data.json:
{ "displayName": "travel with mailbox permission", "tactics": [ "InitialAccess", "PrivilegeEscalation" ], "techniques": [ "T1078", "T1548" ] }
代码:
$content = Get-Content -Raw -Path "data.json" | ConvertFrom-Json $TacticObject = New-Object System.Collections.Generic.List[System.Object] foreach ($Tactic in $content.tactics) { $TacticObject.Add($Tactic) }
echo$TacticObject
新建AzSentinelAlertRule-ResourceGroupName$ResourceGroupName-WorkspaceName$WorkspaceName-Tactic$TacticObject
输出:
InitialAccess PrivilegeEscalation
错误:
[BadRequest] : Field 'tactics[0]' contains an invalid value 'InitialAccess PrivilegeEscalation'.