Avatar of Kelly Garcia
Kelly Garcia
Flag for United Kingdom of Great Britain and Northern Ireland asked on

Change JSON field using PowerShell Core

I have following JSON file and i need update the displayName to contain either QA or Production :

{
    "analytics": [
      {
        "kind": "Scheduled",
        "displayName": "RO-0024-DEV GPO Scheduled Task",
        "description": "test",
        "severity": "Low",
        "enabled": true,
        "query":"SecurityEvent | where EventID == \"5145\"  | where AccountType == \"User\"",
        "queryFrequency": "5H",
        "queryPeriod": "6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 5,
        "suppressionDuration": "6H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "LateralMovement",
          "Collection"
        ],
        "PlayBookName": "Test447"

      }
    ]  
}

Open in new window


i am running a powershell script via Azure Devops build agent and depending on the Tennant, i want to change the DisplayName that contains Dev to QA or Prod.

i have tried the following for testing however it fails:

$rules = Get-Content -Raw -Path .\TestJson.json | ConvertFrom-Json
$rules.analytics.displayname = "test"

Open in new window


i get the following error:

The property 'displayname' cannot be found on this object. Verify that the property exists and can be set.
At line:1 char:1
+ $rules.analytics.displayname = "test"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : PropertyAssignmentException

Open in new window


Thank you in advance.

Regards,
Kelly
PowershellQuality AssuranceJSONAzure

Avatar of undefined
Last Comment
oBdA

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
oBdA

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Kelly Garcia

ASKER
thank you every so much !
Kelly Garcia

ASKER
i have one more issue now, i need to change the displayname and i've just attempted the following:

(($rules.analytics[0].displayName).Split(" ").split("-")[2]).replace("$_", "Qa")

Open in new window


however i get the following error:



Exception calling "Replace" with "2" argument(s): "String cannot be of zero length.
Parameter name: oldValue"
At line:1 char:1
+ (($rules.analytics[0].displayName).Split(" ").split("-")[2]).replace( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentException


also is there better way of writing this code? please let me know if i should raise this as a seperate question?

thanks again,
Kelly
oBdA

Use a Regex:
$type = 'Qa'
$rules.analytics[0].displayName = $rules.analytics[0].displayName -replace '^(.*?-.*?-)(.*?)(\s.*)$', "`$1$($type)`$3"

Open in new window

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23