microsoft / azure-security-center Goto Github PK

ASC PowerShell Module

PowerShell 100.00%

azure-security-center's Introduction

This project is closed

Thank you for your interest in checking out this module, but with the formal release of the new Azure Security Center cmdlets, there is no longer a need to keep these cmdlets published. Please check the link below to find the new official Azure Security Center cmdlets.

Official Module

Documentation

Example of usage

Thanks!

Mike

azure-security-center's People

Stargazers

Watchers

Forkers

allanmoller tomshinder kraghu306 brandonparncutt chlahav annathan vijayraavi injeti-manohar 216giorgiy bassyboy rajeshekharcts parthdmaniar bhaskers-blu-org2 taffywrinkle orgdevendra claudiusgonzo test-mass-forker-org-1 seanpm2001

azure-security-center's Issues

Enable setting OMS Workspace

Is it possible to enable setting the OMS Workspace? I have tried directly modifying the JSON file to specify a specific OMS Workspace but Set-ASCPolicy throws an error. Not sure if the error is because of the module or the ASC REST API.

Get-ASCPolicy doesn't contain phone contact information

In your ASC Policy alert settings, if you do not have a phone number specified, the API will not provide the securityContactPhone property when using Get-ASCPolicy. This causes Set-ASCPolicy to break because the property is missing.

This is a known issue and needs to be fixed on the ASC side. Posting here in case others run into it.

Workaround:
Manually specify a phone number in the portal so that the property contains data.

'Classic Compute' should be 'ClassicCompute' in Get-ASCDataCollection

the url path should be ClassicCompute rather than 'Classic Compute' (with the space) when trying to get security information for 'classic' VMs.

Timeout with Get-ASCDataCollection

Get-ASCDataCollection : {"error":{"code":"GatewayTimeout","message":"The gateway did not receive a response from 'Microsoft.Security' within the specified time
period."}}
At line:1 char:1

Get-ASCDataCollection -ComputeType Compute -ResourceGroup NifastNAVDR ...

  + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
  + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-ASCDataCollection

Applying Qualys solution returns error

Hey,

first thx for great module, saved me from alot of additinal coding :-) i have on issue though when applying the Qualys solution i get an error in azure monitor:

{
    "channels": "Operation",
    "correlationId": "8914c53c-b2e2-411a-bc62-b60154cef9c6",
    "eventDataId": "bc8e5be4-5ada-4c7e-8960-72ea9c1c43f5",
    "eventName": {
        "value": "Semi-integrated solution creation",
        "localizedValue": "Semi-integrated solution creation"
    },
    "category": {
        "value": "Security",
        "localizedValue": "Security"
    },
    "eventTimestamp": "2018-02-22T09:17:59.7302105Z",
    "id": "/subscriptions/subscriptionid/resourceGroups/QualysVA1/providers/Microsoft.Security/securitySolutions/QualysVA/events/bc8e5be4-5ada-4c7e-8960-72ea9c1c43f5/ticks/636548878797302105",
    "level": "Error",
    "operationId": "48e12c35-9f78-4fc7-aed1-da6df19c5407",
    "operationName": {
        "value": "Semi-integrated solution creation",
        "localizedValue": "Semi-integrated solution creation"
    },
    "resourceGroupName": "QualysVA1",
    "resourceProviderName": {
        "value": "Microsoft.Security",
        "localizedValue": "Microsoft.Security"
    },
    "resourceType": {
        "value": "Microsoft.Security/securitySolutions",
        "localizedValue": "Microsoft.Security/securitySolutions"
    },
    "resourceId": "/subscriptions/subscriptionid/resourceGroups/QualysVA1/providers/Microsoft.Security/securitySolutions/QualysVA",
    "status": {
        "value": "Failed",
        "localizedValue": "Failed"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "submissionTimestamp": "2018-02-22T09:17:59.6907723Z",
    "subscriptionId": "subscriptionid",
    "properties": {
        "securityFamily": "Vulnerability Assessment",
        "reason": "",
        "solutionName": "QualysVA"
    },
    "relatedEvents": []
}

PS test code:

Select-AzureRmSubscription -SubscriptionId subscriptionid
$secsolution = New-ASCQualysVASolutionConfiguration -LicenseCode "lcode" `
 -PublicKey "key" `
 -AutoUpdate $true


Set-ASCSecuritySolution -JSON $secsolution -SolutionName QualysVa1 -ResourceGroupName QualysVA1 -Verbose

running newest version of module:

PS C:\Users\username> Get-Module -Name Azure-Security-Center

ModuleType Version    Name                                ExportedCommands                                     
---------- -------    ----                                ----------------                                     
Script     0.0.19     Azure-Security-Center               {Build-ASCPolicy, Get-ASCAlert, Get-ASCJITAccessPo...

any idea why this is happening?

microsoft / azure-security-center Goto Github PK

azure-security-center's Introduction

This project is closed

azure-security-center's People

Stargazers

Watchers

Forkers

azure-security-center's Issues

Enable setting OMS Workspace

Get-ASCPolicy doesn't contain phone contact information

'Classic Compute' should be 'ClassicCompute' in Get-ASCDataCollection

Timeout with Get-ASCDataCollection

Applying Qualys solution returns error

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent