-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
New module for Security insights (Azure Sentinel) Resource Provider (#…
…13607) * v1 * Actions, AlertRules * Bookmarks... start incident comments * more updates * Incident Comments * major updates * fixes * more fixes * GetAlertRuleTemplates updates * Update Az.SecurityInsights.psd1 * v1 tests * tests..... * Revert "tests....." This reverts commit 4dddc6c. * Revert "Revert "tests....."" This reverts commit 7904f59. * test v2 * tests complete... starting bug fixes * bugs * Update NewBookmarks.cs Removed redundant "}" * bugs * Update NewBookmarks.cs Fixed curly bracket * updates * updates after testing * bugs.... * fix input object * Added tests for input objects * Generate Help * added examples to help files based on build failure * add online link to help files * Bug Fixes fixes for help and static analysis * Moved Set- Commands to Update- * bug fix to help docs * Updates per feedback #13607 (comment) * Update Dns.sln * Update Media.sln * Update Media.sln * Update Media.sln * Fixes per comments * remove dependacy on logic app module * Add exceptions for static analysis * Update SignatureIssues.csv * Update SignatureIssues.csv * Update SignatureIssues.csv Co-authored-by: Tiander Turpijn <[email protected]> Co-authored-by: Yunchi Wang <[email protected]>
- Loading branch information
1 parent
a97d1d2
commit def340e
Showing
164 changed files
with
21,653 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
src/SecurityInsights/SecurityInsights.Test/Properties/AssemblyInfo.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
// ---------------------------------------------------------------------------------- | ||
// | ||
// Copyright Microsoft Corporation | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
// ---------------------------------------------------------------------------------- | ||
|
||
using System.Reflection; | ||
using System.Runtime.CompilerServices; | ||
using System.Runtime.InteropServices; | ||
using Xunit; | ||
|
||
// General Information about an assembly is controlled through the following | ||
// set of attributes. Change these attribute values to modify the information | ||
// associated with an assembly. | ||
[assembly: AssemblyTitle("Commands.SecurityInsights.Test")] | ||
[assembly: AssemblyDescription("")] | ||
[assembly: AssemblyConfiguration("")] | ||
[assembly: AssemblyCompany("")] | ||
[assembly: AssemblyProduct("Commands.SecurityInsights.Test")] | ||
[assembly: AssemblyCopyright("Copyright © 2018")] | ||
[assembly: AssemblyTrademark("")] | ||
[assembly: AssemblyCulture("")] | ||
|
||
// Setting ComVisible to false makes the types in this assembly not visible | ||
// to COM components. If you need to access a type in this assembly from | ||
// COM, set the ComVisible attribute to true on that type. | ||
[assembly: ComVisible(false)] | ||
|
||
// The following GUID is for the ID of the typelib if this project is exposed to COM | ||
[assembly: Guid("CA24A45A-9D2D-4BBD-9F71-EF5599ADAD96")] | ||
|
||
// Version information for an assembly consists of the following four values: | ||
// | ||
// Major Version | ||
// Minor Version | ||
// Build Number | ||
// Revision | ||
// | ||
// You can specify all the values or you can default the Build and Revision Numbers | ||
// by using the '*' as shown below: | ||
// [assembly: AssemblyVersion("1.0.*")] | ||
[assembly: AssemblyVersion("1.0.0.0")] | ||
[assembly: AssemblyFileVersion("1.0.0.0")] | ||
[assembly: CollectionBehavior(DisableTestParallelization = true)] |
68 changes: 68 additions & 0 deletions
68
src/SecurityInsights/SecurityInsights.Test/ScenarioTests/ActionsTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,68 @@ | ||
// ---------------------------------------------------------------------------------- | ||
// | ||
// Copyright Microsoft Corporation | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
// ---------------------------------------------------------------------------------- | ||
|
||
