diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 838624b..8dc100f 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -12,7 +12,7 @@ "nonFreePackages": "true" }, "ghcr.io/natescherer/devcontainers-custom-features/powershell-resources:1": { - "resources": "powershell-yaml,Pester,PSScriptAnalyzer" //https://github.com/natescherer/devcontainers-custom-features/blob/main/src/powershell-resources/README.md + "resources": "powershell-yaml,Pester,PSScriptAnalyzer,AZ" //https://github.com/natescherer/devcontainers-custom-features/blob/main/src/powershell-resources/README.md } }, "postStartCommand": "mkdir /root/.config/powershell && echo 'Import-Module -Name ./src/AzWorkspaceManager.psd1' > /root/.config/powershell/Microsoft.PowerShell_profile.ps1", @@ -23,15 +23,18 @@ "vscode": { // Set *default* container specific settings.json values on container create. "settings": { - "terminal.integrated.defaultProfile.linux": "pwsh" + "terminal.integrated.shell.linux": "/opt/microsoft/powershell/7/pwsh" }, // Add the IDs of extensions you want installed when the container is created. "extensions": [ - "ms-vscode.powershell", - "Gruntfuggly.todo-tree", - "TylerLeonhardt.vscode-inline-values-powershell" - ] + "ms-vscode.powershell", + "Gruntfuggly.todo-tree", + "TylerLeonhardt.vscode-inline-values-powershell", + "GitHub.copilot", + "DavidAnson.vscode-markdownlint", + "eamodio.gitlens" + ] } } diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..a0a3934 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,3 @@ +{ + "todo-tree.tree.showBadges": true +} \ No newline at end of file diff --git a/LICENSE b/LICENSE index 034e948..242bc2c 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2022 Visorian GmbH +Copyright (c) 2022 Rogier Dijkman Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index a68f72b..ea3346b 100644 --- a/README.md +++ b/README.md @@ -3,8 +3,8 @@ [![SecureHats](https://img.shields.io/badge/Open_Threat_Research-Community-brightgreen.svg)](https://twitter.com/dijkmanrogier) [![Maintenance](https://img.shields.io/maintenance/yes/2023.svg?style=flat-square)]() [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)
-[![Good First Issues](https://img.shields.io/github/issues/securehats/toolbox/good%20first%20issue?color=important&label=good%20first%20issue&style=flat)](https://github.com/securehats/toolbox/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) -[![Needs Feedback](https://img.shields.io/github/issues/securehats/toolbox/needs%20feedback?color=blue&label=needs%20feedback%20&style=flat)](https://github.com/securehats/toolbox/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+feedback%22) +[![Good First Issues](https://img.shields.io/github/issues/securehats/AzWorkspaceManager/good%20first%20issue?color=important&label=good%20first%20issue&style=flat)](https://github.com/securehats/AzWorkspaceManager/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) +[![Needs Feedback](https://img.shields.io/github/issues/securehats/AzWorkspaceManager/needs%20feedback?color=blue&label=needs%20feedback%20&style=flat)](https://github.com/securehats/AzWorkspaceManager/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+feedback%22) # Az Workspace Manager @@ -25,6 +25,6 @@ inline `code-example` ## Not happy? -If you encounter any issues, or hae suggestions for improvements, feel free to open an Issue +If you encounter any issues, or have suggestions for improvements, feel free to open an Issue [Create Issue](../../issues/new/choose) diff --git a/docs/en-US/Add-AzWorkspaceManagerAssignmentJobs.md b/docs/en-US/Add-AzWorkspaceManagerAssignmentJobs.md new file mode 100644 index 0000000..20b8ba2 --- /dev/null +++ b/docs/en-US/Add-AzWorkspaceManagerAssignmentJobs.md @@ -0,0 +1,117 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Add-AzWorkspaceManagerAssignmentJobs + +## SYNOPSIS +Adds a Microsoft Sentinel Workspace Manager Assignment Job + +## SYNTAX + +``` +Add-AzWorkspaceManagerAssignmentJobs [-WorkspaceName] [[-ResourceGroupName] ] + [[-Name] ] [[-ResourceId] ] [] +``` + +## DESCRIPTION +The Add-AzWorkspaceManagerAssignmentJobs command adds a Workspace Manager Assignment Job to the workspace. +By default the name of the Workspace Manager Assignment is the same as the Workspace Manager Group. + +## EXAMPLES + +### EXAMPLE 1 +``` +Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' +``` + +This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' with the name 'MyWorkspaceManagerAssignment' + +### EXAMPLE 2 +``` +Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' +``` + +This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' in the resourcegroup 'MyResourceGroup' with the name 'MyWorkspaceManagerAssignment' + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' | Add-AzWorkspaceManagerAssignmentJobs +``` + +This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' for each Workspace Manager Assignment found + +## PARAMETERS + +### -WorkspaceName +The name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager assignment. +This is the same as the Workspace Manager GroupName unless specified otherwise + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ResourceId +{{ Fill ResourceId Description }} + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES diff --git a/docs/en-US/Add-AzWorkspaceManagerAssignments.md b/docs/en-US/Add-AzWorkspaceManagerAssignments.md new file mode 100644 index 0000000..9ca821d --- /dev/null +++ b/docs/en-US/Add-AzWorkspaceManagerAssignments.md @@ -0,0 +1,137 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Add-AzWorkspaceManagerAssignments + +## SYNOPSIS +Adds a Microsoft Sentinel Workspace Manager Assignment + +## SYNTAX + +``` +Add-AzWorkspaceManagerAssignments [-WorkspaceName] [[-ResourceGroupName] ] + [-GroupName] [[-Name] ] [[-ResourceId] ] [] +``` + +## DESCRIPTION +The Add-AzWorkspaceManagerAssignments command adds a Workspace Manager Assignment to a Workspace Manager Group. +These assignments are used to provision Microsoft Sentinel workspaces. +The Workspace Manager Assignment name is constructed by the GroupName. +The resource id's of the items that are added to the assignment are stored in the properties of the assignment. +These resources need to be in the same instance as the workspace manager configuration. +If the resource id's are not in the same instance as the workspace manager configuration, the assignment will not be created and an error will be thrown. + +## EXAMPLES + +### EXAMPLE 1 +``` +Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' +``` + +This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup'. + +### EXAMPLE 2 +``` +Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' -ResourceId "/subscriptions/***/resourceGroups/dev-sentinel/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/95204744-39a6-4510-8505-ef13549bc0da" +``` + +This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup' and adds the alert rule to the assignment. + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerItems -WorkspaceName "myWorkspace" -Type "AlertRules" | Add-AzWorkspaceManagerAssignments -GroupName 'myGroup' +``` + +This example gets all the alert rules from the workspace with the name 'myWorkspace' and adds these to the Workspace Manager Assignment with the name 'AlertRules'. + +## PARAMETERS + +### -WorkspaceName +The name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -GroupName +The name of the workspace manager group + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager assignment + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ResourceId +The ResourceId's of the items that to be added to the Workspace Manager Assignment. +This can be a single value or an array of values. + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 5 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + diff --git a/docs/en-US/Add-AzWorkspaceManagerGroups.md b/docs/en-US/Add-AzWorkspaceManagerGroups.md new file mode 100644 index 0000000..5b776f9 --- /dev/null +++ b/docs/en-US/Add-AzWorkspaceManagerGroups.md @@ -0,0 +1,145 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Add-AzWorkspaceManagerGroups + +## SYNOPSIS +Add a Microsoft Sentinel Workspace Manager Group. + +## SYNTAX + +``` +Add-AzWorkspaceManagerGroups [-WorkspaceName] [[-ResourceGroupName] ] [-Name] + [[-Description] ] [[-workspaceManagerMembers] ] [[-ResourceId] ] [] +``` + +## DESCRIPTION +The Add-AzWorkspaceManagerGroups cmdlet adds a workspace manager group to the configuration. +It is possible to add child workspaces to the group or add them later. +For adding child +workspaces, use the Add-AzWorkspaceManagerMembers cmdlet. + +## EXAMPLES + +### EXAMPLE 1 +``` +Add-AzWorkspaceManagerGroups -WorkspaceName "myWorkspace" -Name "Banks" -workspaceManagerMembers 'myChildWorkspace(***)' +``` + +This example adds a Workspace Manager Group 'Banks' to the workspace and adds a child workspace to the group. + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Add-AzWorkspaceManagerGroups -Name "Banks" +``` + +This example adds a Workspace Manager Group 'Banks' to the workspace and adds all child workspaces to the group using the pipeline. + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager group. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Description +The description of the workspace manager group. +If not specified, the name will be used. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -workspaceManagerMembers +The workspace manager members to add to the group. +The members are workspaces that are linked to the workspace manager configuration. +and used to provision Microsoft Sentinel workspaces. + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 5 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ResourceId +{{ Fill ResourceId Description }} + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 6 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + diff --git a/docs/en-US/Add-AzWorkspaceManagerMembers.md b/docs/en-US/Add-AzWorkspaceManagerMembers.md new file mode 100644 index 0000000..420aee3 --- /dev/null +++ b/docs/en-US/Add-AzWorkspaceManagerMembers.md @@ -0,0 +1,116 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Add-AzWorkspaceManagerMembers + +## SYNOPSIS +Add a Microsoft Sentinel Workspace Manager Member + +## SYNTAX + +``` +Add-AzWorkspaceManagerMembers [-WorkspaceName] [[-ResourceGroupName] ] [-ResourceId] + [-TenantId] [] +``` + +## DESCRIPTION +The Add-AzWorkspaceManagerMembers cmdlet adds a workspace manager member to the configuration. +These members are workspaces that are linked to the workspace manager configuration. +and used to +provision Microsoft Sentinel workspaces. +The Workspace Manager Member name is constructed as follows: \(\) + +## EXAMPLES + +### EXAMPLE 1 +``` +Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace" -TenantId "***" +``` + +This example adds a Workspace Manager Member for the workspace with the name 'myWorkspace' and adds the workspace with the name 'myChildWorkspace' as a member. + +### EXAMPLE 2 +``` +$resourceIds = @("/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace", "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myOtherWorkspace") +``` + +PS \> Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId $resourceIds -TenantId "***" + +This example adds a multiple Members from from an array into the workspace manager with the name 'myWorkspace' + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceId +The ResourceId of the target workspace to add as a member + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: True +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -TenantId +The TenantId of the target workspace to add as a member + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 4 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES +The Workspace Manager Member name is constructed as follows: \(\) + diff --git a/docs/en-US/AzWorkspaceManager-help.xml b/docs/en-US/AzWorkspaceManager-help.xml new file mode 100644 index 0000000..92d6dd3 --- /dev/null +++ b/docs/en-US/AzWorkspaceManager-help.xml @@ -0,0 +1,2580 @@ + + + + + Add-AzWorkspaceManagerAssignmentJobs + Add + AzWorkspaceManagerAssignmentJobs + + Adds a Microsoft Sentinel Workspace Manager Assignment Job + + + + The Add-AzWorkspaceManagerAssignmentJobs command adds a Workspace Manager Assignment Job to the workspace. By default the name of the Workspace Manager Assignment is the same as the Workspace Manager Group. + + + + Add-AzWorkspaceManagerAssignmentJobs + + WorkspaceName + + The name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment. This is the same as the Workspace Manager GroupName unless specified otherwise + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + + + + WorkspaceName + + The name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment. This is the same as the Workspace Manager GroupName unless specified otherwise + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' with the name 'MyWorkspaceManagerAssignment' + + + + -------------------------- EXAMPLE 2 -------------------------- + Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' in the resourcegroup 'MyResourceGroup' with the name 'MyWorkspaceManagerAssignment' + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' | Add-AzWorkspaceManagerAssignmentJobs + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' for each Workspace Manager Assignment found + + + + + + + + Add-AzWorkspaceManagerAssignments + Add + AzWorkspaceManagerAssignments + + Adds a Microsoft Sentinel Workspace Manager Assignment + + + + The Add-AzWorkspaceManagerAssignments command adds a Workspace Manager Assignment to a Workspace Manager Group. These assignments are used to provision Microsoft Sentinel workspaces. The Workspace Manager Assignment name is constructed by the GroupName. The resource id's of the items that are added to the assignment are stored in the properties of the assignment. These resources need to be in the same instance as the workspace manager configuration. If the resource id's are not in the same instance as the workspace manager configuration, the assignment will not be created and an error will be thrown. + + + + Add-AzWorkspaceManagerAssignments + + WorkspaceName + + The name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + GroupName + + The name of the workspace manager group + + String + + String + + + None + + + Name + + The name of the workspace manager assignment + + Array + + Array + + + None + + + ResourceId + + The ResourceId's of the items that to be added to the Workspace Manager Assignment. This can be a single value or an array of values. + + Array + + Array + + + None + + + + + + WorkspaceName + + The name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + GroupName + + The name of the workspace manager group + + String + + String + + + None + + + Name + + The name of the workspace manager assignment + + Array + + Array + + + None + + + ResourceId + + The ResourceId's of the items that to be added to the Workspace Manager Assignment. This can be a single value or an array of values. + + Array + + Array + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' + + This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup'. + + + + -------------------------- EXAMPLE 2 -------------------------- + Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' -ResourceId "/subscriptions/***/resourceGroups/dev-sentinel/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/95204744-39a6-4510-8505-ef13549bc0da" + + This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup' and adds the alert rule to the assignment. + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerItems -WorkspaceName "myWorkspace" -Type "AlertRules" | Add-AzWorkspaceManagerAssignments -GroupName 'myGroup' + + This example gets all the alert rules from the workspace with the name 'myWorkspace' and adds these to the Workspace Manager Assignment with the name 'AlertRules'. + + + + + + + + Add-AzWorkspaceManagerGroups + Add + AzWorkspaceManagerGroups + + Add a Microsoft Sentinel Workspace Manager Group. + + + + The Add-AzWorkspaceManagerGroups cmdlet adds a workspace manager group to the