Forum Discussion
john66571
Mar 13, 2025Brass Contributor
Update content package Metadata
Hello Sentinel community and Microsoft. Ive been working on a script where i use this command: https://learn.microsoft.com/en-us/rest/api/securityinsights/content-package/install?view=rest-security...
john66571
Mar 13, 2025Brass Contributor
I cant edit the post above. But i tried a few different versions to mimic the GUI "install" and i notice just now that the rest api for installing content packages ONLY installs the content package (not its content, such as hunting rules, analytic rules, etc etc, which is automatically installed when u select the package in the GUI). Im going back to the drawingboard (perhaps its not working as intended).
_________________
edit2:
It does look like an API limitation. Despite the documentation implying that installing a content package should also provision all of its nested content (templates, analytic rules, workbooks, etc. via Install template https://learn.microsoft.com/en-us/rest/api/securityinsights/content-template/install?view=rest-securityinsights-2024-09-01&tabs=HTTP), but you are not allowed to list all content hub packages - only install/uninstall (which in it self meens you have to had installed them once, list them once, extract the name and then use in your script). you can only list/get once they are already installed. So you have no way to list the templates or id's for those to request installation of them, unless already installed?
it feels like listing content hub packages AND their content from the content hub without installing first is a vital part to get this to work - that is missing.