Skip to content

Commit

Permalink
New module for Security insights (Azure Sentinel) Resource Provider (#…
Browse files Browse the repository at this point in the history
…13607)

* v1

* Actions, AlertRules

* Bookmarks... start incident comments

* more updates

* Incident Comments

* major updates

* fixes

* more fixes

* GetAlertRuleTemplates updates

* Update Az.SecurityInsights.psd1

* v1 tests

* tests.....

* Revert "tests....."

This reverts commit 4dddc6c.

* Revert "Revert "tests.....""

This reverts commit 7904f59.

* test v2

* tests complete... starting bug fixes

* bugs

* Update NewBookmarks.cs

Removed redundant "}"

* bugs

* Update NewBookmarks.cs

Fixed curly bracket

* updates

* updates after testing

* bugs....

* fix input object

* Added tests for input objects

* Generate Help

* added examples to help files based on build failure

* add online link to help files

* Bug Fixes

fixes for help and static analysis

* Moved Set- Commands to Update-

* bug fix to help docs

* Updates per feedback

#13607 (comment)

* Update Dns.sln

* Update Media.sln

* Update Media.sln

* Update Media.sln

* Fixes per comments

* remove dependacy on logic app module

* Add exceptions for static  analysis

* Update SignatureIssues.csv

* Update SignatureIssues.csv

* Update SignatureIssues.csv

Co-authored-by: Tiander Turpijn <[email protected]>
Co-authored-by: Yunchi Wang <[email protected]>
  • Loading branch information
3 people authored Dec 14, 2020
1 parent a97d1d2 commit def340e
Show file tree
Hide file tree
Showing 164 changed files with 21,653 additions and 0 deletions.
3 changes: 3 additions & 0 deletions documentation/azure-powershell-modules.md
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@ Resource Mover | `Az.ResourceMover`
Resources | `Az.Resources` | [![Resources]][ResourcesGallery]
Search | `Az.Search` | [![Search]][SearchGallery]
Security | `Az.Security` | [![Security]][SecurityGallery]
Sentinel (SecurityInsights) | `Az.SecurityInsights` | [![SecurityInsights]][SecurityInsightsGallery]
Service Bus | `Az.ServiceBus` | [![ServiceBus]][ServiceBusGallery]
Service Fabric | `Az.ServiceFabric` | [![ServiceFabric]][ServiceFabricGallery]
SignalR | `Az.SignalR` | [![SignalR]][SignalRGallery]
Expand Down Expand Up @@ -218,6 +219,7 @@ Windows Iot Services | `Az.WindowsIotServices`
[Resources]: https://img.shields.io/powershellgallery/v/Az.Resources.svg?style=flat-square&label=Az.Resources
[Search]: https://img.shields.io/powershellgallery/v/Az.Search.svg?style=flat-square&label=Az.Search
[Security]: https://img.shields.io/powershellgallery/v/Az.Security.svg?style=flat-square&label=Az.Security
[SecurityInsights]: https://img.shields.io/powershellgallery/v/Az.SecurityInsights.svg?style=flat-square&label=Az.SecurityInsights
[ServiceBus]: https://img.shields.io/powershellgallery/v/Az.ServiceBus.svg?style=flat-square&label=Az.ServiceBus
[ServiceFabric]: https://img.shields.io/powershellgallery/v/Az.ServiceFabric.svg?style=flat-square&label=Az.ServiceFabric
[SignalR]: https://img.shields.io/powershellgallery/v/Az.SignalR.svg?style=flat-square&label=Az.SignalR
Expand Down Expand Up @@ -332,6 +334,7 @@ Windows Iot Services | `Az.WindowsIotServices`
[ResourcesGallery]: https://www.powershellgallery.com/packages/Az.Resources/
[SearchGallery]: https://www.powershellgallery.com/packages/Az.Search/
[SecurityGallery]: https://www.powershellgallery.com/packages/Az.Security/
[SecurityInsightsGallery]: https://www.powershellgallery.com/packages/Az.SecurityInsights/
[ServiceBusGallery]: https://www.powershellgallery.com/packages/Az.ServiceBus/
[ServiceFabricGallery]: https://www.powershellgallery.com/packages/Az.ServiceFabric/
[SignalRGallery]: https://www.powershellgallery.com/packages/Az.SignalR/
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
// ----------------------------------------------------------------------------------
//
// Copyright Microsoft Corporation
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// http://www.apache.org/licenses/LICENSE-2.0
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ----------------------------------------------------------------------------------

using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using Xunit;

// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("Commands.SecurityInsights.Test")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("Commands.SecurityInsights.Test")]
[assembly: AssemblyCopyright("Copyright © 2018")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]

// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]

// The following GUID is for the ID of the typelib if this project is exposed to COM
[assembly: Guid("CA24A45A-9D2D-4BBD-9F71-EF5599ADAD96")]

// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: CollectionBehavior(DisableTestParallelization = true)]
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
// ----------------------------------------------------------------------------------
//
// Copyright Microsoft Corporation
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// http://www.apache.org/licenses/LICENSE-2.0
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ----------------------------------------------------------------------------------

using Microsoft.Azure.Commands.ScenarioTest;
using Microsoft.Azure.ServiceManagement.Common.Models;
using Microsoft.WindowsAzure.Commands.ScenarioTest;
using Xunit;

namespace Microsoft.Azure.Commands.SecurityInsights.Test.ScenarioTests
{
public class ActionsTests
{
private readonly XunitTracingInterceptor _logger;

public ActionsTests(Xunit.Abstractions.ITestOutputHelper output)
{
_logger = new XunitTracingInterceptor(output);
XunitTracingInterceptor.AddToContext(_logger);
TestExecutionHelpers.SetUpSessionAndProfile();
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void ListByAlertRule()
{
TestController.NewInstance.RunPowerShellTest(_logger, "Get-AzSentinelAlertRuleAction-ListByAlertRule");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void GetAction()
{
TestController.NewInstance.RunPowerShellTest(_logger, "Get-AzSentinelAlertRuleAction-GetAction");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void CreateAction()
{
TestController.NewInstance.RunPowerShellTest(_logger, "New-AzSentinelAlertRuleAction-Create");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void UpdateAction()
{
TestController.NewInstance.RunPowerShellTest(_logger, "Update-AzSentinelAlertRuleAction-Update");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RemoveAction()
{
TestController.NewInstance.RunPowerShellTest(_logger, "Remove-AzSentinelAlertRuleAction-Delete");
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,170 @@
# ----------------------------------------------------------------------------------
#
# Copyright Microsoft Corporation
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ----------------------------------------------------------------------------------

<#
.SYNOPSIS
List Actions by Alert Rule
#>
function Get-AzSentinelAlertRuleAction-ListByAlertRule
{
$AlertRuleId = "1b64dc0e-4bf6-43c4-a503-52cba30b5c47"
$ActionId = "cd9f21e2-1718-4b8b-871e-b8d59c65f317"
$ActionId2 = "ccef9243-4f96-4ec5-8042-9df44e2df452"
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
$LogicAppResourceId2 = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
$TriggerUri2 = "https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo"

#Create Alert Rule
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10
#Create Alert Rule Action
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId $ActionId -AlertRuleId ($alertRule.Name) -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri
#Create Alert Rule Action
$action2 = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId $ActionId2 -AlertRuleId ($alertRule.Name) -LogicAppResourceId $LogicAppResourceId2 -TriggerUri $TriggerUri2

#Get Alert Rule Actions
$actions = Get-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
# Validate
Validate-Actions $actions

#Cleanup
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
}

<#
.SYNOPSIS
Get Action
#>
function Get-AzSentinelAlertRuleAction-GetAction
{
$AlertRuleId = "77def5f7-ab37-4aaf-8711-904d1ab55787"
$ActionId = "27dda575-93f0-4925-92b3-039ef4d89cad"
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"

#Create Alert Rule
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10
#Create Alert Rule Action
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri

#Get Alert Rule Action
$action = Get-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId ($action.Name)
# Validate
Validate-Action $action

#Cleanup
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
}

<#
.SYNOPSIS
Create Action
#>
function New-AzSentinelAlertRuleAction-Create
{
$AlertRuleId = "26501c9d-8f07-419d-8bcb-f9aac8ec1a7f"
$ActionId = "10d54e5f-8c03-42fc-b1d9-1bd881535af0"
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"

#Create Alert Rule
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10
#Create Alert Rule Action
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri

#Validate
Validate-Action $action

#Cleanup
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
}

<#
.SYNOPSIS
Update Action
#>
function Update-AzSentinelAlertRuleAction-Update
{
$AlertRuleId = "1584e7a3-802c-435b-9178-5720a44be2f3"
$ActionId = "91c2ea2f-f40c-4bef-ab3b-43c09e4a9699"
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"
$LogicAppResourceId2 = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage"
$TriggerUri2 = "https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo"

#Create Alert Rule
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10
#Create Alert Rule Action
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri

#update action
$action = Update-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId ($action.Name) -LogicAppResourceId $LogicAppResourceId2 -TriggerUri $TriggerUri2

# Validate
Validate-Action $action

#Cleanup
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
}

<#
.SYNOPSIS
Delete Action
#>
function Remove-AzSentinelAlertRuleAction-Delete
{
$AlertRuleId = "d1ae0250-f1d8-4cd2-9806-e2375dd7c4ae"
$ActionId = "4044b6d3-de80-4c37-81f2-46d96dfdd78b"
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser"
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E"

#Create Alert Rule
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10
#Create Alert Rule Action
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri
#delete
Remove-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId ($action.Name) -AlertRuleId ($alertRule.Name)
# Validate
Validate-Action $action

#Cleanup
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name)
}

<#
.SYNOPSIS
Validates a list of actions
#>
function Validate-Actions
{
param($actions)

Assert-True { $actions.Count -gt 0 }

Foreach($action in $actions)
{
Validate-Action $action
}
}

<#
.SYNOPSIS
Validates a single action
#>
function Validate-Action
{
param($action)

Assert-NotNull $action
}
Loading

0 comments on commit def340e

Please sign in to comment.