question

ChrisSmith-6811 avatar image
0 Votes"
ChrisSmith-6811 asked ChrisSmith-6811 edited

Alert rule entity mapping via API no longer available?

We had been leveraging the REST API to create alert rules and specifically defining the entity mapping via properties.entitymappings within the request body which had been working fine but we noticed recently that this is no longer working. There's no error, but the entitymappings are seemingly being discarded. If the mappings are specified in the query, those still show up. I noticed the documentation doesn't make any mention of entitymappings anymore and GET requests for alert rules also no longer show that information so is this something that was expected to be removed? If so, is there any other way to handle entity mappings via API or is it strictly via defining mappings in the query code?

Thank you!

azure-sentinel
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@ChrisSmith-6811 Thanks for reaching out and apologies for delay on this.
This is still valid for 2019-01-01-preview and 2020-01-01 stable API versions, are you still facing the same issue ?

0 Votes 0 ·

Thanks for your response @vipulsparsh-MSFT! We switched to using 2021-03-01-preview which has allowed us to again target the entities correctly. We had previously been targeting 2020-01-01 which was no longer accepting (or displaying) any entity changes.

0 Votes 0 ·

0 Answers