data.json:
{
"displayName": "travel with mailbox permission",
"tactics": [
"InitialAccess",
"PrivilegeEscalation"
],
"techniques": [
"T1078",
"T1548"
]
}
代码:
$content = Get-Content -Raw -Path "data.json" | ConvertFrom-Json
$TacticObject = New-Object System.Collections.Generic.List[System.Object]
foreach ($Tactic in $content.tactics) {
$TacticObject.Add($Tactic)
}
echo$TacticObject
新建AzSentinelAlertRule-ResourceGroupName$ResourceGroupName-WorkspaceName$WorkspaceName-Tactic$TacticObject
输出:
InitialAccess PrivilegeEscalation
错误:
[BadRequest] : Field 'tactics[0]' contains an invalid value 'InitialAccess PrivilegeEscalation'.