Skip to content

Commit c7fd033

Browse files
bmansheimbmansheim
committed
Add PowerShell scripts
1 parent 6e8f9a9 commit c7fd033

File tree

3 files changed

+331
-2
lines changed

3 files changed

+331
-2
lines changed

‎articles/defender-for-cloud/powershell-sample-vulnerability-assessment-azure-sql.md

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
title: PowerShell Script Sample - Enable vulnerability assessment on a SQL server
3+
description: In this article, learn how to enable vulnerability assessments on Azure SQL databases with the express configuration.
4+
ms.topic: sample
5+
ms.date: 11/29/2022
6+
---
7+
8+
# Enable vulnerability assessments on Azure SQL databases with the express configuration
9+
10+
This PowerShell script enables the express configuration of [vulnerability assessments](../../defender-for-cloud/sql-azure-vulnerability-assessment-overview.md) on an Azure SQL Server.
11+
12+
[!INCLUDE [sample-powershell-install](../../../includes/sample-powershell-install-no-ssh.md)]
13+
14+
[!INCLUDE [quickstarts-free-trial-note](../../../includes/quickstarts-free-trial-note.md)]
15+
16+
## Sample script
17+
18+
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
19+
20+
```powershell
21+
<#
22+
.SYNOPSIS
23+
This script migrates an Azure SQL Server to the Vulnerability Assessment Express Configuration feature, and then scans all databases that belong to the selected server.
24+
25+
.DESCRIPTION
26+
This script migrates Azure SQL Server to the Vulnerability Assessment Express Configuration feature.
27+
It deletes the current Vulnerability Assessment settings (if exists), this step will reset all the Vulnerability Assessment scans and baseline for all databases.
28+
29+
#>
30+
31+
32+
$SubscriptionId = "<subscriptionid>" # The Subscription id that the server belongs to.
33+
$ResourceGroupName = "<resource group>" # The Resource Group that the server belongs to.
34+
$ServerName = "<server name>" # The SQL server name that we want to apply the new SQL Vulnerability Assessment policy to (short name, without suffix).
35+
$Force = $false # Will remove the classic Vulnerability Assessment configurations without asking for confirmation.
36+
$APIVersion = "2022-05-01-preview"
37+
38+
39+
40+
###### New SQL Vulnerability Assessment Commands ######
41+
#######################################################
42+
43+
44+
function SetSqlVulnerabilityAssessmentServerSetting($SubscriptionId, $ResourceGroupName, $ServerName){
45+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/default?api-version=" + $APIVersion
46+
$Body = @{
47+
properties = @{
48+
state = "Enabled"
49+
}
50+
}
51+
52+
$Body = $Body | ConvertTo-Json
53+
return SendRestRequest -Method "Put" -Uri $Uri -Body $Body
54+
}
55+
56+
function RunSqlVulnerabilityAssessmentScanOnUserDatabase($SubscriptionId, $ResourceGroupName, $ServerName, $DatabaseName){
57+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/databases/$DatabaseName/sqlVulnerabilityAssessments/defualt/initiateScan?api-version=" + $APIVersion
58+
SendRestRequest -Method "Post" -Uri $Uri
59+
}
60+
61+
function RunSqlVulnerabilityAssessmentScanOnSystemDatabase($SubscriptionId, $ResourceGroupName, $ServerName, $DatabaseName){
62+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/default/initiateScan?api-version=" + $APIVersion + "&systemDatabaseName=$DatabaseName"
63+
SendRestRequest -Method "Post" -Uri $Uri
64+
}
65+
66+
function SendRestRequest(
67+
[Parameter(Mandatory=$True)]
68+
[string] $Method,
69+
[Parameter(Mandatory=$True)]
70+
[string] $Uri,
71+
[parameter( Mandatory=$false )]
72+
[string] $Body = "DEFAULT")
73+
{
74+
$AccessToken = Get-AzAccessToken
75+
$Token = "Bearer $($AccessToken.Token)"
76+
77+
$headers = @{
78+
'Authorization' = $Token
79+
}
80+
81+
$Params = @{
82+
Method = $Method
83+
Uri = $Uri
84+
Headers = $headers
85+
ContentType = "application/json"
86+
}
87+
88+
if(!($Body -eq "DEFAULT"))
89+
{
90+
$Params = @{
91+
Method = $Method
92+
Uri = $Uri
93+
Body = $Body
94+
Headers = $headers
95+
ContentType = "application/json"
96+
}
97+
}
98+
99+
Invoke-RestMethod @Params
100+
}
101+
102+
#######################################################
103+
104+
105+
function HaveVulnerabilityAssessmentSetting($ResourceGroupName, $ServerName, $Databases)
106+
{
107+
# Check if we have a server setting.
108+
Write-Host "Check Vulnerability Assessment setting for '$($ServerName)' server"
109+
$vaServerSetting = Get-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName
110+
if(![string]::IsNullOrEmpty($vaServerSetting.StorageAccountName))
111+
{
112+
return $true
113+
}
114+
115+
# Check if we have a database setting for server
116+
foreach ($database in $Databases)
117+
{
118+
Write-Host "Check VA settings for '$($database.DatabaseName)' database"
119+
$vaDatabaseSetting = Get-AzSqlDatabaseVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName
120+
if(![string]::IsNullOrEmpty($vaDatabaseSetting.StorageAccountName))
121+
{
122+
return $true
123+
}
124+
}
125+
126+
return $false
127+
}
128+
129+
130+
# Connect
131+
Connect-AzAccount
132+
Set-AzContext $SubscriptionId
133+
134+
$databases = Get-AzSqlDatabase -ResourceGroupName $ResourceGroupName -ServerName $ServerName | where {$_.DatabaseName -ne "master"}
135+
$haveVaSetting = HaveVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName -Databases $databases
136+
137+
if($haveVaSetting)
138+
{
139+
140+
Write-Host "Classic Configurations detected."
141+
142+
if(!$Force)
143+
{
144+
Write-Host "We are going to remove the current Vulnerability Assessment setting for this server and underlying databases, this step will reset all the Vulnerability Assessment scans and baseline for all databases ($($databases.Count) under this server)"
145+
$Confirmation = Read-Host -Prompt "Do you approve (y/n)?"
146+
if($Confirmation -ne "y")
147+
{
148+
Write-Host "You chose not to approve the migration process. Existing VA settings will not be changed."
149+
return
150+
}
151+
}
152+
153+
# Removing Classic Configuration database Vulnerability Assessment setting
154+
foreach ($database in $Databases)
155+
{
156+
Write-Host "Clear Classic Configuration Vulnerability Assessment setting for '$($database.DatabaseName)' database"
157+
Clear-AzSqlDatabaseVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName
158+
}
159+
160+
# Removing Classic Configuration server Vulnerability Assessment setting
161+
Write-Host "Clear Classic Configuration Vulnerability Assessment setting for '$($ServerName)' server"
162+
Clear-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName
163+
}
164+
165+
# Set Express Configuration SQL Vulnerability Assessment Setting
166+
Write-Host "Add Express Configuration Vulnerability Assessment feature setting for '$($ServerName)' server"
167+
$Respond = SetSqlVulnerabilityAssessmentServerSetting -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName
168+
169+
if( $Respond.properties.state.Equals("Enabled") )
170+
{
171+
Write-Host "Congratulations! your server '$($ServerName)' server is set up with Vulnerability Assessment Express Configuration!"
172+
}
173+
else
174+
{
175+
Write-Host "There was a problem to enable Vulnerability Assessment Express Configuration on the '$($ServerName)' server, please try again"
176+
return
177+
}
178+
179+
# Scan on all the databases
180+
foreach ($database in $Databases)
181+
{
182+
Write-Host "Run scan on '$($database.DatabaseName)' database"
183+
RunSqlVulnerabilityAssessmentScanOnUserDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName
184+
}
185+
186+
Write-Host "Run scan on 'master' database"
187+
RunSqlVulnerabilityAssessmentScanOnSystemDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName "master"
188+
189+
Write-Host "The migration process completed, the new scan results will be available in a couple of minutes."
190+
```
191+
192+
## Next steps
193+
194+
For more information on the Azure PowerShell module, see [Azure PowerShell documentation](/powershell/azure/new-azureps-module-az).

