlertRuleAction @arguments -PlayBookName $playbook -RuleId $($body.Properties.Name) -confirm:$false + $PlaybookResult = New-AzSentinelAlertRuleAction @arguments -PlayBookName $playbook -RuleId $($body.Properties.Name) -confirm:$false $body.Properties | Add-Member -NotePropertyName PlaybookStatus -NotePropertyValue $PlaybookResult -Force } } elseif (($compareResult | Where-Object PropertyName -eq "playbookName").RefValue) { - Remove-AzSentinelAlertRuleAction @arguments -RuleId $($body.Name) -Confirm:$false + $PlaybookResult = Remove-AzSentinelAlertRuleAction @arguments -RuleId $($body.Name) -Confirm:$false $body.Properties | Add-Member -NotePropertyName PlaybookStatus -NotePropertyValue $PlaybookResult -Force } else {