using Microsoft.Azure.Commands.ScenarioTest; | ||
using Microsoft.Azure.ServiceManagement.Common.Models; | ||
using Microsoft.WindowsAzure.Commands.ScenarioTest; | ||
using Xunit; | ||
|
||
namespace Microsoft.Azure.Commands.SecurityInsights.Test.ScenarioTests | ||
{ | ||
public class ActionsTests | ||
{ | ||
private readonly XunitTracingInterceptor _logger; | ||
|
||
public ActionsTests(Xunit.Abstractions.ITestOutputHelper output) | ||
{ | ||
_logger = new XunitTracingInterceptor(output); | ||
XunitTracingInterceptor.AddToContext(_logger); | ||
TestExecutionHelpers.SetUpSessionAndProfile(); | ||
} | ||
|
||
[Fact] | ||
[Trait(Category.AcceptanceType, Category.CheckIn)] | ||
public void ListByAlertRule() | ||
{ | ||
TestController.NewInstance.RunPowerShellTest(_logger, "Get-AzSentinelAlertRuleAction-ListByAlertRule"); | ||
} | ||
|
||
[Fact] | ||
[Trait(Category.AcceptanceType, Category.CheckIn)] | ||
public void GetAction() | ||
{ | ||
TestController.NewInstance.RunPowerShellTest(_logger, "Get-AzSentinelAlertRuleAction-GetAction"); | ||
} | ||
|
||
[Fact] | ||
[Trait(Category.AcceptanceType, Category.CheckIn)] | ||
public void CreateAction() | ||
{ | ||
TestController.NewInstance.RunPowerShellTest(_logger, "New-AzSentinelAlertRuleAction-Create"); | ||
} | ||
|
||
[Fact] | ||
[Trait(Category.AcceptanceType, Category.CheckIn)] | ||
public void UpdateAction() | ||
{ | ||
TestController.NewInstance.RunPowerShellTest(_logger, "Update-AzSentinelAlertRuleAction-Update"); | ||
} | ||
|
||
[Fact] | ||
[Trait(Category.AcceptanceType, Category.CheckIn)] | ||
public void RemoveAction() | ||
{ | ||
TestController.NewInstance.RunPowerShellTest(_logger, "Remove-AzSentinelAlertRuleAction-Delete"); | ||
} | ||
} | ||
} |
170 changes: 170 additions & 0 deletions
170
src/SecurityInsights/SecurityInsights.Test/ScenarioTests/ActionsTests.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,170 @@ | ||
# ---------------------------------------------------------------------------------- | ||
# | ||
# Copyright Microsoft Corporation | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# http://www.apache.org/licenses/LICENSE-2.0 | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
# ---------------------------------------------------------------------------------- | ||
|
||
<# | ||
.SYNOPSIS | ||
List Actions by Alert Rule | ||
#> | ||
function Get-AzSentinelAlertRuleAction-ListByAlertRule | ||
{ | ||
$AlertRuleId = "1b64dc0e-4bf6-43c4-a503-52cba30b5c47" | ||
$ActionId = "cd9f21e2-1718-4b8b-871e-b8d59c65f317" | ||
$ActionId2 = "ccef9243-4f96-4ec5-8042-9df44e2df452" | ||
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" | ||
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E" | ||
$LogicAppResourceId2 = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage" | ||
$TriggerUri2 = "https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo" | ||
|
||
#Create Alert Rule | ||
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10 | ||
#Create Alert Rule Action | ||
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId $ActionId -AlertRuleId ($alertRule.Name) -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri | ||
#Create Alert Rule Action | ||
$action2 = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId $ActionId2 -AlertRuleId ($alertRule.Name) -LogicAppResourceId $LogicAppResourceId2 -TriggerUri $TriggerUri2 | ||
|
||
#Get Alert Rule Actions | ||
$actions = Get-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
# Validate | ||
Validate-Actions $actions | ||
|
||
#Cleanup | ||
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Get Action | ||
#> | ||
function Get-AzSentinelAlertRuleAction-GetAction | ||
{ | ||
$AlertRuleId = "77def5f7-ab37-4aaf-8711-904d1ab55787" | ||
$ActionId = "27dda575-93f0-4925-92b3-039ef4d89cad" | ||
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" | ||
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E" | ||
|
||
#Create Alert Rule | ||
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10 | ||
#Create Alert Rule Action | ||
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri | ||
|
||
#Get Alert Rule Action | ||
$action = Get-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId ($action.Name) | ||
# Validate | ||
Validate-Action $action | ||
|
||
#Cleanup | ||
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Create Action | ||
#> | ||
function New-AzSentinelAlertRuleAction-Create | ||
{ | ||
$AlertRuleId = "26501c9d-8f07-419d-8bcb-f9aac8ec1a7f" | ||
$ActionId = "10d54e5f-8c03-42fc-b1d9-1bd881535af0" | ||
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" | ||
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E" | ||
|
||
#Create Alert Rule | ||
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10 | ||
#Create Alert Rule Action | ||
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri | ||
|
||
#Validate | ||
Validate-Action $action | ||
|
||
#Cleanup | ||
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Update Action | ||
#> | ||
function Update-AzSentinelAlertRuleAction-Update | ||
{ | ||
$AlertRuleId = "1584e7a3-802c-435b-9178-5720a44be2f3" | ||
$ActionId = "91c2ea2f-f40c-4bef-ab3b-43c09e4a9699" | ||
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" | ||
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E" | ||
$LogicAppResourceId2 = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Get-MDATPInvestigationPackage" | ||
$TriggerUri2 = "https://prod-16.westus.logic.azure.com:443/workflows/18c75599cf3742c998d14af0f89cf3b1/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=rREdJWoN3PNCmhqwMz0KRy8apQDt8DQbZZuvlm1l4Oo" | ||
|
||
#Create Alert Rule | ||
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10 | ||
#Create Alert Rule Action | ||
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri | ||
|
||
#update action | ||
$action = Update-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId ($action.Name) -LogicAppResourceId $LogicAppResourceId2 -TriggerUri $TriggerUri2 | ||
|
||
# Validate | ||
Validate-Action $action | ||
|
||
#Cleanup | ||
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Delete Action | ||
#> | ||
function Remove-AzSentinelAlertRuleAction-Delete | ||
{ | ||
$AlertRuleId = "d1ae0250-f1d8-4cd2-9806-e2375dd7c4ae" | ||
$ActionId = "4044b6d3-de80-4c37-81f2-46d96dfdd78b" | ||
$LogicAppResourceId = "/subscriptions/1c61ccbf-70b3-45a3-a1fb-848ce46d70a6/resourceGroups/ndicola-azsposh/providers/Microsoft.Logic/workflows/Block-AADUser" | ||
$TriggerUri = "https://prod-13.westus.logic.azure.com:443/workflows/826a95b1b84c4ffbaf3af3dd88fe96b5/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2018-07-01-preview&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=pK23xWl4uJT4RWs7zopxiP0Z7CpIfCDZEanL-mEyy1E" | ||
|
||
#Create Alert Rule | ||
$alertRule = New-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId $AlertRuleId -Scheduled -Enabled -DisplayName "PoshModuleTest" -Severity Low -Query "SecurityAlert | take 1" -QueryFrequency (New-TimeSpan -Hours 5) -QueryPeriod (New-TimeSpan -Hours 5) -TriggerThreshold 10 | ||
#Create Alert Rule Action | ||
$action = New-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) -ActionId $ActionId -LogicAppResourceId $LogicAppResourceId -TriggerUri $TriggerUri | ||
#delete | ||
Remove-AzSentinelAlertRuleAction -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -ActionId ($action.Name) -AlertRuleId ($alertRule.Name) | ||
# Validate | ||
Validate-Action $action | ||
|
||
#Cleanup | ||
Remove-AzSentinelAlertRule -ResourceGroupName (Get-TestResourceGroupName) -WorkspaceName (Get-TestWorkspaceName) -AlertRuleId ($alertRule.Name) | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Validates a list of actions | ||
#> | ||
function Validate-Actions | ||
{ | ||
param($actions) | ||
|
||
Assert-True { $actions.Count -gt 0 } | ||
|
||
Foreach($action in $actions) | ||
{ | ||
Validate-Action $action | ||
} | ||
} | ||
|
||
<# | ||
.SYNOPSIS | ||
Validates a single action | ||
#> | ||
function Validate-Action | ||
{ | ||
param($action) | ||
|
||
Assert-NotNull $action | ||
} |
Oops, something went wrong.