Link to home
Start Free TrialLog in
Avatar of Kelly Garcia
Kelly GarciaFlag for United Kingdom of Great Britain and Northern Ireland

asked on

ExtendedProperties in Get-AzSecurityAlerted into Variable in PowerShell

When i run the command get-azsecurityalert, i get the following result:

Id                 : /subscriptions/4b06/resourceGroups/GUD01/prov
                     iders/Microsoft.Security/locations/centralus/alerts/256470605332_2de8ba64-8ec8-47-8ce0-00
                     4f77588f3f
Name               : 4777-8ce0-00488f3f
ActionTaken        : Undefined
AlertDisplayName   : Azure Security Center test alert (not a threat)
AlertName          : SCUBA_RULE_ASC_EICAR
AssociatedResource : /subscriptions/6e6ab4b06/resourceGroups/CCLOUD01/prov
                     iders/Microsoft.Compute/virtualMachines/azrapp007
CanBeInvestigated  : True
CompromisedEntity  : RAPP007
ConfidenceReasons  : {}
ConfidenceScore    :
Description        : This is a test alert generated by Azure Security Center. No further action is needed.
DetectedTimeUtc    : 25/09/2019 10:42:32
Entities           : {Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlertEntity,
                     Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlertEntity,
                     Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlertEntity,
                     Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlertEntity...}
ExtendedProperties : {[compromised Host, AZRAPP007], [user Name, Kloud\KellyGarcia], [account
                     Session Id, 0x13ce9cc], [suspicious Process,
                     c:\users\Kelly.Garcia\desktop\asc_alerttest_662jfi039n.exe]...}
InstanceId         : 2de8ba64-8ec8-4777-8ce0-004f77588f3f
RemediationSteps   : No further action is needed.
ReportedSeverity   : High
ReportedTimeUtc    : 25/09/2019 10:43:11
State              : Active
SubscriptionId     : d7644790-4c1a-4a7c-8817-df76e6ab4b06
SystemSource       : Azure
VendorName         : Microsoft
WorkspaceArmId     : /subscriptions/b68d365f314ad67/resourcegroups/rg-dev-loganalytics001/provider
                     s/microsoft.operationalinsights/workspaces/godevopsla001

i need the process name in a varialble which is under extended properties:

ExtendedProperties : {[compromised Host, RAPP007], [user Name, Kloud\KellyGarcia], [account
                     Session Id, 0x13ce9cc], [suspicious Process,
                     c:\users\Kelly.Garcia\desktop\asc_alerttest_662jfi039n.exe]...}

the gm for extended properties return me the following result:

   TypeName: Selected.Microsoft.Azure.Commands.Security.Models.Alerts.PSSecurityAlert

Name               MemberType   Definition
----               ----------   ----------
Equals             Method       bool Equals(System.Object obj)
GetHashCode        Method       int GetHashCode()
GetType            Method       type GetType()
ToString           Method       string ToString()
ExtendedProperties NoteProperty Dictionary[string,Object] ExtendedProperties=System.Collections.Generic.Dictionary`2...

how do i do this?
ASKER CERTIFIED SOLUTION
Avatar of footech
footech
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial