Skip to content
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,9 @@ public SqlVulnerabilityAssessmentTests(Xunit.Abstractions.ITestOutputHelper outp
*/
[Fact]
[Trait(Category.AcceptanceType, Category.LiveOnly)]
public void TestAzSecuritySqlVulnerabilityAssessment()
public void TestAzSecuritySecuritySqlVulnerabilityAssessment()
{
TestController.NewInstance.RunPowerShellTest(_logger, "Test-AzSecuritySqlVulnerabilityAssessment");
TestController.NewInstance.RunPowerShellTest(_logger, "Test-AzSecuritySecuritySqlVulnerabilityAssessment");
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -19,48 +19,48 @@
New-AzMonitorLogAnalyticsSolution cmdlet depends on Az.MonitoringSolution
which is a generated module and is not currently supported by the testing framework
#>
function Test-AzSecuritySqlVulnerabilityAssessment
function Test-AzSecuritySecuritySqlVulnerabilityAssessment
{
# Setup
$testPrefix = "pssqlva"
$testParams = Get-SqlVulnerabilityAssessmentTestEnvironmentParameters $testPrefix
$testParams = Get-SecuritySqlVulnerabilityAssessmentTestEnvironmentParameters $testPrefix
$vmResourceId = "/subscriptions/" + $testParams.subscriptionId + "/resourceGroups/" + $testParams.rgName + "/providers/Microsoft.Compute/VirtualMachines/" + $testParams.sqlVmNamePrefix
Create-TestEnvironmentWithParams $testParams

$vaScanRecord = Get-AzSqlVulnerabilityAssessmentScanRecord -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId latest
$resultsOnMaster = Get-AzSqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master
$vaScanRecord = Get-AzSecuritySqlVulnerabilityAssessmentScanRecord -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId latest
$resultsOnMaster = Get-AzSecuritySqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master
$resultsWithFindingsOnMaster = $resultsOnMaster | where { $_.Status -eq "Finding" }

Assert-True { $resultsOnMaster.Count -eq $vaScanRecord.TotalRulesCount }
Assert-True { $resultsWithFindingsOnMaster.Count -eq $vaScanRecord.TotalFailedRulesCount }

$finding = $resultsWithFindingsOnMaster | select -first 1
$ruleResult = Get-AzSqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId $vaScanRecord.Name -RuleId $finding.Name
$ruleResult = Get-AzSecuritySqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId $vaScanRecord.Name -RuleId $finding.Name

Assert-True { $finding.Name -eq $ruleResult.Name }

# check add baseline with latest.
Add-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name
Add-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name

$baseline = Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name
$baseline = Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name

Assert-NotNull $baseline

$baseline | Remove-AzSqlVulnerabilityAssessmentBaseline -Force
$baseline | Remove-AzSecuritySqlVulnerabilityAssessmentBaseline -Force

Assert-Throws { Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name }
Assert-Throws { Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name }

# check Add baseline with result
Add-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name -Baseline $finding.QueryResults
Add-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name -Baseline $finding.QueryResults

$baseline = Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name
$baseline = Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $finding.Name
Assert-NotNull $baseline

$baseline | Remove-AzSqlVulnerabilityAssessmentBaseline -Force
$baseline | Remove-AzSecuritySqlVulnerabilityAssessmentBaseline -Force

### Check piping

$resultsOnMsdb = Get-AzSqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb
$resultsOnMsdb = Get-AzSecuritySqlVulnerabilityAssessmentScanResult -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb
$resultsWithFindingsOnMsdb = $resultsOnMsdb | where { $_.Status -eq "Finding" }
$rulesNamesOnMsdb = $resultsWithFindingsOnMsdb | select -ExpandProperty Name
$rulesNamesOnMaster = $resultsWithFindingsOnMaster | select -ExpandProperty Name
Expand All @@ -71,29 +71,29 @@ function Test-AzSecuritySqlVulnerabilityAssessment
if ($ruleWithFindingsOnBothDbs.Count -gt 0)
{
# add baseline on master
Add-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $ruleWithFindingsOnBothDbs[0]
Add-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $ruleWithFindingsOnBothDbs[0]

# bypass it to msdb
Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $ruleWithFindingsOnBothDbs[0] `
| Add-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb
Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -RuleId $ruleWithFindingsOnBothDbs[0] `
| Add-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb

$baseline = Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb -RuleId $ruleWithFindingsOnBothDbs[0]
$baseline = Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database msdb -RuleId $ruleWithFindingsOnBothDbs[0]
Assert-NotNull $baseline
}

# Set all latest results as Baseline
Set-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -Force
$vaScanRecord = Get-AzSqlVulnerabilityAssessmentScanRecord -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId latest
Set-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -Force
$vaScanRecord = Get-AzSecuritySqlVulnerabilityAssessmentScanRecord -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -ScanId latest

Assert-True { $vaScanRecord.State -eq "Passed"}
Assert-True { $vaScanRecord.TotalFailedRulesCount -eq 0 }

Get-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master | Remove-AzSqlVulnerabilityAssessmentBaseline -Force
Get-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master | Remove-AzSecuritySqlVulnerabilityAssessmentBaseline -Force

$baselineSet = @{}
$resultsWithFindingsOnMaster | select -skip 3 | ForEach-Object { $baselineSet.Add($_.RuleId, $_.QueryResults)}

Set-AzSqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -BaselineSet $baselineSet -Force
Set-AzSecuritySqlVulnerabilityAssessmentBaseline -ResourceId $vmResourceId -WorkspaceId $testParams.workspaceId -Server $testParams.sqlServerName -Database master -BaselineSet $baselineSet -Force

Delete-TestEnvironments ($testParams)
}
Expand All @@ -102,7 +102,7 @@ function Test-AzSecuritySqlVulnerabilityAssessment
.SYNOPSIS
Gets the values of the parameters used at the tests
#>
function Get-SqlVulnerabilityAssessmentTestEnvironmentParameters ($testPrefix)
function Get-SecuritySqlVulnerabilityAssessmentTestEnvironmentParameters ($testPrefix)
{
$location = Get-Location "Microsoft.Compute" "virtualMachines" "East Us 2 Euap";
$sqlVmName = getAssetName ($testPrefix +'vm');
Expand Down Expand Up @@ -165,7 +165,7 @@ function Create-TestEnvironmentWithParams ($testParams)
-Location $testParams.vmLocation

# Update the registery and restart the Monitoring agent to force a scan.
Invoke-AzVMRunCommand -ResourceGroupName $testParams.rgName -Name $testParams.sqlVmNamePrefix -CommandId 'RunPowerShellScript' -ScriptPath 'SqlVulnerabilityAssessmentTestResources\SetUpVm.ps1'
Invoke-AzVMRunCommand -ResourceGroupName $testParams.rgName -Name $testParams.sqlVmNamePrefix -CommandId 'RunPowerShellScript' -ScriptPath 'SecuritySqlVulnerabilityAssessmentTestResources\SetUpVm.ps1'

Start-Sleep -Seconds 180
}
Expand Down
12 changes: 6 additions & 6 deletions src/Security/Security/Az.Security.psd1
Original file line number Diff line number Diff line change
Expand Up @@ -89,12 +89,12 @@ CmdletsToExport = 'Get-AzSecurityAlert', 'Set-AzSecurityAlert',
'Get-AzSecurityAdvancedThreatProtection',
'Enable-AzSecurityAdvancedThreatProtection',
'Disable-AzSecurityAdvancedThreatProtection',
'Get-AzSqlVulnerabilityAssessmentScanRecord',
'Get-AzSqlVulnerabilityAssessmentScanResult',
'Add-AzSqlVulnerabilityAssessmentBaseline',
'Remove-AzSqlVulnerabilityAssessmentBaseline',
'Get-AzSqlVulnerabilityAssessmentBaseline',
'Set-AzSqlVulnerabilityAssessmentBaseline',
'Get-AzSecuritySqlVulnerabilityAssessmentScanRecord',
'Get-AzSecuritySqlVulnerabilityAssessmentScanResult',
'Add-AzSecuritySqlVulnerabilityAssessmentBaseline',
'Remove-AzSecuritySqlVulnerabilityAssessmentBaseline',
'Get-AzSecuritySqlVulnerabilityAssessmentBaseline',
'Set-AzSecuritySqlVulnerabilityAssessmentBaseline',
'Get-AzIotSecuritySolution', 'Set-AzIotSecuritySolution',
'Remove-AzIotSecuritySolution', 'Update-AzIotSecuritySolution',
'New-AzIotSecuritySolutionRecommendationConfigurationObject',
Expand Down
12 changes: 6 additions & 6 deletions src/Security/Security/ChangeLog.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@

## Upcoming Release
* Added Sql Vulnerability Assessment cmdlets for IAAS:
`Get-AzSqlVulnerabilityAssessmentScanRecord`
`Get-AzSqlVulnerabilityAssessmentScanResult`
`Add-AzSqlVulnerabilityAssessmentBaseline`
`Remove-AzSqlVulnerabilityAssessmentBaseline`
`Get-AzSqlVulnerabilityAssessmentBaseline`
`Set-AzSqlVulnerabilityAssessmentBaseline`
`Get-AzSecuritySqlVulnerabilityAssessmentScanRecord`
`Get-AzSecuritySqlVulnerabilityAssessmentScanResult`
`Add-AzSecuritySqlVulnerabilityAssessmentBaseline`
`Remove-AzSecuritySqlVulnerabilityAssessmentBaseline`
`Get-AzSecuritySqlVulnerabilityAssessmentBaseline`
`Set-AzSecuritySqlVulnerabilityAssessmentBaseline`

## Version 0.9.0
* Added breaking change notification in AzSecurityAlert:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@

namespace Microsoft.Azure.Commands.SecurityCenter.Cmdlets.SqlVulnerabilityAssessment
{
[Cmdlet(VerbsCommon.Add, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlVulnerabilityAssessmentBaseline"),OutputType(typeof(PSSqlVulnerabilityAssessmentBaselineResults))]
public class AddSqlVulnerabilityAssessmentBaselineRule : SqlVulnerabilityAssessmentBaseWithBaseline
[Cmdlet(VerbsCommon.Add, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SecuritySqlVulnerabilityAssessmentBaseline", DefaultParameterSetName = ParameterSetNames.ResourceIdWithBaselineObject, SupportsShouldProcess = true), OutputType(typeof(PSSqlVulnerabilityAssessmentBaselineResults))]
public class AddSecuritySqlVulnerabilityAssessmentBaseline : SqlVulnerabilityAssessmentBaseWithBaseline
{
[Parameter(ParameterSetName = ParameterSetNames.ResourceIdWithBaselineObject, Mandatory = true, HelpMessage = ParameterHelpMessages.RuleId)]
[Parameter(ParameterSetName = ParameterSetNames.OnPremMachinesWithBaselineObject, Mandatory = true, HelpMessage = ParameterHelpMessages.RuleId)]
Expand All @@ -31,21 +31,27 @@ public override void ExecuteCmdlet()
{
foreach (var rule in InputObject.Results)
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(rule.Name, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, results: rule.Results).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
if (ShouldProcess(rule.Name, $"Adding baseline for {databaseResourceId}."))
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(rule.Name, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, results: rule.Results).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
}
}
}
else
{
if (Baseline == null)
if (ShouldProcess(RuleId, $"Adding baseline for {databaseResourceId}."))
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(RuleId, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, latestScan: true).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
}
else
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(RuleId, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, results: Baseline).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
if (Baseline == null)
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(RuleId, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, latestScan: true).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
}
else
{
var results = SecurityCenterClient.SqlVulnerabilityAssessmentBaselineRules.CreateOrUpdateWithHttpMessagesAsync(RuleId, WorkspaceId, VulnerabilityAssessmentConstants.ApiVersion, databaseResourceId, results: Baseline).GetAwaiter().GetResult().Body;
WriteObject(results?.ConvertToPSType());
}
}
}
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@

namespace Microsoft.Azure.Commands.SecurityCenter.Cmdlets.SqlVulnerabilityAssessment
{
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlVulnerabilityAssessmentBaseline", DefaultParameterSetName = ParameterSetNames.ResourceId), OutputType(typeof(PSSqlVulnerabilityAssessmentBaselineResults))]
public class GetSqlVulnerabilityAssessmentBaseline : SqlVulnerabilityAssessmentCmdlet
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SecuritySqlVulnerabilityAssessmentBaseline", DefaultParameterSetName = ParameterSetNames.ResourceId), OutputType(typeof(PSSqlVulnerabilityAssessmentBaselineResults))]
public class GetSecuritySqlVulnerabilityAssessmentBaseline : SqlVulnerabilityAssessmentCmdlet
{
[Parameter(ParameterSetName = ParameterSetNames.ResourceId, Mandatory = false, HelpMessage = ParameterHelpMessages.RuleId)]
[Parameter(ParameterSetName = ParameterSetNames.OnPremMachines, Mandatory = false, HelpMessage = ParameterHelpMessages.RuleId)]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@

namespace Microsoft.Azure.Commands.Security.Cmdlets.SqlVulnerabilityAssessment
{
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlVulnerabilityAssessmentScanRecord"), OutputType(typeof(PSSqlVulnerabilityAssessmentScanRecord))]
public class GetSqlVulnerabilityAssessmentScanRecord : SqlVulnerabilityAssessmentCmdlet
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SecuritySqlVulnerabilityAssessmentScanRecord", DefaultParameterSetName = ParameterSetNames.ResourceId), OutputType(typeof(PSSqlVulnerabilityAssessmentScanRecord))]
public class GetSecuritySqlVulnerabilityAssessmentScanRecord : SqlVulnerabilityAssessmentCmdlet
{
[Parameter(ParameterSetName = ParameterSetNames.ResourceId, Mandatory = false, HelpMessage = ParameterHelpMessages.ScanId)]
[Parameter(ParameterSetName = ParameterSetNames.OnPremMachines, Mandatory = false, HelpMessage = ParameterHelpMessages.ScanId)]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@

namespace Microsoft.Azure.Commands.SecurityCenter.Cmdlets.SqlVulnerabilityAssessment
{
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlVulnerabilityAssessmentScanResult"), OutputType(typeof(PSSqlVulnerabilityAssessmentScanResult))]
public class GetSqlVulnerabilityAssessmentScanResult : SqlVulnerabilityAssessmentCmdlet
[Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SecuritySqlVulnerabilityAssessmentScanResult", DefaultParameterSetName = ParameterSetNames.ResourceId), OutputType(typeof(PSSqlVulnerabilityAssessmentScanResult))]
public class GetSecuritySqlVulnerabilityAssessmentScanResult : SqlVulnerabilityAssessmentCmdlet
{
[Parameter(ParameterSetName = ParameterSetNames.ResourceId, Mandatory = false, HelpMessage = ParameterHelpMessages.ScanId)]
[Parameter(ParameterSetName = ParameterSetNames.OnPremMachines, Mandatory = false, HelpMessage = ParameterHelpMessages.ScanId)]
Expand Down
Loading