configuration. It is possible to add child workspaces to the group or add them later. For adding child workspaces, use the Add-AzWorkspaceManagerMembers cmdlet. + + + + Add-AzWorkspaceManagerGroups + + WorkspaceName + + The Name of the log analytics workspace. + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located. + + String + + String + + + None + + + Name + + The name of the workspace manager group. + + String + + String + + + None + + + Description + + The description of the workspace manager group. If not specified, the name will be used. + + String + + String + + + None + + + workspaceManagerMembers + + The workspace manager members to add to the group. The members are workspaces that are linked to the workspace manager configuration. and used to provision Microsoft Sentinel workspaces. + + Array + + Array + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + + + + WorkspaceName + + The Name of the log analytics workspace. + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located. + + String + + String + + + None + + + Name + + The name of the workspace manager group. + + String + + String + + + None + + + Description + + The description of the workspace manager group. If not specified, the name will be used. + + String + + String + + + None + + + workspaceManagerMembers + + The workspace manager members to add to the group. The members are workspaces that are linked to the workspace manager configuration. and used to provision Microsoft Sentinel workspaces. + + Array + + Array + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Add-AzWorkspaceManagerGroups -WorkspaceName "myWorkspace" -Name "Banks" -workspaceManagerMembers 'myChildWorkspace(***)' + + This example adds a Workspace Manager Group 'Banks' to the workspace and adds a child workspace to the group. + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Add-AzWorkspaceManagerGroups -Name "Banks" + + This example adds a Workspace Manager Group 'Banks' to the workspace and adds all child workspaces to the group using the pipeline. + + + + + + + + Add-AzWorkspaceManagerMembers + Add + AzWorkspaceManagerMembers + + Add a Microsoft Sentinel Workspace Manager Member + + + + The Add-AzWorkspaceManagerMembers cmdlet adds a workspace manager member to the configuration. These members are workspaces that are linked to the workspace manager configuration. and used to provision Microsoft Sentinel workspaces. The Workspace Manager Member name is constructed as follows: <workspaceName>(<subscriptionId>) + + + + Add-AzWorkspaceManagerMembers + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + ResourceId + + The ResourceId of the target workspace to add as a member + + Array + + Array + + + None + + + TenantId + + The TenantId of the target workspace to add as a member + + String + + String + + + None + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + ResourceId + + The ResourceId of the target workspace to add as a member + + Array + + Array + + + None + + + TenantId + + The TenantId of the target workspace to add as a member + + String + + String + + + None + + + + + + + The Workspace Manager Member name is constructed as follows: <workspaceName>(<subscriptionId>) + + + + + -------------------------- EXAMPLE 1 -------------------------- + Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace" -TenantId "***" + + This example adds a Workspace Manager Member for the workspace with the name 'myWorkspace' and adds the workspace with the name 'myChildWorkspace' as a member. + + + + -------------------------- EXAMPLE 2 -------------------------- + $resourceIds = @("/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace", "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myOtherWorkspace") + + PS > Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId $resourceIds -TenantId " * " + This example adds a multiple Members from from an array into the workspace manager with the name 'myWorkspace' + + + + + + + + Get-AzWorkspaceManager + Get + AzWorkspaceManager + + Gets the Microsoft Sentinel Workspace Manager + + + + The Get-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration from the Log Analytics workspace. You can retrieve the workspace manager configuration by using just provding a workspacename. Only one workspace manager configuration can be added per Microsoft Sentinel instance + + + + Get-AzWorkspaceManager + + Name + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + + + + Name + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Get-AzWorkspaceManager -Name 'myWorkspace' + + This command gets the workspace manager for the workspace 'myWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' + + This command gets the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. + + + + + + + + Get-AzWorkspaceManagerAssignmentJobs + Get + AzWorkspaceManagerAssignmentJobs + + Get the Microsoft Sentinel Workspace Manager Groups + + + + The Get-AzWorkspaceManagerAssignmentJobs cmdlet gets the Microsoft Sentinel Workspace Manager Assignment Jobs It can be used to get all the Workspace Manager Assignment Jobs or a specific Workspace Manager Assignment Job by specifying the JobName. + + + + Get-AzWorkspaceManagerAssignmentJobs + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + + String + + String + + + None + + + JobName + + The name of the Workspace Manager Assignment Job + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + String + + String + + + None + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + + String + + String + + + None + + + JobName + + The name of the Workspace Manager Assignment Job + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + String + + String + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + + + + + + + + + + + Get-AzWorkspaceManagerAssignments + Get + AzWorkspaceManagerAssignments + + Get the Microsoft Sentinel Workspace Manager Groups + + + + The Get-AzWorkspaceManagerAssignments cmdlet gets the Microsoft Sentinel Workspace Manager Assignments by just specifying the workspace name When the workspace manager configuration is not 'Enabled' for the workspace, the cmdlet will return an information message If a Name is specified, the cmdlet will return the details of the workspace manager assignment + + + + Get-AzWorkspaceManagerAssignments + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment + + String + + String + + + None + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager assignment + + String + + String + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' + + This example gets all the Microsoft Sentinel Workspace Manager Assignments for the workspace 'MyWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' + + This example gets the details of the Microsoft Sentinel Workspace Manager Assignment 'MyWorkspaceManagerAssignment' for the workspace 'MyWorkspace' + + + + + + + + Get-AzWorkspaceManagerGroups + Get + AzWorkspaceManagerGroups + + Get the Microsoft Sentinel Workspace Manager Groups + + + + The Get-AzWorkspaceManagerGroups cmdlet gets the Microsoft Sentinel Workspace Manager Groups by just specifying the workspace name or by specifying the workspace name and the resource group name. The return value contains the details of the workspace manager groups including the members. If no workspace manager groups are found, the cmdlet returns an information message. If the workspace manager configuration is not enabled, the cmdlet returns an information message. + + + + Get-AzWorkspaceManagerGroups + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager group + + String + + String + + + None + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The name of the workspace manager group + + String + + String + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerGroup' + + This example gets the Microsoft Sentinel Workspace Manager Group 'MyWorkspaceManagerGroup' for the workspace 'MyWorkspace' + + + + -------------------------- EXAMPLE 4 -------------------------- + Get-AzWorkspaceManager -Name 'MyWorkspace' | Get-AzWorkspaceManagerGroups + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' using the pipeline + + + + + + + + Get-AzWorkspaceManagerItems + Get + AzWorkspaceManagerItems + + Gets a Microsoft Sentinel Workspace Manager Member + + + + The Get-AzWorkspaceManagerItems is a helper command to get the resource ids of Microsoft Sentinel resources that can be added to assignments Currently only three types of resources are supported: AlertRules, AutomationRules and SavedSearches. When using SavedSearches, the Name parameter This command currently not supports pipeline input and is still in development. is ignored due to API limitations. + + + + Get-AzWorkspaceManagerItems + + WorkspaceName + + Enter the Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Enter the name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + Enter the name of the resource to get + + String + + String + + + None + + + Type + + Select the type of resource to get. Currently only AlertRules, AutomationRules and SavedSearches are supported + + String + + String + + + AlertRules + + + + + + WorkspaceName + + Enter the Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Enter the name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + Enter the name of the resource to get + + String + + String + + + None + + + Type + + Select the type of resource to get. Currently only AlertRules, AutomationRules and SavedSearches are supported + + String + + String + + + AlertRules + + + + + + + This command currently not supports pipeline input and is still in development. + + + + + -------------------------- EXAMPLE 1 -------------------------- + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Name 'MyAlertRule' -Type 'AlertRules' + + This example gets the resource id of the AlertRule 'MyAlertRule' in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AlertRules' + + This example gets the resource ids of all AlertRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'SavedSearches' + + This example gets the resource ids of all SavedSearches in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + + + + -------------------------- EXAMPLE 4 -------------------------- + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AutomationRules' + + This example gets the resource ids of all AutomationRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + + + + + + + + Get-AzWorkspaceManagerMembers + Get + AzWorkspaceManagerMembers + + Gets a Microsoft Sentinel Workspace Manager Member + + + + The Get-AzWorkspaceManagerMembers cmdlet gets workspace manager member(s) from the configuration. If the workspace manager member name is not provided, all the workspace manager members for the workspace will be returned. When the workspace manager member name is provided, the workspace manager member details will be returned. + + + + Get-AzWorkspaceManagerMembers + + WorkspaceName + + Enter the Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Enter the name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + Enter the name of the workspace manager member + + String + + String + + + None + + + + + + WorkspaceName + + Enter the Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Enter the name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + Enter the name of the workspace manager member + + String + + String + + + None + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroupName "myResourceGroup" + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' in the resource group 'myResourceGroup' + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" + + This example gets the Microsoft Sentinel Workspace Manager Member 'myChildWorkspace( * )' for the workspace 'MyWorkspace' + + + + -------------------------- EXAMPLE 4 -------------------------- + Get-AzWorkspaceManager -Name "myWorkspace" | Get-AzWorkspaceManagerMembers + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' using pipeline + + + + + + + + Remove-AzWorkspaceManager + Remove + AzWorkspaceManager + + Remove Microsoft Sentinel Workspace Manager + + + + The Remove-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration and removes it from the Log Analytics workspace. You can remove the workspace manager configuration by just providing a workspacename. + + + + Remove-AzWorkspaceManager + + Name + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + + SwitchParameter + + + False + + + + + + Name + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + SwitchParameter + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + SwitchParameter + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + SwitchParameter + + SwitchParameter + + + False + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Remove-AzWorkspaceManager -Name 'myWorkspace' -Force + + This command removes the workspace manager on the Sentinel workspace 'myWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Remove-AzWorkspaceManager -Name sentinel-playground -Force + + This command removes the workspace manager on the Sentinel workspace 'myWorkspace' without confirmation' + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManager -Name sentinel-playground | Remove-AzWorkspaceManager -Force + + This command removes the workspace manager based on a pipeline value from the Get-AzWorkspaceManager cmdlet + + + + + + + + Remove-AzWorkspaceManagerAssignmentJobs + Remove + AzWorkspaceManagerAssignmentJobs + + Get the Microsoft Sentinel Workspace Manager Groups + + + + The Remove-AzWorkspaceManagerAssignmentJobs cmdlet removes the Workspace Manager Assignment Jobs from the Workspace Manager Assignment. When the Workspace Manager Assignment is removed, all the Workspace Manager Assignment Jobs are removed as well. + + + + Remove-AzWorkspaceManagerAssignmentJobs + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + AssignmentName + + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + + String + + String + + + None + + + Name + + {{ Fill Name Description }} + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration + + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + + SwitchParameter + + + False + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + AssignmentName + + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + + String + + String + + + None + + + Name + + {{ Fill Name Description }} + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration + + SwitchParameter + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + SwitchParameter + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + SwitchParameter + + SwitchParameter + + + False + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Remove-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -ResourceGroupName 'myRG' -AssignmentName 'myAssignment' -JobName 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' + + This example removes the Workspace Manager Assignment Job 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' from the Workspace Manager Assignment 'myAssignment' in the log analytics workspace 'myWorkspace' in the resource group 'myRG' + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -Name 'MyWorkspaceManagerAssignment' | Remove-AzWorkspaceManagerAssignmentJobs -Force + + This example removes all the Workspace Manager Assignment Jobs from the Workspace Manager Assignment 'MyWorkspaceManagerAssignment' without prompting for confirmation + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerAssignments -WorkspaceName 'sentinel-playground' | Get-AzWorkspaceManagerAssignmentJobs | Remove-AzWorkspaceManagerAssignmentJobs -Force + + This example removes all the Workspace Manager Assignment Jobs from all the Workspace Manager Assignments in the log analytics workspace 'sentinel-playground' without prompting for confirmation + + + + + + + + Remove-AzWorkspaceManagerAssignments + Remove + AzWorkspaceManagerAssignments + + Remove Microsoft Sentinel Workspace Manager Assignment + + + + The Remove-AzWorkspaceManagerAssignments cmdlet removes a Workspace Manager Assignment from a Microsoft Sentinel Workspace. The cmdlet will not return an error if the Workspace Manager Assignment does not exist. The Assignment must first be removed from the Workspace