Mise à jour detectionRule

PATCH https://graph.microsoft.com/beta/security/rules/detectionRules/office-encoded-powershell
Content-Type: application/json

{
  "status": "disabled",
  "queryCondition": {
    "queryText": "DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'"
  }
}

// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Models.Security;

var requestBody = new DetectionRule
{
	QueryCondition = new QueryCondition
	{
		QueryText = "DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'",
	},
	AdditionalData = new Dictionary<string, object>
	{
		{
			"status" , "disabled"
		},
	},
};

// To initialize your graphClient, see https://dotnet.territoriali.olinfo.it/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Rules.DetectionRules["{detectionRule-id}"].PatchAsync(requestBody);

// Code snippets are only available for the latest major version. Current major version is $v0.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
	  //other-imports
)

requestBody := graphmodelssecurity.NewDetectionRule()
queryCondition := graphmodelssecurity.NewQueryCondition()
queryText := "DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'"
queryCondition.SetQueryText(&queryText) 
requestBody.SetQueryCondition(queryCondition)
additionalData := map[string]interface{}{
	"status" : "disabled", 
}
requestBody.SetAdditionalData(additionalData)

// To initialize your graphClient, see https://dotnet.territoriali.olinfo.it/en-us/graph/sdks/create-client?from=snippets&tabs=go
detectionRules, err := graphClient.Security().Rules().DetectionRules().ByDetectionRuleId("detectionRule-id").Patch(context.Background(), requestBody, nil)

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.beta.models.security.DetectionRule detectionRule = new com.microsoft.graph.beta.models.security.DetectionRule();
com.microsoft.graph.beta.models.security.QueryCondition queryCondition = new com.microsoft.graph.beta.models.security.QueryCondition();
queryCondition.setQueryText("DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'");
detectionRule.setQueryCondition(queryCondition);
HashMap<String, Object> additionalData = new HashMap<String, Object>();
additionalData.put("status", "disabled");
detectionRule.setAdditionalData(additionalData);
com.microsoft.graph.models.security.DetectionRule result = graphClient.security().rules().detectionRules().byDetectionRuleId("{detectionRule-id}").patch(detectionRule);

const options = {
	authProvider,
};

const client = Client.init(options);

const detectionRule = {
  status: 'disabled',
  queryCondition: {
    queryText: 'DeviceProcessEvents | where InitiatingProcessFileName in~ (\'winword.exe\',\'excel.exe\',\'outlook.exe\') | where FileName == \'powershell.exe\' | where ProcessCommandLine has \'-enc\''
  }
};

await client.api('/security/rules/detectionRules/office-encoded-powershell')
	.version('beta')
	.update(detectionRule);

<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Security\DetectionRule;
use Microsoft\Graph\Beta\Generated\Models\Security\QueryCondition;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new DetectionRule();
$queryCondition = new QueryCondition();
$queryCondition->setQueryText('DeviceProcessEvents | where InitiatingProcessFileName in~ (\'winword.exe\',\'excel.exe\',\'outlook.exe\') | where FileName == \'powershell.exe\' | where ProcessCommandLine has \'-enc\'');
$requestBody->setQueryCondition($queryCondition);
$additionalData = [
	'status' => 'disabled',
];
$requestBody->setAdditionalData($additionalData);

$result = $graphServiceClient->security()->rules()->detectionRules()->byDetectionRuleId('detectionRule-id')->patch($requestBody)->wait();

Import-Module Microsoft.Graph.Beta.Security

$params = @{
	status = "disabled"
	queryCondition = @{
		queryText = "DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'"
	}
}

Update-MgBetaSecurityRuleDetectionRule -DetectionRuleId $detectionRuleId -BodyParameter $params

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.security.detection_rule import DetectionRule
from msgraph_beta.generated.models.security.query_condition import QueryCondition
# To initialize your graph_client, see https://dotnet.territoriali.olinfo.it/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = DetectionRule(
	query_condition = QueryCondition(
		query_text = "DeviceProcessEvents | where InitiatingProcessFileName in~ ('winword.exe','excel.exe','outlook.exe') | where FileName == 'powershell.exe' | where ProcessCommandLine has '-enc'",
	),
	additional_data = {
			"status" : "disabled",
	}
)

result = await graph_client.security.rules.detection_rules.by_detection_rule_id('detectionRule-id').patch(request_body)