public static async Task ProcessSentinelIncidentsAsync()
{
var sentinelIncidentService = new AzureSentinelIncidentService();
var incidents = await sentinelIncidentService.GetIncidentsAsync(IncidentStatus.New, 20, _Workspace);
foreach (var incident in incidents)
{
var stringEnumConverter = new System.Text.Json.Serialization.JsonStringEnumConverter();
var options = new JsonSerializerOptions
{
PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
};
options.Converters.Add(stringEnumConverter);
var json = JsonSerializer.Serialize <SentinelIncident>(incident, options);
await _EventHubService.PublishMessageAsync(json);
// update the incident status.
incident.Properties.Status = IncidentStatus.Active;
await sentinelIncidentService.UpdateIncidentAsync(incident, incident.Name, _Workspace);
System.Console.WriteLine(String.Format("Incidentnr {0} is forwared to eventhub", incident.Properties.IncidentNumber));
}
}
public JsonSerializerOptions GetJsonSerializerOptions()
{
var stringEnumConverter = new System.Text.Json.Serialization.JsonStringEnumConverter();
var options = new JsonSerializerOptions
{
PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
};
options.Converters.Add(stringEnumConverter);
return(options);
}
