Public/Get-CustomDetectionIdByDescriptionTag.ps1
|
function Get-CustomDetectionIdByDescriptionTag { <# .SYNOPSIS Gets the detection rule ID by its description tag UUID. .DESCRIPTION Looks up the detection rule ID for a given UUID that was embedded in the alert description as a tag (e.g. "[UUID]" or "[PREFIX:UUID]"). This function leverages the cached output of Get-CustomDetectionIds. .PARAMETER DescriptionTag The UUID to search for in description tags. .EXAMPLE Get-CustomDetectionIdByDescriptionTag -DescriptionTag "81fb771a-c57e-41b8-9905-63dbf267c13f" Returns the detection rule ID for the rule whose description contains the specified UUID tag. .NOTES Requires the Microsoft.Graph.Authentication module and an active Graph API session. Use Connect-MgGraph before calling this function. #> [CmdletBinding()] [OutputType([string])] param ( [Parameter(Mandatory, ValueFromPipeline)] [ValidateNotNullOrEmpty()] [string]$DescriptionTag ) begin { Assert-MgGraphConnection } process { try { # Leverage the cached detection IDs list $detectionIds = Get-CustomDetectionIds $ruleId = Get-CustomDetectionTaggedId -Rule @($detectionIds) -DescriptionTag $DescriptionTag if ($ruleId) { return $ruleId } Write-Warning "No detection rule found with description tag: $DescriptionTag" return $null } catch { Write-Error "Error querying Microsoft Graph API: $($_.Exception.Message)" throw } } } |