Manager Group before the group can be removed. + + + + Remove-AzWorkspaceManagerAssignments + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Assignment + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + + SwitchParameter + + + False + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Assignment + + String + + String + + + None + + + ResourceId + + {{ Fill ResourceId Description }} + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + SwitchParameter + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + SwitchParameter + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + SwitchParameter + + SwitchParameter + + + False + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Remove-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' -ResourceGroupName 'ContosoResourceGroup' -Name 'ContosoWorkspaceManagerAssignment' + + This command removes the Workspace Manager Assignment 'ContosoWorkspaceManagerAssignment' from the workspace 'ContosoWorkspace' in the resource group 'ContosoResourceGroup'. + + + + -------------------------- EXAMPLE 2 -------------------------- + Get-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerAssignments -Force + + This example removes all Workspace Manager Assignments from the workspace 'ContosoWorkspace' in the resource group 'ContosoResourceGroup' without prompting for confirmation. + + + + + + + + Remove-AzWorkspaceManagerGroups + Remove + AzWorkspaceManagerGroups + + Remove Microsoft Sentinel Workspace Manager + + + + This command removes a Workspace Manager Group from a Microsoft Sentinel Workspace. If the Workspace Manager Group does not exist, the command will return an error. When the Workspace Manager Group is removed the members of the group will no longer receive updates from the workspace. If an assigment is still available for the group, the group cannot be removed. + + + + Remove-AzWorkspaceManagerGroups + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Group + + String + + String + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + + SwitchParameter + + + False + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Group + + String + + String + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + SwitchParameter + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + SwitchParameter + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + SwitchParameter + + SwitchParameter + + + False + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -Name 'myChildWorkspace' + + This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -ResourceGroupName 'myWorkspaceManagerGroup' -Name 'myChildWorkspace' -Force + + This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' in the resource group 'myWorkspaceManagerGroup' without prompting for confirmation + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerGroups -Force + + This example removes all Workspace Manager Groups from the workspace 'myWorkspace' without prompting for confirmation using the pipeline + + + + + + + + Remove-AzWorkspaceManagerMembers + Remove + AzWorkspaceManagerMembers + + Remove a Workspace Manager Member + + + + The Remove-AzWorkspaceManagerMembers cmdlet removes a workspace manager member to the configuration. + + + + Remove-AzWorkspaceManagerMembers + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Member + + String + + String + + + None + + + ResourceId + + The ResourceId of the target workspace manager member to remove + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + + SwitchParameter + + + False + + + + + + WorkspaceName + + The Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + The name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Name + + The Name of the Workspace Manager Member + + String + + String + + + None + + + ResourceId + + The ResourceId of the target workspace manager member to remove + + Array + + Array + + + None + + + Force + + Confirms the removal of the Workspace manager configuration. + + SwitchParameter + + SwitchParameter + + + False + + + WhatIf + + Shows what would happen if the cmdlet runs. The cmdlet is not run. + + SwitchParameter + + SwitchParameter + + + False + + + Confirm + + Prompts you for confirmation before running the cmdlet. + + SwitchParameter + + SwitchParameter + + + False + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" + + This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' with confirmation + + + + -------------------------- EXAMPLE 2 -------------------------- + Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroup "myRG" -Name "myChildWorkspace(***)" -Force + + This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' without confirmation + + + + -------------------------- EXAMPLE 3 -------------------------- + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Remove-AzWorkspaceManagerMembers -Force + + This example removes all workspace manager members from the workspace configuration 'myWorkspace' using pipeline input without confirmation + + + + + + + + Set-AzWorkspaceManager + Set + AzWorkspaceManager + + Creates a Workspace Manager Configuration + + + + The Set-AzWorkspaceManager cmdlet creates a Workspace Manager Configuration that is required to use workspace manager feature. You can create a workspace manager configuration by using just a workspacename. The minimum requirement to to enable the workspace manager is that Microsoft Sentinel is enabled on the Log Analytics workspace. Only one workspace manager configuration can be added per Microsoft Sentinel instance. + + + + Set-AzWorkspaceManager + + Name + + Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Mode + + Status of the Workspace Manager (Enabled or Disabled) + + String + + String + + + Enabled + + + + + + Name + + Name of the log analytics workspace + + String + + String + + + None + + + ResourceGroupName + + Name of the ResouceGroup where the log analytics workspace is located + + String + + String + + + None + + + Mode + + Status of the Workspace Manager (Enabled or Disabled) + + String + + String + + + Enabled + + + + + + + + + + + + -------------------------- EXAMPLE 1 -------------------------- + Set-AzWorkspaceManager -Name 'myWorkspace' + + Name : myWorkspace ResourceGroupName : myRG ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations WorkspaceName : myWorkspace ResourceId : /subscriptions/<REDACTED>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace Tags : Properties : @{mode=Enabled} + This command creates / enables the workspace manager on the Sentinel workspace 'myWorkspace' + + + + -------------------------- EXAMPLE 2 -------------------------- + Set-AzWorkspaceManager -Name 'myworkspace' -Mode 'Disabled' + + Name : myWorkspace ResourceGroupName : myRG ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations WorkspaceName : myWorkspace ResourceId : /subscriptions/<REDACTED>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace Tags : Properties : @{mode=Disabled} + This command sets the workspace manager to disabled + + + + -------------------------- EXAMPLE 3 -------------------------- + Set-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' + + Name : myWorkspace ResourceGroupName : myRG ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations WorkspaceName : myWorkspace ResourceId : /subscriptions/<REDACTED>/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace Tags : Properties : @{mode=Enabled} + This command enables the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. + + + + + + \ No newline at end of file diff --git a/docs/en-US/Get-AzWorkspaceManager.md b/docs/en-US/Get-AzWorkspaceManager.md new file mode 100644 index 0000000..046ad22 --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManager.md @@ -0,0 +1,80 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManager + +## SYNOPSIS +Gets the Microsoft Sentinel Workspace Manager + +## SYNTAX + +``` +Get-AzWorkspaceManager [-Name] [[-ResourceGroupName] ] [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration from the Log Analytics workspace. +You can retrieve the workspace manager configuration by using just provding a workspacename. +Only one workspace manager configuration can be added per Microsoft Sentinel instance + +## EXAMPLES + +### EXAMPLE 1 +``` +Get-AzWorkspaceManager -Name 'myWorkspace' +``` + +This command gets the workspace manager for the workspace 'myWorkspace' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' +``` + +This command gets the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' +Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. + +## PARAMETERS + +### -Name +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES diff --git a/docs/en-US/Get-AzWorkspaceManagerAssignmentJobs.md b/docs/en-US/Get-AzWorkspaceManagerAssignmentJobs.md new file mode 100644 index 0000000..0ad1f79 --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManagerAssignmentJobs.md @@ -0,0 +1,117 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManagerAssignmentJobs + +## SYNOPSIS +Get the Microsoft Sentinel Workspace Manager Groups + +## SYNTAX + +``` +Get-AzWorkspaceManagerAssignmentJobs [-WorkspaceName] [[-ResourceGroupName] ] + [[-Name] ] [[-JobName] ] [[-ResourceId] ] [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManagerAssignmentJobs cmdlet gets the Microsoft Sentinel Workspace Manager Assignment Jobs +It can be used to get all the Workspace Manager Assignment Jobs or a specific Workspace Manager Assignment Job by specifying the JobName. + +## EXAMPLES + +### EXAMPLE 1 +``` + +``` + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -JobName +The name of the Workspace Manager Assignment Job + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ResourceId +{{ Fill ResourceId Description }} + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 5 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Get-AzWorkspaceManagerAssignments.md b/docs/en-US/Get-AzWorkspaceManagerAssignments.md new file mode 100644 index 0000000..630c9dc --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManagerAssignments.md @@ -0,0 +1,99 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManagerAssignments + +## SYNOPSIS +Get the Microsoft Sentinel Workspace Manager Groups + +## SYNTAX + +``` +Get-AzWorkspaceManagerAssignments [[-WorkspaceName] ] [[-ResourceGroupName] ] + [[-Name] ] [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManagerAssignments cmdlet gets the Microsoft Sentinel Workspace Manager Assignments by just specifying the workspace name +When the workspace manager configuration is not 'Enabled' for the workspace, the cmdlet will return an information message +If a Name is specified, the cmdlet will return the details of the workspace manager assignment + +## EXAMPLES + +### EXAMPLE 1 +``` +Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' +``` + +This example gets all the Microsoft Sentinel Workspace Manager Assignments for the workspace 'MyWorkspace' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' +``` + +This example gets the details of the Microsoft Sentinel Workspace Manager Assignment 'MyWorkspaceManagerAssignment' for the workspace 'MyWorkspace' + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 1 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager assignment + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS + + diff --git a/docs/en-US/Get-AzWorkspaceManagerGroups.md b/docs/en-US/Get-AzWorkspaceManagerGroups.md new file mode 100644 index 0000000..9e391f1 --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManagerGroups.md @@ -0,0 +1,116 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManagerGroups + +## SYNOPSIS +Get the Microsoft Sentinel Workspace Manager Groups + +## SYNTAX + +``` +Get-AzWorkspaceManagerGroups [-WorkspaceName] [[-ResourceGroupName] ] [[-Name] ] + [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManagerGroups cmdlet gets the Microsoft Sentinel Workspace Manager Groups by just specifying the workspace name +or by specifying the workspace name and the resource group name. +The return value contains the details of the workspace manager groups +including the members. +If no workspace manager groups are found, the cmdlet returns an information message. +If the workspace manager configuration is not enabled, the cmdlet returns an information message. + +## EXAMPLES + +### EXAMPLE 1 +``` +Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' +``` + +This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' +``` + +This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerGroup' +``` + +This example gets the Microsoft Sentinel Workspace Manager Group 'MyWorkspaceManagerGroup' for the workspace 'MyWorkspace' + +### EXAMPLE 4 +``` +Get-AzWorkspaceManager -Name 'MyWorkspace' | Get-AzWorkspaceManagerGroups +``` + +This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' using the pipeline + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The name of the workspace manager group + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS + + diff --git a/docs/en-US/Get-AzWorkspaceManagerItems.md b/docs/en-US/Get-AzWorkspaceManagerItems.md new file mode 100644 index 0000000..b6b9a16 --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManagerItems.md @@ -0,0 +1,130 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManagerItems + +## SYNOPSIS +Gets a Microsoft Sentinel Workspace Manager Member + +## SYNTAX + +``` +Get-AzWorkspaceManagerItems [-WorkspaceName] [[-ResourceGroupName] ] [[-Name] ] + [[-Type] ] [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManagerItems is a helper command to get the resource ids of Microsoft Sentinel resources that can be added to assignments +Currently only three types of resources are supported: AlertRules, AutomationRules and SavedSearches. +When using SavedSearches, the Name parameter +This command currently not supports pipeline input and is still in development. +is ignored due to API limitations. + +## EXAMPLES + +### EXAMPLE 1 +``` +Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Name 'MyAlertRule' -Type 'AlertRules' +``` + +This example gets the resource id of the AlertRule 'MyAlertRule' in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AlertRules' +``` + +This example gets the resource ids of all AlertRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'SavedSearches' +``` + +This example gets the resource ids of all SavedSearches in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + +### EXAMPLE 4 +``` +Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AutomationRules' +``` + +This example gets the resource ids of all AutomationRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + +## PARAMETERS + +### -WorkspaceName +Enter the Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +Enter the name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +Enter the name of the resource to get + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Type +Select the type of resource to get. +Currently only AlertRules, AutomationRules and SavedSearches are supported + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: AlertRules +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES +This command currently not supports pipeline input and is still in development. + +## RELATED LINKS diff --git a/docs/en-US/Get-AzWorkspaceManagerMembers.md b/docs/en-US/Get-AzWorkspaceManagerMembers.md new file mode 100644 index 0000000..0208c56 --- /dev/null +++ b/docs/en-US/Get-AzWorkspaceManagerMembers.md @@ -0,0 +1,111 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Get-AzWorkspaceManagerMembers + +## SYNOPSIS +Gets a Microsoft Sentinel Workspace Manager Member + +## SYNTAX + +``` +Get-AzWorkspaceManagerMembers [-WorkspaceName] [[-ResourceGroupName] ] [[-Name] ] + [] +``` + +## DESCRIPTION +The Get-AzWorkspaceManagerMembers cmdlet gets workspace manager member(s) from the configuration. +If the workspace manager member name is not provided, all the workspace manager members for the workspace will be returned. +When the workspace manager member name is provided, the workspace manager member details will be returned. + +## EXAMPLES + +### EXAMPLE 1 +``` +Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" +``` + +This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroupName "myResourceGroup" +``` + +This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' in the resource group 'myResourceGroup' + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" +``` + +This example gets the Microsoft Sentinel Workspace Manager Member 'myChildWorkspace(***)' for the workspace 'MyWorkspace' + +### EXAMPLE 4 +``` +Get-AzWorkspaceManager -Name "myWorkspace" | Get-AzWorkspaceManagerMembers +``` + +This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' using pipeline + +## PARAMETERS + +### -WorkspaceName +Enter the Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +Enter the name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +Enter the name of the workspace manager member + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Remove-AzWorkspaceManager.md b/docs/en-US/Remove-AzWorkspaceManager.md new file mode 100644 index 0000000..0399238 --- /dev/null +++ b/docs/en-US/Remove-AzWorkspaceManager.md @@ -0,0 +1,136 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Remove-AzWorkspaceManager + +## SYNOPSIS +Remove Microsoft Sentinel Workspace Manager + +## SYNTAX + +``` +Remove-AzWorkspaceManager [-Name] [[-ResourceGroupName] ] [-Force] [-WhatIf] [-Confirm] + [] +``` + +## DESCRIPTION +The Remove-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration and removes +it from the Log Analytics workspace. +You can remove the workspace manager configuration by +just providing a workspacename. + +## EXAMPLES + +### EXAMPLE 1 +``` +Remove-AzWorkspaceManager -Name 'myWorkspace' -Force +``` + +This command removes the workspace manager on the Sentinel workspace 'myWorkspace' + +### EXAMPLE 2 +``` +Remove-AzWorkspaceManager -Name sentinel-playground -Force +``` + +This command removes the workspace manager on the Sentinel workspace 'myWorkspace' without confirmation' + +### EXAMPLE 3 +``` +Get-AzWorkspaceManager -Name sentinel-playground | Remove-AzWorkspaceManager -Force +``` + +This command removes the workspace manager based on a pipeline value from the Get-AzWorkspaceManager cmdlet + +## PARAMETERS + +### -Name +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Force +Confirms the removal of the Workspace manager configuration. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf +Shows what would happen if the cmdlet runs. +The cmdlet is not run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm +Prompts you for confirmation before running the cmdlet. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Remove-AzWorkspaceManagerAssignmentJobs.md b/docs/en-US/Remove-AzWorkspaceManagerAssignmentJobs.md new file mode 100644 index 0000000..4014696 --- /dev/null +++ b/docs/en-US/Remove-AzWorkspaceManagerAssignmentJobs.md @@ -0,0 +1,180 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Remove-AzWorkspaceManagerAssignmentJobs + +## SYNOPSIS +Get the Microsoft Sentinel Workspace Manager Groups + +## SYNTAX + +``` +Remove-AzWorkspaceManagerAssignmentJobs [-WorkspaceName] [[-ResourceGroupName] ] + [[-AssignmentName] ] [[-Name] ] [[-ResourceId] ] [-Force] [-WhatIf] [-Confirm] + [] +``` + +## DESCRIPTION +The Remove-AzWorkspaceManagerAssignmentJobs cmdlet removes the Workspace Manager Assignment Jobs from the Workspace Manager Assignment. +When the Workspace Manager Assignment is removed, all the Workspace Manager Assignment Jobs are removed as well. + +## EXAMPLES + +### EXAMPLE 1 +``` +Remove-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -ResourceGroupName 'myRG' -AssignmentName 'myAssignment' -JobName 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' +``` + +This example removes the Workspace Manager Assignment Job 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' from the Workspace Manager Assignment 'myAssignment' in the log analytics workspace 'myWorkspace' in the resource group 'myRG' + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -Name 'MyWorkspaceManagerAssignment' | Remove-AzWorkspaceManagerAssignmentJobs -Force +``` + +This example removes all the Workspace Manager Assignment Jobs from the Workspace Manager Assignment 'MyWorkspaceManagerAssignment' without prompting for confirmation + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerAssignments -WorkspaceName 'sentinel-playground' | Get-AzWorkspaceManagerAssignmentJobs | Remove-AzWorkspaceManagerAssignmentJobs -Force +``` + +This example removes all the Workspace Manager Assignment Jobs from all the Workspace Manager Assignments in the log analytics workspace 'sentinel-playground' without prompting for confirmation + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -AssignmentName +The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +{{ Fill Name Description }} + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceId +{{ Fill ResourceId Description }} + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 5 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Force +Confirms the removal of the Workspace manager configuration + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf +Shows what would happen if the cmdlet runs. +The cmdlet is not run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm +Prompts you for confirmation before running the cmdlet. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Remove-AzWorkspaceManagerAssignments.md b/docs/en-US/Remove-AzWorkspaceManagerAssignments.md new file mode 100644 index 0000000..3866aa6 --- /dev/null +++ b/docs/en-US/Remove-AzWorkspaceManagerAssignments.md @@ -0,0 +1,158 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Remove-AzWorkspaceManagerAssignments + +## SYNOPSIS +Remove Microsoft Sentinel Workspace Manager Assignment + +## SYNTAX + +``` +Remove-AzWorkspaceManagerAssignments [-WorkspaceName] [[-ResourceGroupName] ] + [[-Name] ] [[-ResourceId] ] [-Force] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION +The Remove-AzWorkspaceManagerAssignments cmdlet removes a Workspace Manager Assignment from a Microsoft Sentinel Workspace. +The cmdlet will not return an error if the Workspace Manager Assignment does not exist. +The Assignment must first be removed from the Workspace Manager Group before the group can be removed. + +## EXAMPLES + +### EXAMPLE 1 +``` +Remove-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' -ResourceGroupName 'ContosoResourceGroup' -Name 'ContosoWorkspaceManagerAssignment' +``` + +This command removes the Workspace Manager Assignment 'ContosoWorkspaceManagerAssignment' from the workspace 'ContosoWorkspace' in the resource group 'ContosoResourceGroup'. + +### EXAMPLE 2 +``` +Get-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerAssignments -Force +``` + +This example removes all Workspace Manager Assignments from the workspace 'ContosoWorkspace' in the resource group 'ContosoResourceGroup' without prompting for confirmation. + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The Name of the Workspace Manager Assignment + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ResourceId +{{ Fill ResourceId Description }} + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Force +Confirms the removal of the Workspace manager configuration. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf +Shows what would happen if the cmdlet runs. +The cmdlet is not run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm +Prompts you for confirmation before running the cmdlet. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Remove-AzWorkspaceManagerGroups.md b/docs/en-US/Remove-AzWorkspaceManagerGroups.md new file mode 100644 index 0000000..573fb2e --- /dev/null +++ b/docs/en-US/Remove-AzWorkspaceManagerGroups.md @@ -0,0 +1,151 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Remove-AzWorkspaceManagerGroups + +## SYNOPSIS +Remove Microsoft Sentinel Workspace Manager + +## SYNTAX + +``` +Remove-AzWorkspaceManagerGroups [-WorkspaceName] [[-ResourceGroupName] ] [-Name] + [-Force] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION +This command removes a Workspace Manager Group from a Microsoft Sentinel Workspace. +If the Workspace Manager Group does not exist, the command will return an error. +When the Workspace Manager Group is removed the members of the group will no longer receive updates from the workspace. +If an assigment is still available for the group, the group cannot be removed. + +## EXAMPLES + +### EXAMPLE 1 +``` +Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -Name 'myChildWorkspace' +``` + +This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' + +### EXAMPLE 2 +``` +Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -ResourceGroupName 'myWorkspaceManagerGroup' -Name 'myChildWorkspace' -Force +``` + +This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' in the resource group 'myWorkspaceManagerGroup' without prompting for confirmation + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerGroups -Force +``` + +This example removes all Workspace Manager Groups from the workspace 'myWorkspace' without prompting for confirmation using the pipeline + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The Name of the Workspace Manager Group + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 3 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Force +Confirms the removal of the Workspace manager configuration. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf +Shows what would happen if the cmdlet runs. +The cmdlet is not run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm +Prompts you for confirmation before running the cmdlet. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Remove-AzWorkspaceManagerMembers.md b/docs/en-US/Remove-AzWorkspaceManagerMembers.md new file mode 100644 index 0000000..73a8bd8 --- /dev/null +++ b/docs/en-US/Remove-AzWorkspaceManagerMembers.md @@ -0,0 +1,163 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Remove-AzWorkspaceManagerMembers + +## SYNOPSIS +Remove a Workspace Manager Member + +## SYNTAX + +``` +Remove-AzWorkspaceManagerMembers [-WorkspaceName] [[-ResourceGroupName] ] [[-Name] ] + [[-ResourceId] ] [-Force] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION +The Remove-AzWorkspaceManagerMembers cmdlet removes a workspace manager member to the configuration. + +## EXAMPLES + +### EXAMPLE 1 +``` +Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" +``` + +This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' with confirmation + +### EXAMPLE 2 +``` +Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroup "myRG" -Name "myChildWorkspace(***)" -Force +``` + +This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' without confirmation + +### EXAMPLE 3 +``` +Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Remove-AzWorkspaceManagerMembers -Force +``` + +This example removes all workspace manager members from the workspace configuration 'myWorkspace' using pipeline input without confirmation + +## PARAMETERS + +### -WorkspaceName +The Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +The name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Name +The Name of the Workspace Manager Member + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceId +The ResourceId of the target workspace manager member to remove + +```yaml +Type: Array +Parameter Sets: (All) +Aliases: + +Required: False +Position: 4 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Force +Confirms the removal of the Workspace manager configuration. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf +Shows what would happen if the cmdlet runs. +The cmdlet is not run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm +Prompts you for confirmation before running the cmdlet. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/docs/en-US/Set-AzWorkspaceManager.md b/docs/en-US/Set-AzWorkspaceManager.md new file mode 100644 index 0000000..53a0fb4 --- /dev/null +++ b/docs/en-US/Set-AzWorkspaceManager.md @@ -0,0 +1,130 @@ +--- +external help file: AzWorkspaceManager-help.xml +Module Name: AzWorkspaceManager +online version: +schema: 2.0.0 +--- + +# Set-AzWorkspaceManager + +## SYNOPSIS +Creates a Workspace Manager Configuration + +## SYNTAX + +``` +Set-AzWorkspaceManager [-Name] [[-ResourceGroupName] ] [[-Mode] ] [] +``` + +## DESCRIPTION +The Set-AzWorkspaceManager cmdlet creates a Workspace Manager Configuration that is required to use workspace manager feature. +You can create a workspace manager configuration by using just a workspacename. +The minimum requirement to to enable the +workspace manager is that Microsoft Sentinel is enabled on the Log Analytics workspace. +Only one workspace manager configuration can be added per Microsoft Sentinel instance. + +## EXAMPLES + +### EXAMPLE 1 +``` +Set-AzWorkspaceManager -Name 'myWorkspace' +``` + +Name : myWorkspace +ResourceGroupName : myRG +ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations +WorkspaceName : myWorkspace +ResourceId : /subscriptions/\/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace +Tags : +Properties : @{mode=Enabled} + +This command creates / enables the workspace manager on the Sentinel workspace 'myWorkspace' + +### EXAMPLE 2 +``` +Set-AzWorkspaceManager -Name 'myworkspace' -Mode 'Disabled' +``` + +Name : myWorkspace +ResourceGroupName : myRG +ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations +WorkspaceName : myWorkspace +ResourceId : /subscriptions/\/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace +Tags : +Properties : @{mode=Disabled} + +This command sets the workspace manager to disabled + +### EXAMPLE 3 +``` +Set-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' +``` + +Name : myWorkspace +ResourceGroupName : myRG +ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations +WorkspaceName : myWorkspace +ResourceId : /subscriptions/\/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace +Tags : +Properties : @{mode=Enabled} + +This command enables the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' +Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. + +## PARAMETERS + +### -Name +Name of the log analytics workspace + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 1 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -ResourceGroupName +Name of the ResouceGroup where the log analytics workspace is located + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 2 +Default value: None +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` + +### -Mode +Status of the Workspace Manager (Enabled or Disabled) + +```yaml +Type: String +Parameter Sets: (All) +Aliases: + +Required: False +Position: 3 +Default value: Enabled +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +## OUTPUTS + +## NOTES + +## RELATED LINKS diff --git a/src/AzWorkspaceManager.psd1 b/src/AzWorkspaceManager.psd1 index 10a170b..bed5c5a 100644 --- a/src/AzWorkspaceManager.psd1 +++ b/src/AzWorkspaceManager.psd1 @@ -69,9 +69,13 @@ # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. - FunctionsToExport = @( - 'Get-AzWorkspaceManager', - '' + FunctionsToExport = @('Get-AzWorkspaceManager', + 'Set-AzWorkspaceManager', 'Remove-AzWorkspaceManager', + 'Get-AzWorkspaceManagerMembers', 'Add-AzWorkspaceManagerMembers', 'Remove-AzWorkspaceManagerMembers', + 'Get-AzWorkspaceManagerGroups', 'Add-AzWorkspaceManagerGroups', 'Remove-AzWorkspaceManagerGroups', + 'Get-AzWorkspaceManagerAssignments', 'Add-AzWorkspaceManagerAssignments', 'Remove-AzWorkspaceManagerAssignments', + 'Get-AzWorkspaceManagerAssignmentJobs', 'Add-AzWorkspaceManagerAssignmentJobs', 'Remove-AzWorkspaceManagerAssignmentJobs', + 'Get-AzWorkspaceManagerItems' ) # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. @@ -90,15 +94,40 @@ # ModuleList = @() # List of all files packaged with this module - # FileList = @() + FileList = 'Private\Get-AccessToken.ps1', + 'Private\Invoke-AzWorkspaceManager.ps1', + 'Private\Format-Result.ps1', + 'Private\Write-Message.ps1', + 'Public\Get-LogAnalyticsWorkspace.ps1', + 'Public\Get-AzWorkspaceManager.ps1', + 'Public\Set-AzWorkspaceManager.ps1', + 'Public\Remove-AzWorkspaceManager.ps1', + 'Public\Get-AzWorkspaceManagerMembers.ps1', + 'Public\Add-AzWorkspaceManagerMembers.ps1', + 'Public\Remove-AzWorkspaceManagerMembers.ps1', + 