‎articles/defender-for-cloud/powershell-sample-vulnerability-assessment-baselines.md

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
title: PowerShell Script Sample - Enable vulnerability assessment on a SQL server
3+
description: In this article, learn how to enable vulnerability assessments on Azure SQL databases with the express configuration.
4+
ms.topic: sample
5+
ms.date: 11/29/2022
6+
---
7+
8+
# Enable vulnerability assessments on Azure SQL databases with the express configuration
9+
10+
This PowerShell script sets up baselines based on latest [vulnerability assessment](../../defender-for-cloud/sql-azure-vulnerability-assessment-overview.md) scan results for all databases in an Azure SQL Server.
11+
12+
[!INCLUDE [sample-powershell-install](../../../includes/sample-powershell-install-no-ssh.md)]
13+
14+
[!INCLUDE [quickstarts-free-trial-note](../../../includes/quickstarts-free-trial-note.md)]
15+
16+
## Sample script
17+
18+
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
19+
20+
```powershell
21+
<#
22+
.SYNOPSIS
23+
This script sets the results of the last successful scan as baseline for each database under the selected Azure SQL Server.
24+
25+
.DESCRIPTION
26+
This script check if the selected Azure SQL Server uses Vulnerability Assessment Express Configuration, iterates through all user databases under a server and sets the latest scan results as a baseline.
27+
28+
#>
29+
30+
31+
$SubscriptionId = "<subscriptionid>" # The Subscription id that the server belongs to.
32+
$ResourceGroupName = "<resource group>" # The Resource Group that the server belongs to.
33+
$ServerName = "<server name>" # The SQL server name that we want to apply the new SQL Vulnerability Assessment policy to (short name, without suffix).
34+
$APIVersion = "2022-05-01-preview"
35+
36+
37+
38+
39+
###### New SQL Vulnerability Assessment Commands ######
40+
#######################################################
41+
42+
43+
function GetExpressConfigurationStatus($SubscriptionId, $ResourceGroupName, $ServerName){
44+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/Defualt?api-version=" + $APIVersion
45+
SendRestRequest -Method "GET" -Uri $Uri
46+
}
47+
48+
49+
function SetLastScanAsBaselineOnSystemDatabase($SubscriptionId, $ResourceGroupName, $ServerName){
50+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/default/baselines/default?systemDatabaseName=master&api-version=" + $APIVersion
51+
$Body = "{properties: {latestScan: true,results: {}}}"
52+
SendRestRequest -Method "PUT" -Uri $Uri -Body $Body
53+
}
54+
55+
function SetLastScanAsBaselineOnUserDatabase($SubscriptionId, $ResourceGroupName, $ServerName, $DatabaseName){
56+
$Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/databases/$DatabaseName/sqlVulnerabilityAssessments/defualt/baselines/default?api-version=" + $APIVersion
57+
$Body = "{properties: {latestScan: true,results: {}}}"
58+
SendRestRequest -Method "PUT" -Uri $Uri -Body $Body
59+
}
60+
61+
62+
function SendRestRequest(
63+
[Parameter(Mandatory=$True)]
64+
[string] $Method,
65+
[Parameter(Mandatory=$True)]
66+
[string] $Uri,
67+
[parameter( Mandatory=$false )]
68+
[string] $Body = "DEFAULT")
69+
{
70+
$AccessToken = Get-AzAccessToken
71+
$Token = "Bearer $($AccessToken.Token)"
72+
73+
$headers = @{
74+
'Authorization' = $Token
75+
}
76+
77+
$Params = @{
78+
Method = $Method
79+
Uri = $Uri
80+
Headers = $headers
81+
ContentType = "application/json"
82+
}
83+
84+
if(!($Body -eq "DEFAULT"))
85+
{
86+
$Params = @{
87+
Method = $Method
88+
Uri = $Uri
89+
Body = $Body
90+
Headers = $headers
91+
ContentType = "application/json"
92+
}
93+
}
94+
95+
Invoke-RestMethod @Params
96+
}
97+
98+
#######################################################
99+
100+
101+
102+
# Connect
103+
Connect-AzAccount
104+
Set-AzContext $SubscriptionId
105+
106+
# Check if Express Configuration is enabled
107+
$ECState = (GetExpressConfigurationStatus -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName).properties.State
108+
109+
Write-Host "Express Configuration status: " $ECState
110+
111+
if ($ECState = "Enabled")
112+
{
113+
# Get list of databases
114+
$databases = Get-AzSqlDatabase -ResourceGroupName $ResourceGroupName -ServerName $ServerName | where {$_.DatabaseName -ne "master"}
115+
116+
# Set latest scan results as baseline on all user databases
117+
foreach ($database in $Databases)
118+
{
119+
Write-Host "Set baseline on database: '$($database.DatabaseName)'"
120+
SetLastScanAsBaselineOnUserDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName
121+
}
122+
123+
Write-Host "Set baseline on 'master' database"
124+
SetLastScanAsBaselineOnSystemDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName
125+
}
126+
else
127+
{
128+
Write-Host "The specified server does not have VA Express Configuration enabled therefore bulk baseline operations were not performed."
129+
return
130+
}
131+
```
132+
133+
## Next steps
134+
135+
For more information on the Azure PowerShell module, see [Azure PowerShell documentation](/powershell/azure/new-azureps-module-az).

‎articles/defender-for-cloud/sql-azure-vulnerability-assessment-manage.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -176,8 +176,8 @@ Here are several examples to how you can setup baselines using ARM templates:
176176

177177
Express configuration is not supported in PowerShell cmdlets but you can use PowerShell to invoke the latest vulnerability assessment capabilities using REST API, for example:
178178

179-
- Enable express configuration on an Azure SQL Server
180-
- Setup baselines based on latest scan results for all databases in an Azure SQL Server
179+
- [Enable express configuration](powershell-sample-vulnerability-assessment-azure-sql.md) on an Azure SQL Server
180+
- [Setup baselines](powershell-sample-vulnerability-assessment-baselines.md) based on latest scan results for all databases in an Azure SQL Server
181181

182182
## FAQ
183183

0 commit comments

Comments
 (0)