'Public\Get-AzWorkspaceManagerGroups.ps1', + 'Public\Add-AzWorkspaceManagerGroups.ps1', + 'Public\Remove-AzWorkspaceManagerGroups.ps1', + 'Public\Get-AzWorkspaceManagerAssignments.ps1', + 'Public\Add-AzWorkspaceManagerAssignments.ps1', + 'Public\Remove-AzWorkspaceManagerAssignments.ps1', + 'Public\Get-AzWorkspaceManagerAssignmentJobs.ps1', + 'Public\Add-AzWorkspaceManagerAssignmentJobs.ps1', + 'Public\Remove-AzWorkspaceManagerAssignmentJobs.ps1', + 'Public\Get-AzWorkspaceManagerItems.ps1', + 'AzWorkspaceManager.psd1', + 'AzWorkspaceManager.psm1' # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell. PrivateData = @{ - PSData = @{ + #IsPrerelease of this module + IsPrerelease = $true + + PSData = @{ # Tags applied to this module. These help with module discovery in online galleries. - Tags = @("Sentinel", "Azure", "WorkspaceManager", "ARM") + Tags = @("Sentinel", "Microsoft", "Azure", "WorkspaceManager", "ARM") # A URL to the license for this module. # LicenseUri = 'https://github.com/securehats/AzWorkspaceManager/blob/master/LICENSE' @@ -130,5 +159,4 @@ # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' - } diff --git a/src/AzWorkspaceManager.psm1 b/src/AzWorkspaceManager.psm1 index b7023a5..918197f 100644 --- a/src/AzWorkspaceManager.psm1 +++ b/src/AzWorkspaceManager.psm1 @@ -1,15 +1,43 @@ -# Import private and public scripts and expose the public ones -$privateScripts = @(Get-ChildItem -Path "$PSScriptRoot\Private" -Recurse -Filter "*.ps1") | Sort-Object Name -$publicScripts = @(Get-ChildItem -Path "$PSScriptRoot\Public" -Recurse -Filter "*.ps1") | Sort-Object Name +#region load module variables +Write-Verbose -Message "Creating modules variables" +[System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')] +$SessionVariables = [ordered]@{ + baseUri = '' + ExpiresOn = '' + workspace = '' + apiVersion = '2023-06-01-preview' +} +New-Variable -Name Guid -Value (New-Guid).Guid -Scope Global -Force +New-Variable -Name SessionVariables -Value $SessionVariables -Scope Global -Force -foreach ($script in ($privateScripts + $publicScripts)) { - Write-Verbose $script - try { - . $script.FullName - Write-Verbose -Message ("Imported function {0}" -f $script) - } catch { - Write-Error -Message ("Failed to import function {0}: {1}" -f $script, $_) - } +#region Handle Module Removal +$OnRemoveScript = { + Remove-Variable -Name SessionVariables -Scope Global -Force + Remove-Variable -Name Guid -Scope Global -Force } +$ExecutionContext.SessionState.Module.OnRemove += $OnRemoveScript +Register-EngineEvent -SourceIdentifier ([System.Management.Automation.PsEngineEvent]::Exiting) -Action $OnRemoveScript +#endregion Handle Module Removal + +#region discover module name +$ScriptPath = Split-Path $MyInvocation.MyCommand.Path +$ModuleName = $ExecutionContext.SessionState.Module +Write-Verbose -Message "Loading module $ModuleName" +#endregion discover module name -Export-ModuleMember -Function $publicScripts.BaseName +#region dot source public and private function definition files +try { + foreach ($Scope in 'Public', 'Private') { + Get-ChildItem (Join-Path -Path $ScriptPath -ChildPath $Scope) -Filter *.ps1 | ForEach-Object { + . $_.FullName + if ($Scope -eq 'Public') { + Export-ModuleMember -Function $_.BaseName -ErrorAction Stop + } + } + } +} +catch { + Write-Error ("{0}: {1}" -f $_.BaseName, $_.Exception.Message) + exit 1 +} +#endregion dot source public and private function definition files diff --git a/src/Private/Format-Result.ps1 b/src/Private/Format-Result.ps1 new file mode 100644 index 0000000..81c06fa --- /dev/null +++ b/src/Private/Format-Result.ps1 @@ -0,0 +1,36 @@ +function Format-Result { + <# + .SYNOPSIS + Writes an output message to the console + .DESCRIPTION + This function is used internally to prompt messages to the PowerShell console + .EXAMPLE + Write-Result -FunctionName $MyInvocation.MyCommand.Name -Message 'This is a message' + .NOTES + NAME: Write-Message + #> + + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipeline = $true)] + [array]$Message, + + [Parameter(Mandatory = $false)] + [string]$FunctionName + ) + $result = @() + + foreach ($value in $Message) { + $split = $value.id.Split('/') + $result += [ordered]@{ + Name = $split[-1] + ResourceGroupName = $split[-9] + ResourceType = '{0}/{1}' -f $split[-3], $split[-2] + WorkspaceName = $split[-5] + ResourceId = $value.id + Tags = $value.tags + Properties = $value.properties + } | ConvertTo-Json -Depth 10 | ConvertFrom-Json -Depth 10 + } + return $result +} \ No newline at end of file diff --git a/src/Private/Get-AccessToken.ps1 b/src/Private/Get-AccessToken.ps1 new file mode 100644 index 0000000..8600e0e --- /dev/null +++ b/src/Private/Get-AccessToken.ps1 @@ -0,0 +1,44 @@ +#requires -module @{ModuleName = 'Az.Accounts'; ModuleVersion = '2.10.0'} +#requires -version 6.2 + +function Get-AccessToken { + <# + .SYNOPSIS + Get an Access Token + .DESCRIPTION + This function is used to get an access token for the Microsoft Azure API + .EXAMPLE + Get-AuthToken + .NOTES + NAME: Get-AccessToken + #> + + [CmdletBinding()] + param ( + ) + + try { + $azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile + + Write-Verbose "Current Subscription: $($azProfile.DefaultContext.Subscription.Name) in tenant $($azProfile.DefaultContext.Tenant.Id)" + + $SessionVariables.subscriptionId = $azProfile.DefaultContext.Subscription.Id + $SessionVariables.tenantId = $azProfile.DefaultContext.Tenant.Id + + $profileClient = [Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient]::new($azProfile) + + try { + $SessionVariables.accessToken = ([Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes(($profileClient.AcquireAccessToken($SessionVariables.tenantId)).accessToken))) | ConvertTo-SecureString -AsPlainText -Force + $SessionVariables.ExpiresOn = ($profileClient.AcquireAccessToken($SessionVariables.tenantId)).ExpiresOn.DateTime + Write-Verbose "Access Token expires on: $($SessionVariables.ExpiresOn)" + } + catch { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message 'Run Connect-AzAccount to login' -Severity 'Error' + break + } + } + catch { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message 'An error has occured requesting the Access Token' -Severity 'Error' + break + } +} \ No newline at end of file diff --git a/src/Private/Get-LogAnalyticsWorkspace.ps1 b/src/Private/Get-LogAnalyticsWorkspace.ps1 new file mode 100644 index 0000000..6162a65 --- /dev/null +++ b/src/Private/Get-LogAnalyticsWorkspace.ps1 @@ -0,0 +1,109 @@ +function Get-LogAnalyticsWorkspace { + <# + .SYNOPSIS + Get the Log Analytics workspace properties + .DESCRIPTION + This function is used to get the Log Analytics workspace properties + .EXAMPLE + Get-LogAnalyticsWorkspace + .NOTES + NAME: Get-LogAnalyticsWorkspace + #> + + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + process { + #Region Set Constants + $apiVersion = '2015-11-01-preview' + #EndRegion Set Constants + + if ($ResourceGroupName) { + Write-Verbose "Resource Group Name: $ResourceGroupName" + $uri = "$($SessionVariables.baseUri)/resourcegroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces?api-version=$apiVersion" + } + else { + Write-Verbose "No Resource Group Name specified" + $uri = "$($SessionVariables.baseUri)/providers/Microsoft.OperationalInsights/workspaces?api-version=$apiVersion" + } + + try { + Write-Verbose "Trying to get the Microsoft Sentinel workspace '$Name'" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = "ErrVar" + } + + $workspace = ( + Invoke-RestMethod @requestParam -ErrorVariable "ErrVar" ).value | Where-Object { $_.name -eq $Name } + + switch ($workspace.count) { + { $_ -eq 1 } { $_workspacePath = ("https://management.azure.com$($workspace.id)").ToLower() } + { $_ -gt 1 } { + $SessionVariables.workspace = $null + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Multiple resource '/Microsoft.OperationalInsights/workspaces/$($Name)' found. Please specify the resourcegroup" -Severity 'Information' + break + } + { $_ -lt 1 } { + $SessionVariables.workspace = $null + Write-Message -FunctionName $MyInvocation.MyCommand.Name"The Resource '/Microsoft.OperationalInsights/workspaces/$($Name)' was not found" -Severity 'Error' + } + Default {} + } + + if ($_workspacePath) { + $uri = "$(($_workspacePath).Split('microsoft.')[0])Microsoft.OperationsManagement/solutions/SecurityInsights($($workspace.name))?api-version=2015-11-01-preview" + + try { + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = "ErrVar" + } + + $_sentinelInstance = Invoke-RestMethod @requestParam + if ($_sentinelInstance.properties.provisioningState -eq 'Succeeded') { + Write-Verbose "Microsoft Sentinel workspace [$($Name)] found" + $SessionVariables.workspace = "https://management.azure.com$($workspace.id)" + } + else { + $SessionVariables.workspace = $null + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Microsoft Sentinel was found under workspace '$Name' but is not yet provisioned.." -Severity 'Information' + } + } + catch { + $SessionVariables.workspace = $null + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Microsoft Sentinel was not found under workspace '$Name'" -Severity 'Error' + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "An error has occured requesting the Log Analytics workspace" -Severity 'Error' + } + } + } + } + catch { + $SessionVariables.workspace = $null + if ($ErrVar.Message -like '*ResourceGroupNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Provided resource group does not exist." -Severity 'Error' + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "An error has occured requesting the Log Analytics workspace" -Severity 'Error' + } + } + } +} \ No newline at end of file diff --git a/src/Private/Invoke-AzWorkspaceManager.ps1 b/src/Private/Invoke-AzWorkspaceManager.ps1 new file mode 100644 index 0000000..c04db04 --- /dev/null +++ b/src/Private/Invoke-AzWorkspaceManager.ps1 @@ -0,0 +1,55 @@ +#requires -module @{ModuleName = 'Az.Accounts'; ModuleVersion = '2.10.0'} +#requires -version 6.2 + +function Invoke-AzWorkspaceManager { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipeline = $true)] + [string]$FunctionName + ) + <# + .SYNOPSIS + Get prerequisites and validate access to the Microsoft Azure API + .DESCRIPTION + This function is called by all functions to validate if the access token in still valid. + .EXAMPLE + Invoke-AzWorkspaceManager + .NOTES + NAME: Invoke-AzWorkspaceManager + #> + + Write-Verbose "Function Name: $($FunctionName)" + $azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile + + if ($azProfile.Contexts.Count -ne 0) { + if ([string]::IsNullOrEmpty($script:accessToken)) { + try { + Get-AccessToken + } + catch { + Write-Error -Exception $_.Exception.Message + break + } + } + elseif ($SessionVariables.ExpiresOn - [datetime]::UtcNow.AddMinutes(-5) -le 0) { + # if token expires within 5 minutes, request a new access token + try { + Get-AccessToken + } + catch { + Write-Error -Exception $_.Exception.Message + break + } + } + + # Set the subscription from AzContext + $SessionVariables.baseUri = "https://management.azure.com/subscriptions/$($SessionVariables.subscriptionId)" + $script:authHeader = @{ + 'Authorization' = 'Bearer ' + [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($($SessionVariables.AccessToken | ConvertFrom-SecureString -AsPlainText))) + } + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name "Run Connect-AzAccount to login" -Severity 'Error' + break + } +} \ No newline at end of file diff --git a/src/Private/Write-Message.ps1 b/src/Private/Write-Message.ps1 new file mode 100644 index 0000000..2f775bf --- /dev/null +++ b/src/Private/Write-Message.ps1 @@ -0,0 +1,38 @@ +function Write-Message { + <# + .SYNOPSIS + Writes an output message to the console + .DESCRIPTION + This function is used internally to prompt messages to the PowerShell console + .EXAMPLE + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message 'This is a message' -Severity 'Information' + .NOTES + NAME: Write-Message + #> + + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipeline = $true)] + [string]$Message, + + [Parameter(Mandatory = $false, ValueFromPipeline = $true)] + [ValidateSet("Error", "Information", "Debug")] + [string]$Severity, + + [Parameter(Mandatory = $false)] + [string]$FunctionName + ) + + $messageBody = ("**$($FunctionName): $($Message)**" | ConvertFrom-Markdown -AsVt100EncodedString).VT100EncodedString + + switch ($Severity) { + 'Error' { Write-Host -Object $messageBody -ForegroundColor Red } + 'Information' { Write-Host -Object $messageBody -ForegroundColor Green } + 'Debug' { Write-Host -Object $messageBody -ForegroundColor Blue } + Default { Write-Host -Object $messageBody } + } + + if ($Severity -eq 'Error') { + break + } +} \ No newline at end of file diff --git a/src/Public/Add-AzWorkspaceManagerAssignmentJobs.ps1 b/src/Public/Add-AzWorkspaceManagerAssignmentJobs.ps1 new file mode 100644 index 0000000..4e907a3 --- /dev/null +++ b/src/Public/Add-AzWorkspaceManagerAssignmentJobs.ps1 @@ -0,0 +1,109 @@ +function Add-AzWorkspaceManagerAssignmentJobs { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, # //TODO: Add validation for workspace name + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipeline = $false)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [array]$ResourceId + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + if ($ResourceId) { + $uri = "https://management.azure.com$($ResourceId)/jobs?api-version=$($SessionVariables.apiVersion)" + $name = $ResourceId.Split('/')[-1] + } + elseif ($Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($Name)/jobs?api-version=$($SessionVariables.apiVersion)" + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "No name was provided for the Workspace Manager Assignment Job. The name will be the same as the Workspace Manager Assignment" -Severity 'Information' + } + Write-Verbose "Adding Workspace Manager Assignment Job to group '$Name'" + + write-host $uri + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'POST' + ErrorVariable = 'ErrVar' + } + + $apiResponse = Invoke-RestMethod @requestParam + if ($apiResponse -ne '') { + $split = $apiResponse.id.Split('/') + $result = [ordered]@{ + Name = $split[-1] + ResourceGroupName = $split[-11] + ResourceType = '{0}/{1}/{2}' -f $split[-5], $split[-4], $split[-2] + ResourceId = $apiResponse.id + Properties = $apiResponse.properties + } | ConvertTo-Json | ConvertFrom-Json + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + break + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($ErrVar.Message | ConvertFrom-Json).error.message -Severity 'Error' + } + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$($WorkspaceName)'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Adds a Microsoft Sentinel Workspace Manager Assignment Job + .DESCRIPTION + The Add-AzWorkspaceManagerAssignmentJobs command adds a Workspace Manager Assignment Job to the workspace. + By default the name of the Workspace Manager Assignment is the same as the Workspace Manager Group. + .PARAMETER WorkspaceName + The name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The name of the workspace manager assignment. This is the same as the Workspace Manager GroupName unless specified otherwise + .EXAMPLE + Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' with the name 'MyWorkspaceManagerAssignment' + .EXAMPLE + Add-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' in the resourcegroup 'MyResourceGroup' with the name 'MyWorkspaceManagerAssignment' + .EXAMPLE + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' | Add-AzWorkspaceManagerAssignmentJobs + + This example adds a Workspace Manager Assignment Job to the workspace 'MyWorkspace' for each Workspace Manager Assignment found + .LINK + Get-AzWorkspaceManagerAssignmentJobs + Remove-AzWorkspaceManagerAssignmentJobs +#> +} \ No newline at end of file diff --git a/src/Public/Add-AzWorkspaceManagerAssignments.ps1 b/src/Public/Add-AzWorkspaceManagerAssignments.ps1 new file mode 100644 index 0000000..f701ceb --- /dev/null +++ b/src/Public/Add-AzWorkspaceManagerAssignments.ps1 @@ -0,0 +1,134 @@ +function Add-AzWorkspaceManagerAssignments { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [ValidateNotNullOrEmpty()] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $true, ValueFromPipeline = $false)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [ValidateNotNullOrEmpty()] + [string]$GroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [array]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [array]$ResourceId + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($ResourceId) { + foreach ($resource in $ResourceId) { + $items += @( + @{ resourceId = $resource } + ) + } + } + $payload = @{ + properties = @{ + targetResourceName = $GroupName + items = @($items) + } + } + write-Output $payload | ConvertTo-Json -Depth 10 + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "Adding Workspace Manager Assignment to group '$GroupName'" + if (-Not($Name)) { $name = $GroupName } + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'PUT' + Body = $payload | ConvertTo-Json -Depth 10 -Compress + ContentType = 'application/json' + ErrorVariable = 'ErrVar' + } + + $apiResponse = Invoke-RestMethod @requestParam + if ($Name) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + else { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + $result = Format-Result -Message $apiResponse + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + break + } + } + catch { + if ($ErrVar.Message -like '*existing Assignment*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message (($ErrVar.ErrorRecord) | ConvertFrom-Json).error.message -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message (($ErrVar.ErrorRecord) | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$($WorkspaceName)'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Adds a Microsoft Sentinel Workspace Manager Assignment + .DESCRIPTION + The Add-AzWorkspaceManagerAssignments command adds a Workspace Manager Assignment to a Workspace Manager Group. + These assignments are used to provision Microsoft Sentinel workspaces. The Workspace Manager Assignment name is constructed by the GroupName. + The resource id's of the items that are added to the assignment are stored in the properties of the assignment. These resources need to be in the same instance as the workspace manager configuration. + If the resource id's are not in the same instance as the workspace manager configuration, the assignment will not be created and an error will be thrown. + .PARAMETER WorkspaceName + The name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER GroupName + The name of the workspace manager group + .PARAMETER Name + The name of the workspace manager assignment + .PARAMETER ResourceId + The ResourceId's of the items that to be added to the Workspace Manager Assignment. This can be a single value or an array of values. + .EXAMPLE + Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' + + This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup'. + .EXAMPLE + Add-AzWorkspaceManagerAssignments -WorkspaceName "myWorkspace" -Name "AlertRules" -GroupName 'myGroup' -ResourceId "/subscriptions/***/resourceGroups/dev-sentinel/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/95204744-39a6-4510-8505-ef13549bc0da" + + This example adds a Workspace Manager Assignment to the workspace with the name 'AlertRules' and assigns this to the group 'myGroup' and adds the alert rule to the assignment. + .EXAMPLE + Get-AzWorkspaceManagerItems -WorkspaceName "myWorkspace" -Type "AlertRules" | Add-AzWorkspaceManagerAssignments -GroupName 'myGroup' + + This example gets all the alert rules from the workspace with the name 'myWorkspace' and adds these to the Workspace Manager Assignment with the name 'AlertRules'. + .LINK + Get-AzWorkspaceManagerItems + Get-AzWorkspaceManagerAssignments + Remove-AzWorkspaceManagerAssignments + Get-AzWorkspaceManagerGroups + #> +} \ No newline at end of file diff --git a/src/Public/Add-AzWorkspaceManagerGroups.ps1 b/src/Public/Add-AzWorkspaceManagerGroups.ps1 new file mode 100644 index 0000000..dccfaa6 --- /dev/null +++ b/src/Public/Add-AzWorkspaceManagerGroups.ps1 @@ -0,0 +1,116 @@ +function Add-AzWorkspaceManagerGroups { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $true, ValueFromPipeline = $false)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipeline = $false)] + [string]$Description = "", + + [Parameter(Mandatory = $false, ValueFromPipeline = $false)] + [array]$workspaceManagerMembers, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [array]$ResourceId + + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($ResourceId) { + foreach ($resource in $ResourceId) { + $workspaceManagerMembers += $resource.split('/')[-1] + } + } + $payload = @{ + properties = @{ + displayName = $Name + description = $Description + memberResourceNames = @(foreach ($workspaceManagerMember in $workspaceManagerMembers) { $workspaceManagerMember }) + } + } | ConvertTo-Json + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "Adding Workspace Manager Group to workspace [$WorkspaceName)]" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerGroups/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'PUT' + Body = $payload + ContentType = 'application/json' + } + + $apiResponse = Invoke-RestMethod @requestParam + + if ($apiResponse -ne '') { + $result = Format-Result -Message $apiResponse + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + } + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$($WorkspaceName)'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Add a Microsoft Sentinel Workspace Manager Group. + .DESCRIPTION + The Add-AzWorkspaceManagerGroups cmdlet adds a workspace manager group to the configuration. + It is possible to add child workspaces to the group or add them later. For adding child + workspaces, use the Add-AzWorkspaceManagerMembers cmdlet. + .PARAMETER WorkspaceName + The Name of the log analytics workspace. + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located. + .PARAMETER Name + The name of the workspace manager group. + .PARAMETER Description + The description of the workspace manager group. If not specified, the name will be used. + .PARAMETER workspaceManagerMembers + The workspace manager members to add to the group. The members are workspaces that are linked to the workspace manager configuration. and used to provision Microsoft Sentinel workspaces. + .EXAMPLE + Add-AzWorkspaceManagerGroups -WorkspaceName "myWorkspace" -Name "Banks" -workspaceManagerMembers 'myChildWorkspace(***)' + + This example adds a Workspace Manager Group 'Banks' to the workspace and adds a child workspace to the group. + .EXAMPLE + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Add-AzWorkspaceManagerGroups -Name "Banks" + + This example adds a Workspace Manager Group 'Banks' to the workspace and adds all child workspaces to the group using the pipeline. + .LINK + Get-AzWorkspaceManagerGroups + Remove-AzWorkspaceManagerGroups + Add-AzWorkspaceManagerMembers + Get-AzWorkspaceManagerMembers + #> +} \ No newline at end of file diff --git a/src/Public/Add-AzWorkspaceManagerMembers.ps1 b/src/Public/Add-AzWorkspaceManagerMembers.ps1 new file mode 100644 index 0000000..a70f6f2 --- /dev/null +++ b/src/Public/Add-AzWorkspaceManagerMembers.ps1 @@ -0,0 +1,117 @@ +function Add-AzWorkspaceManagerMembers { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $false)] + [array]$ResourceId, + + [Parameter(Mandatory = $true, ValueFromPipeline = $true)] + [ValidatePattern('^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$', ErrorMessage="It is not a valid GUID")] + [string]$TenantId + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + foreach ($id in $ResourceId) { + + $Name = "$($id.Split('/')[-1])($($id.Split('/')[2]))" + + $payload = @{ + properties = @{ + targetWorkspaceResourceId = $id + targetWorkspaceTenantId = $TenantId + } + } | ConvertTo-Json -Compress + + Write-Verbose $payload + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "Adding Workspace Manager Member to workspace [$WorkspaceName)]" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerMembers/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'PUT' + Body = $payload + ContentType = 'application/json' + ErrorVariable = "ErrVar" + } + + $apiResponse = Invoke-RestMethod @requestParam + + if ($apiResponse -ne '') { + [array]$result += Format-Result -Message $apiResponse + } + else { + Write-Output "$($MyInvocation.MyCommand.Name): $_.Exception.Message" + } + } + catch { + if ($ErrVar.Message -like '*LinkedAuthorizationFailed*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Unable to link workspace in tenant '$tenantId'. Check if the ResourceId is correct and the the account has permissions" -Severity 'Error' + } + elseif ($ErrVar.Message -like '*InternalServerError*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Unable to connect to tenant '$tenantId'" -Severity 'Error' + } else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $_.Exception.Message -Severity 'Error' + } + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$($WorkspaceName)'" -Severity 'Information' + } + } + return $result + } + <# + .SYNOPSIS + Add a Microsoft Sentinel Workspace Manager Member + .DESCRIPTION + The Add-AzWorkspaceManagerMembers cmdlet adds a workspace manager member to the configuration. + These members are workspaces that are linked to the workspace manager configuration. and used to + provision Microsoft Sentinel workspaces. + The Workspace Manager Member name is constructed as follows: () + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER ResourceId + The ResourceId of the target workspace to add as a member + .PARAMETER TenantId + The TenantId of the target workspace to add as a member + .EXAMPLE + Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace" -TenantId "***" + + This example adds a Workspace Manager Member for the workspace with the name 'myWorkspace' and adds the workspace with the name 'myChildWorkspace' as a member. + .EXAMPLE + $resourceIds = @("/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myChildWorkspace", "/subscriptions/***/resourcegroups/myRemoteRG/providers/microsoft.operationalinsights/workspaces/myOtherWorkspace") + + PS > Add-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceId $resourceIds -TenantId "***" + + This example adds a multiple Members from from an array into the workspace manager with the name 'myWorkspace' + .LINK + Get-AzWorkspaceManagerMembers + Remove-AzWorkspaceManagerMembers + .NOTES + The Workspace Manager Member name is constructed as follows: () + #> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManager.ps1 b/src/Public/Get-AzWorkspaceManager.ps1 new file mode 100644 index 0000000..7d1a46c --- /dev/null +++ b/src/Public/Get-AzWorkspaceManager.ps1 @@ -0,0 +1,79 @@ +function Get-AzWorkspaceManager { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName + ) + + begin { + $MyInvocation.MyCommand.Name | Invoke-AzWorkspaceManager + } + + process { + if ($ResourceGroupName) { + Get-LogAnalyticsWorkspace -Name $Name -ResourceGroupName $ResourceGroupName + } + else { + Get-LogAnalyticsWorkspace -Name $Name + } + + try { + if ($SessionVariables.workspace) { + Write-Verbose "Get Microsoft Sentinel Workspace Manager Configuration for workspace '$Name'" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + } + $apiResponse = (Invoke-RestMethod @requestParam).value + } + else { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Microsoft Sentinel was not found under workspace '$Name'" -Severity 'Error' + } + + if ($apiResponse -ne '') { + $SessionVariables.workspaceManagerConfiguration = $apiResponse.properties.mode + $result = Format-Result -Message $apiResponse + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager is not configured for workspace '$Name'" -Severity 'Information' + $SessionVariables.workspaceManagerConfiguration = $false + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + } + } +<# + .SYNOPSIS + Gets the Microsoft Sentinel Workspace Manager + .DESCRIPTION + The Get-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration from the Log Analytics workspace. + You can retrieve the workspace manager configuration by using just provding a workspacename. + Only one workspace manager configuration can be added per Microsoft Sentinel instance + .PARAMETER Name + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .EXAMPLE + Get-AzWorkspaceManager -Name 'myWorkspace' + + This command gets the workspace manager for the workspace 'myWorkspace' + .EXAMPLE + Get-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' + + This command gets the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' + Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. + .LINK + Set-AzWorkspaceManager + Remove-AzWorkspaceManager +#> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManagerAssignmentJobs.ps1 b/src/Public/Get-AzWorkspaceManagerAssignmentJobs.ps1 new file mode 100644 index 0000000..c98c09c --- /dev/null +++ b/src/Public/Get-AzWorkspaceManagerAssignmentJobs.ps1 @@ -0,0 +1,121 @@ +function Get-AzWorkspaceManagerAssignmentJobs { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidateNotNullOrEmpty()] + [string]$JobName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceId + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($ResourceId) { + $uri = "https://management.azure.com$($ResourceId)/jobs?api-version=$($SessionVariables.apiVersion)" + } else { + if ($Name -and $JobName) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($Name)/jobs/$($JobName)?api-version=$($SessionVariables.apiVersion)" + } + elseif ($Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($Name)/jobs?api-version=$($SessionVariables.apiVersion)" + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No name for the workspace manager assignment or job was provided" -Severity 'Error' + } + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "List Microsoft Sentinel Workspace Manager Assignments Jobs for workspace '$WorkspaceName'" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + if ($JobName) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + elseif ($ResourceId -or $Name ) { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + foreach ($object in $apiResponse) { + $split = $object.id.Split('/') + $result += @( + [ordered]@{ + Name = $split[-1] + ResourceGroupName = $split[-11] + ResourceType = '{0}/{1}/{2}' -f $split[-5], $split[-4], $split[-2] + WorkspaceName = $WorkspaceName + ResourceId = $object.id + Properties = $object.properties + } | ConvertTo-Json -Depth 20 | ConvertFrom-Json -Depth 20 + ) + } + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No Workspace Manager Assignments Jobs found for workspace '$WorkspaceName'" -Severity 'Information' + break + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No Workspace Manager Assignment Job with name '$($JobName)' found for Assignment Group '$($Name)'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception.Message) -Severity 'Error' + } + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$WorkspaceName'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Get the Microsoft Sentinel Workspace Manager Groups + .DESCRIPTION + The Get-AzWorkspaceManagerAssignmentJobs cmdlet gets the Microsoft Sentinel Workspace Manager Assignment Jobs + It can be used to get all the Workspace Manager Assignment Jobs or a specific Workspace Manager Assignment Job by specifying the JobName. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + .PARAMETER JobName + The name of the Workspace Manager Assignment Job + .EXAMPLE + #> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManagerAssignments.ps1 b/src/Public/Get-AzWorkspaceManagerAssignments.ps1 new file mode 100644 index 0000000..2d1ab01 --- /dev/null +++ b/src/Public/Get-AzWorkspaceManagerAssignments.ps1 @@ -0,0 +1,105 @@ +function Get-AzWorkspaceManagerAssignments { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $false, ValueFromPipeline = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipeline = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipeline = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($null -ne $Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments?api-version=$($SessionVariables.apiVersion)" + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "List Microsoft Sentinel Workspace Manager Assignments for workspace '$WorkspaceName'" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + if ($Name) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + else { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + foreach ($object in $apiResponse) { + $result = Format-Result -Message $apiResponse + } + + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No Workspace Manager Assignments found for workspace '$WorkspaceName'" -Severity 'Information' + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No Workspace Manager Assignments with name '$($Name)' found under workspace '$WorkspaceName'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message (($ErrVar.ErrorRecord) | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$WorkspaceName'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Get the Microsoft Sentinel Workspace Manager Groups + .DESCRIPTION + The Get-AzWorkspaceManagerAssignments cmdlet gets the Microsoft Sentinel Workspace Manager Assignments by just specifying the workspace name + When the workspace manager configuration is not 'Enabled' for the workspace, the cmdlet will return an information message + If a Name is specified, the cmdlet will return the details of the workspace manager assignment + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The name of the workspace manager assignment + .EXAMPLE + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' + + This example gets all the Microsoft Sentinel Workspace Manager Assignments for the workspace 'MyWorkspace' + .EXAMPLE + Get-AzWorkspaceManagerAssignments -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerAssignment' + + This example gets the details of the Microsoft Sentinel Workspace Manager Assignment 'MyWorkspaceManagerAssignment' for the workspace 'MyWorkspace' + .LINK + Add-AzWorkspaceManagerAssignments + Remove-AzWorkspaceManagerAssignments + #> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManagerGroups.ps1 b/src/Public/Get-AzWorkspaceManagerGroups.ps1 new file mode 100644 index 0000000..ca3a5c1 --- /dev/null +++ b/src/Public/Get-AzWorkspaceManagerGroups.ps1 @@ -0,0 +1,109 @@ +function Get-AzWorkspaceManagerGroups { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidateNotNullOrEmpty()] + # [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$Name + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($null -ne $Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerGroups/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerGroups?api-version=$($SessionVariables.apiVersion)" + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "List Microsoft Sentinel Workspace Manager Groups for workspace [$WorkspaceName)]" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + if ($Name) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + else { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + foreach ($object in $apiResponse) { + $result = Format-Result -Message $apiResponse + } + + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No Workspace Manager Group(s) found for workspace '$WorkspaceName'" -Severity 'Information' + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($return.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$WorkspaceName'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Get the Microsoft Sentinel Workspace Manager Groups + .DESCRIPTION + The Get-AzWorkspaceManagerGroups cmdlet gets the Microsoft Sentinel Workspace Manager Groups by just specifying the workspace name + or by specifying the workspace name and the resource group name. The return value contains the details of the workspace manager groups + including the members. If no workspace manager groups are found, the cmdlet returns an information message. + If the workspace manager configuration is not enabled, the cmdlet returns an information message. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The name of the workspace manager group + .EXAMPLE + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' + .EXAMPLE + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + .EXAMPLE + Get-AzWorkspaceManagerGroups -WorkspaceName 'MyWorkspace' -Name 'MyWorkspaceManagerGroup' + + This example gets the Microsoft Sentinel Workspace Manager Group 'MyWorkspaceManagerGroup' for the workspace 'MyWorkspace' + .EXAMPLE + Get-AzWorkspaceManager -Name 'MyWorkspace' | Get-AzWorkspaceManagerGroups + + This example gets the Microsoft Sentinel Workspace Manager Groups for the workspace 'MyWorkspace' using the pipeline + .LINK + Add-AzWorkspaceManagerGroups + Remove-AzWorkspaceManagerGroups + Get-AzWorkspaceManager + #> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManagerItems.ps1 b/src/Public/Get-AzWorkspaceManagerItems.ps1 new file mode 100644 index 0000000..a6e0833 --- /dev/null +++ b/src/Public/Get-AzWorkspaceManagerItems.ps1 @@ -0,0 +1,121 @@ +function Get-AzWorkspaceManagerItems { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [string]$Name, + + [Parameter(Mandatory = $false)] + [ValidateSet('AlertRules', 'SavedSearches', 'AutomationRules')] + [string]$Type = 'AlertRules' + + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/$($Type)/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + if ($Type -eq 'SavedSearches') { + $uri = "$($SessionVariables.workspace)/savedsearches?api-version=2022-10-01" + } + else { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/$($Type)?api-version=$($SessionVariables.apiVersion)" + } + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + if ($Name) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + else { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + $result = @() + Foreach ($item in $apiResponse) { + $result += [ordered]@{ + Name = $item.Properties.DisplayName + ResourceId = $item.Id + WorkspaceName = $WorkspaceName + } | ConvertTo-Json | ConvertFrom-Json + } + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) "No $($Type) where found in workspace '$WorkspaceName'" -Severity 'Information' + break + } + } + catch { + Write-Output $_.Exception + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $($_.Exception) -Severity 'Error' + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$WorkspaceName'" -Severity 'Information' + } + } + <# + .SYNOPSIS + Gets a Microsoft Sentinel Workspace Manager Member + .DESCRIPTION + The Get-AzWorkspaceManagerItems is a helper command to get the resource ids of Microsoft Sentinel resources that can be added to assignments + Currently only three types of resources are supported: AlertRules, AutomationRules and SavedSearches. When using SavedSearches, the Name parameter + This command currently not supports pipeline input and is still in development. + is ignored due to API limitations. + .PARAMETER WorkspaceName + Enter the Name of the log analytics workspace + .PARAMETER ResourceGroupName + Enter the name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + Enter the name of the resource to get + .PARAMETER Type + Select the type of resource to get. Currently only AlertRules, AutomationRules and SavedSearches are supported + .EXAMPLE + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Name 'MyAlertRule' -Type 'AlertRules' + + This example gets the resource id of the AlertRule 'MyAlertRule' in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + .EXAMPLE + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AlertRules' + + This example gets the resource ids of all AlertRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + .EXAMPLE + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'SavedSearches' + + This example gets the resource ids of all SavedSearches in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + .EXAMPLE + Get-AzWorkspaceManagerItems -WorkspaceName 'MyWorkspace' -ResourceGroupName 'MyResourceGroup' -Type 'AutomationRules' + + This example gets the resource ids of all AutomationRules in the log analytics workspace 'MyWorkspace' in the resource group 'MyResourceGroup' + .NOTES + This command currently not supports pipeline input and is still in development. + #> +} \ No newline at end of file diff --git a/src/Public/Get-AzWorkspaceManagerMembers.ps1 b/src/Public/Get-AzWorkspaceManagerMembers.ps1 new file mode 100644 index 0000000..8eb53d8 --- /dev/null +++ b/src/Public/Get-AzWorkspaceManagerMembers.ps1 @@ -0,0 +1,111 @@ +function Get-AzWorkspaceManagerMembers { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($null -eq $Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerMembers?api-version=$($SessionVariables.apiVersion)" + } + else { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerMembers/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + + if ($SessionVariables.workspaceManagerConfiguration -eq 'Enabled') { + try { + Write-Verbose "Get Workspace Manager Member(s) for workspace [$($WorkspaceName)]" + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + if ($Name) { + $apiResponse = (Invoke-RestMethod @requestParam) + } + else { + $apiResponse = (Invoke-RestMethod @requestParam).value + } + + if ($apiResponse -ne '') { + $result += Format-Result -Message $apiResponse + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) "No Workspace Manager Member(s) found for workspace '$WorkspaceName'" -Severity 'Information' + break + } + } + catch { + $SessionVariables.workspace = $null + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Workspace Manager Member '$($Name)' was not found under workspace '$WorkspaceName'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $_.Exception.Message -Severity 'Error' + } + break + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager configuration is not 'Enabled' for workspace '$($WorkspaceName)'" -Severity 'Information' + break + } + } + <# + .SYNOPSIS + Gets a Microsoft Sentinel Workspace Manager Member + .DESCRIPTION + The Get-AzWorkspaceManagerMembers cmdlet gets workspace manager member(s) from the configuration. + If the workspace manager member name is not provided, all the workspace manager members for the workspace will be returned. + When the workspace manager member name is provided, the workspace manager member details will be returned. + .PARAMETER WorkspaceName + Enter the Name of the log analytics workspace + .PARAMETER ResourceGroupName + Enter the name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + Enter the name of the workspace manager member + .EXAMPLE + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' + .EXAMPLE + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroupName "myResourceGroup" + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' in the resource group 'myResourceGroup' + .EXAMPLE + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" + + This example gets the Microsoft Sentinel Workspace Manager Member 'myChildWorkspace(***)' for the workspace 'MyWorkspace' + .EXAMPLE + Get-AzWorkspaceManager -Name "myWorkspace" | Get-AzWorkspaceManagerMembers + + This example gets the Microsoft Sentinel Workspace Manager Members for the workspace 'MyWorkspace' using pipeline + .LINK + Add-AzWorkspaceManagerMembers + Remove-AzWorkspaceManagerMembers + #> +} \ No newline at end of file diff --git a/src/Public/Remove-AzWorkspaceManager.ps1 b/src/Public/Remove-AzWorkspaceManager.ps1 new file mode 100644 index 0000000..8b1d99d --- /dev/null +++ b/src/Public/Remove-AzWorkspaceManager.ps1 @@ -0,0 +1,85 @@ +function Remove-AzWorkspaceManager { + [cmdletbinding(SupportsShouldProcess=$true, ConfirmImpact='High')] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + Write-Verbose "Resource Group Name: $ResourceGroupName" + $null = Get-AzWorkspaceManager -Name $Name -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $Name + } + if ($Force){ + $ConfirmPreference = 'None' + } + + try { + if ($PSCmdlet.ShouldProcess($SessionVariables.workspaceManagerConfiguration -eq 'Enabled', "Remove '$($Name)")) { + Write-Verbose "Performing the operation 'Removing workspace manager ...' on target '$Name'" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'DELETE' + } + + $reponse = Invoke-RestMethod @requestParam + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager Configuration '$Name' removed" -Severity 'Information' + return $reponse + } + else { + Write-Debug "User has aborted" + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($return.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } +<# + .SYNOPSIS + Remove Microsoft Sentinel Workspace Manager + .DESCRIPTION + The Remove-AzWorkspaceManager cmdlet retrieves a Workspace Manager Configuration and removes + it from the Log Analytics workspace. You can remove the workspace manager configuration by + just providing a workspacename. + .PARAMETER Name + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Force + Confirms the removal of the Workspace manager configuration. + .EXAMPLE + Remove-AzWorkspaceManager -Name 'myWorkspace' -Force + + This command removes the workspace manager on the Sentinel workspace 'myWorkspace' + .EXAMPLE + Remove-AzWorkspaceManager -Name sentinel-playground -Force + + This command removes the workspace manager on the Sentinel workspace 'myWorkspace' without confirmation' + + .EXAMPLE + Get-AzWorkspaceManager -Name sentinel-playground | Remove-AzWorkspaceManager -Force + + This command removes the workspace manager based on a pipeline value from the Get-AzWorkspaceManager cmdlet + .LINK + Get-AzWorkspaceManager + Set-AzWorkspaceManager +#> +} \ No newline at end of file diff --git a/src/Public/Remove-AzWorkspaceManagerAssignmentJobs.ps1 b/src/Public/Remove-AzWorkspaceManagerAssignmentJobs.ps1 new file mode 100644 index 0000000..f42a58e --- /dev/null +++ b/src/Public/Remove-AzWorkspaceManagerAssignmentJobs.ps1 @@ -0,0 +1,124 @@ +function Remove-AzWorkspaceManagerAssignmentJobs { + [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [ValidateNotNullOrEmpty()] + [string]$AssignmentName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [array]$ResourceId, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $($WorkspaceName) -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $($WorkspaceName) + } + + if ($Force) { + $ConfirmPreference = 'None' + } + + try { + Write-Verbose "Performing the operation 'Removing workspace manager assignment' on target '$($WorkspaceName)'." + if ($ResourceId) { + $uri = "https://management.azure.com$($ResourceId)?api-version=$($SessionVariables.apiVersion)" + $name = $ResourceId.Split('/')[-1] + } elseif ($Name -and $AssignmentName) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($AssignmentName)/jobs/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No name for the workspace manager assignment or job was provided" -Severity 'Error' + } + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + + if ($apiResponse -ne '') { + if ($PSCmdlet.ShouldProcess($SessionVariables.workspaceManagerConfiguration -eq 'Enabled', "Remove Workspace Manager Assignment Job '$($Name)'")) { + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'DELETE' + ErrorVariable = 'ErrVar' + } + + Invoke-RestMethod @requestParam + + if ($null -eq $response) { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager Assignment Job '$($name)' was removed." -Severity 'Information' + } + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager Assignment Job '$($name)' does not exist" -Severity 'Error' + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Workspace Manager Assignment Job '$($name)' was not found under Assignment '$($AssignmentName)'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($return.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + <# + .SYNOPSIS + Get the Microsoft Sentinel Workspace Manager Groups + .DESCRIPTION + The Remove-AzWorkspaceManagerAssignmentJobs cmdlet removes the Workspace Manager Assignment Jobs from the Workspace Manager Assignment. + When the Workspace Manager Assignment is removed, all the Workspace Manager Assignment Jobs are removed as well. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER AssignmentName + The name of the workspace manager assignment (default this has the same value as the Workspace Manager GroupName) + .PARAMETER JobName + The name of the Workspace Manager Assignment Job + .PARAMETER Force + Confirms the removal of the Workspace manager configuration + .EXAMPLE + Remove-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -ResourceGroupName 'myRG' -AssignmentName 'myAssignment' -JobName 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' + + This example removes the Workspace Manager Assignment Job 'e53fa65b-1e2d-48cd-b079-a596dc6ea5a1' from the Workspace Manager Assignment 'myAssignment' in the log analytics workspace 'myWorkspace' in the resource group 'myRG' + .EXAMPLE + Get-AzWorkspaceManagerAssignmentJobs -WorkspaceName 'myWorkspace' -Name 'MyWorkspaceManagerAssignment' | Remove-AzWorkspaceManagerAssignmentJobs -Force + + This example removes all the Workspace Manager Assignment Jobs from the Workspace Manager Assignment 'MyWorkspaceManagerAssignment' without prompting for confirmation + .EXAMPLE + Get-AzWorkspaceManagerAssignments -WorkspaceName 'sentinel-playground' | Get-AzWorkspaceManagerAssignmentJobs | Remove-AzWorkspaceManagerAssignmentJobs -Force + + This example removes all the Workspace Manager Assignment Jobs from all the Workspace Manager Assignments in the log analytics workspace 'sentinel-playground' without prompting for confirmation + #> +} \ No newline at end of file diff --git a/src/Public/Remove-AzWorkspaceManagerAssignments.ps1 b/src/Public/Remove-AzWorkspaceManagerAssignments.ps1 new file mode 100644 index 0000000..f2ab370 --- /dev/null +++ b/src/Public/Remove-AzWorkspaceManagerAssignments.ps1 @@ -0,0 +1,128 @@ +function Remove-AzWorkspaceManagerAssignments { + [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $false)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage="It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [array]$ResourceId, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($Force) { + $ConfirmPreference = 'None' + } + + Write-Debug "WorkspaceName: $($WorkspaceName)" + Write-Debug "ResourceGroupName: $($ResourceGroupName)" + Write-Debug "Name: $($Name)" + Write-Debug "ResourceId: $($ResourceId)" + + try { + if ($ResourceId) { + $uri = "https://management.azure.com$($ResourceId)?api-version=$($SessionVariables.apiVersion)" + $Name = $ResourceId.Split('/')[-1] + } + elseif ($Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No name for the workspace manager assignment was provided" -Severity 'Error' + } + Write-Debug "Performing the operation 'Removing workspace manager assignment'" + Write-Debug "Request URI: $($uri)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + $apiResponse = Invoke-RestMethod @requestParam + + if ($apiResponse -ne '') { + if ($PSCmdlet.ShouldProcess($SessionVariables.workspaceManagerConfiguration -eq 'Enabled', "Remove Workspace Manager Assignment '$Name'")) { + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'DELETE' + ErrorVariable = 'ErrVar' + } + + Write-Verbose "Performing the operation 'Removing workspace manager assignment'" + Write-Verbose "Request URI: $($uri)" + Invoke-RestMethod @requestParam + + Write-Host $response + if ($null -eq $response) { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager Assignment '$($Name)' was removed from workspace '$WorkspaceName'" -Severity 'Information' + } + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager Assignment '$($Name)' does not exist" -Severity 'Error' + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Workspace Manager Assignment '$($Name)' was not found under workspace '$WorkspaceName'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($_.Exception.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + <# + .SYNOPSIS + Remove Microsoft Sentinel Workspace Manager Assignment + .DESCRIPTION + The Remove-AzWorkspaceManagerAssignments cmdlet removes a Workspace Manager Assignment from a Microsoft Sentinel Workspace. + The cmdlet will not return an error if the Workspace Manager Assignment does not exist. + The Assignment must first be removed from the Workspace Manager Group before the group can be removed. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The Name of the Workspace Manager Assignment + .PARAMETER Force + Confirms the removal of the Workspace manager configuration. + .EXAMPLE + Remove-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' -ResourceGroupName 'myRG' -Name 'myAssignment' + + This command removes the Workspace Manager Assignment 'myAssignment' from the workspace 'ContosoWorkspace' in the resource group 'myRG'. + .EXAMPLE + Get-AzWorkspaceManagerAssignments -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerAssignments -Force + + This example removes all Workspace Manager Assignments from the workspace 'ContosoWorkspace' in the resource group 'myRG' without prompting for confirmation. + .LINK + Get-AzWorkspaceManagerAssignments + Remove-AzWorkspaceManagerAssignments + #> +} \ No newline at end of file diff --git a/src/Public/Remove-AzWorkspaceManagerGroups.ps1 b/src/Public/Remove-AzWorkspaceManagerGroups.ps1 new file mode 100644 index 0000000..006d63e --- /dev/null +++ b/src/Public/Remove-AzWorkspaceManagerGroups.ps1 @@ -0,0 +1,115 @@ +function Remove-AzWorkspaceManagerGroups { + [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($Force) { + $ConfirmPreference = 'None' + } + + try { + Write-Verbose "Performing the operation 'Removing workspace manager group' on target '$Name'" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerGroups/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + $apiResponse = Invoke-RestMethod @requestParam + + if ($apiResponse -ne '') { + if ($PSCmdlet.ShouldProcess($SessionVariables.workspaceManagerConfiguration -eq 'Enabled', "Remove Workspace Manager Group $($Name)")) { + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'DELETE' + ErrorVariable = 'ErrVar' + } + + Invoke-RestMethod @requestParam + + if ($null -eq $response) { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager Group '$($Name)' was removed from workspace '$WorkspaceName'" -Severity 'Information' + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Workspace Manager Group '$($Name)' was not removed from workspace '$WorkspaceName'" -Severity 'Information' + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager Group '$($Name)' does not exist" -Severity 'Error' + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Workspace Manager Group '$($Name)' was not found under workspace '$WorkspaceName'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($return.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + <# + .SYNOPSIS + Remove Microsoft Sentinel Workspace Manager + .DESCRIPTION + This command removes a Workspace Manager Group from a Microsoft Sentinel Workspace. + If the Workspace Manager Group does not exist, the command will return an error. + When the Workspace Manager Group is removed the members of the group will no longer receive updates from the workspace. + If an assigment is still available for the group, the group cannot be removed. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The Name of the Workspace Manager Group + .PARAMETER Force + Confirms the removal of the Workspace manager configuration. + .EXAMPLE + Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -Name 'myChildWorkspace' + + This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' + .EXAMPLE + Remove-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' -ResourceGroupName 'myWorkspaceManagerGroup' -Name 'myChildWorkspace' -Force + + This example removes the Workspace Manager Group 'myChildWorkspace' from the workspace 'myWorkspace' in the resource group 'myWorkspaceManagerGroup' without prompting for confirmation + .EXAMPLE + Get-AzWorkspaceManagerGroups -WorkspaceName 'myWorkspace' | Remove-AzWorkspaceManagerGroups -Force + + This example removes all Workspace Manager Groups from the workspace 'myWorkspace' without prompting for confirmation using the pipeline + .LINK + Get-AzWorkspaceManagerGroups + Remove-AzWorkspaceManagerGroups + #> +} \ No newline at end of file diff --git a/src/Public/Remove-AzWorkspaceManagerMembers.ps1 b/src/Public/Remove-AzWorkspaceManagerMembers.ps1 new file mode 100644 index 0000000..38ae32d --- /dev/null +++ b/src/Public/Remove-AzWorkspaceManagerMembers.ps1 @@ -0,0 +1,128 @@ +function Remove-AzWorkspaceManagerMembers { + [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$WorkspaceName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [array]$ResourceId, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + $null = Get-AzWorkspaceManager -Name $WorkspaceName -ResourceGroupName $ResourceGroupName + } + else { + $null = Get-AzWorkspaceManager -Name $WorkspaceName + } + + if ($Force) { + $ConfirmPreference = 'None' + } + + try { + if ($ResourceId) { + $uri = "https://management.azure.com$($ResourceId)?api-version=$($SessionVariables.apiVersion)" + $name = $ResourceId.Split('/')[-1] + } + elseif ($Name) { + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerMembers/$($Name)?api-version=$($SessionVariables.apiVersion)" + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "No name for the workspace manager member was provided" -Severity 'Error' + } + + Write-Verbose "Performing the operation 'Removing workspace manager member' on target '$Name'" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerMembers/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'GET' + ErrorVariable = 'ErrVar' + } + + $apiResponse = Invoke-RestMethod @requestParam + + if ($apiResponse -ne '') { + if ($PSCmdlet.ShouldProcess($SessionVariables.workspaceManagerConfiguration -eq 'Enabled', "Remove Workspace Manager Member '$($Name)")) { + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'DELETE' + ErrorVariable = 'ErrVar' + } + + Invoke-RestMethod @requestParam + + Write-Host $response + if ($null -eq $response) { + Write-Message -Message "Workspace Manager Member '$($Name)' was removed from workspace '$WorkspaceName'" -Severity 'Information' -FunctionName $($MyInvocation.MyCommand.Name) + } + } + else { + Write-Debug "User has aborted" + } + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "The Workspace Manager Member '$($Name)' was not found" -Severity 'Error' + } + } + catch { + if ($ErrVar.Message -like '*ResourceNotFound*') { + Write-Message -FunctionName $MyInvocation.MyCommand.Name -Message "Workspace Manager Member '$($Name)' was not found under workspace '$WorkspaceName'" -Severity 'Error' + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message ($return.ErrorRecord | ConvertFrom-Json).error.message -Severity 'Error' + } + } + } + <# + .SYNOPSIS + Remove a Workspace Manager Member + .DESCRIPTION + The Remove-AzWorkspaceManagerMembers cmdlet removes a workspace manager member to the configuration. + .PARAMETER WorkspaceName + The Name of the log analytics workspace + .PARAMETER ResourceGroupName + The name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Name + The Name of the Workspace Manager Member + .PARAMETER ResourceId + The ResourceId of the target workspace manager member to remove + .PARAMETER Force + Confirms the removal of the Workspace manager configuration. + .EXAMPLE + Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -Name "myChildWorkspace(***)" + + This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' with confirmation + .EXAMPLE + Remove-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" -ResourceGroup "myRG" -Name "myChildWorkspace(***)" -Force + + This example removes the workspace manager member myChildWorkspace from the workspace configuration 'myWorkspace' without confirmation + .EXAMPLE + Get-AzWorkspaceManagerMembers -WorkspaceName "myWorkspace" | Remove-AzWorkspaceManagerMembers -Force + + This example removes all workspace manager members from the workspace configuration 'myWorkspace' using pipeline input without confirmation + .LINK + Get-AzWorkspaceManagerMembers + Add-AzWorkspaceManagerMembers + #> +} \ No newline at end of file diff --git a/src/Public/Set-AzWorkspaceManager.ps1 b/src/Public/Set-AzWorkspaceManager.ps1 new file mode 100644 index 0000000..7457468 --- /dev/null +++ b/src/Public/Set-AzWorkspaceManager.ps1 @@ -0,0 +1,116 @@ +function Set-AzWorkspaceManager { + [cmdletbinding()] + param ( + [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)] + [ValidateNotNullOrEmpty()] + [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$', ErrorMessage = "It does not match expected pattern '{1}'")] + [string]$Name, + + [Parameter(Mandatory = $false, ValueFromPipelineByPropertyName = $true)] + [string]$ResourceGroupName, + + [Parameter(Mandatory = $false, ValueFromPipeline = $true)] + [ValidateSet("Enabled", "Disabled")] + [string]$Mode = 'Enabled' + ) + + begin { + Invoke-AzWorkspaceManager -FunctionName $MyInvocation.MyCommand.Name + } + + process { + if ($ResourceGroupName) { + Get-LogAnalyticsWorkspace -Name $Name -ResourceGroupName $ResourceGroupName + } + else { + Get-LogAnalyticsWorkspace -Name $Name + } + + $payload = @{ + properties = @{ + mode = "$Mode" + } + } | ConvertTo-Json -Compress + + try { + if ($SessionVariables.workspace) { + Write-Verbose "Configuring Microsoft Sentinel Workspace Manager Configuration for workspace [$Name]" + $uri = "$($SessionVariables.workspace)/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/$($Name)?api-version=$($SessionVariables.apiVersion)" + + $requestParam = @{ + Headers = $authHeader + Uri = $uri + Method = 'PUT' + Body = $payload + ContentType = 'application/json' + ErrorVariable = "ErrVar" + } + + $apiResponse = Invoke-RestMethod @requestParam + $result = Format-Result -Message $apiResponse + return $result + } + else { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message "Error configuring Workspace Manager for workspace $($Name)" -Severity 'Error' + } + } + catch { + Write-Message -FunctionName $($MyInvocation.MyCommand.Name) -Message $ErrVar -Severity 'Error' + } + } + <# + .SYNOPSIS + Creates a Workspace Manager Configuration + .DESCRIPTION + The Set-AzWorkspaceManager cmdlet creates a Workspace Manager Configuration that is required to use workspace manager feature. + You can create a workspace manager configuration by using just a workspacename. The minimum requirement to to enable the + workspace manager is that Microsoft Sentinel is enabled on the Log Analytics workspace. + Only one workspace manager configuration can be added per Microsoft Sentinel instance. + .PARAMETER Name + Name of the log analytics workspace + .PARAMETER ResourceGroupName + Name of the ResouceGroup where the log analytics workspace is located + .PARAMETER Mode + Status of the Workspace Manager (Enabled or Disabled) + .LINK + Get-AzWorkspaceManager + Remove-AzWorkspaceManager + .EXAMPLE + Set-AzWorkspaceManager -Name 'myWorkspace' + + Name : myWorkspace + ResourceGroupName : myRG + ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations + WorkspaceName : myWorkspace + ResourceId : /subscriptions//resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace + Tags : + Properties : @{mode=Enabled} + + This command creates / enables the workspace manager on the Sentinel workspace 'myWorkspace' + .EXAMPLE + Set-AzWorkspaceManager -Name 'myworkspace' -Mode 'Disabled' + + Name : myWorkspace + ResourceGroupName : myRG + ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations + WorkspaceName : myWorkspace + ResourceId : /subscriptions//resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace + Tags : + Properties : @{mode=Disabled} + + This command sets the workspace manager to disabled + .EXAMPLE + Set-AzWorkspaceManager -Name 'myWorkspace' -ResourceGroupName 'myRG' + + Name : myWorkspace + ResourceGroupName : myRG + ResourceType : Microsoft.SecurityInsights/workspaceManagerConfigurations + WorkspaceName : myWorkspace + ResourceId : /subscriptions//resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/myWorkspace + Tags : + Properties : @{mode=Enabled} + + This command enables the workspace manager for the workspace 'myWorkspace' in resource group 'myRg' + Specifying the resource group is only needed if multiple workspaces with the same name are available in the subscription. +#> +} \ No newline at end of file