我想以编程方式在 Azure SQL server 和数据库级别打开“漏洞评估扫描”。它应该会再次发生。
我正在处理的项目有许多调用 Az 模块的 power shell 脚本。
您知道我应该调用哪些 Az 模块来将“漏洞评估扫描”设置为重新发生吗？
回答1
I think you can use Azure Powershell command ,
Start-AzSqlDatabaseVulnerabilityAssessmentScan.
This above triggers the start of a vulnerability assessment scan on a database.
The one below starts the instance scan.
Start-AzSqlInstanceDatabaseVulnerabilityAssessmentScan
You can use the below script :
{
# set parameters - resource group, server, database and storage account
$params = @{ rgname = "rg";
serverName = "my-server";
databaseName = "my-db";
storageAccount = "mystorage"
}
# Turn on ATP
Enable-AzureRmSqlServerAdvancedThreatProtection -ResourceGroupName $params.rgname -ServerName $params.serverName
# Set Vulnerability Assessment storage settings for all the databases in the server
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"}| Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -StorageAccountName $params.storageAccount
# Update vulnerability assessment settings to turn ON recurring scans, and provide email to receive results
$scanNotificationEmail = @("user1@microsoft.com")
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName| where {$_.DatabaseName -ne "master"} | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -RecurringScansInterval Weekly -NotificationEmail $scanNotificationEmail -EmailAdmins $true
# Set Vulnerability Assessment baseline for rule VA1143 on all the databases in the server
$ruleId = "VA1143"
$baselineResult = @( '1')
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"} | Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline -RuleId $ruleId -BaselineResult $baselineResult
# Run a new scan on a database
$scanId1 = "custom-scan1"
$scanJob = Start-AzureRmSqlDatabaseVulnerabilityAssessmentScan -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1 -AsJob
$scanJob | Wait-Job
$scanRecord = $scanJob | Receive-Job
# Convert the raw scan results to an Excel file
$convertScanResult = Convert-AzureRmSqlDatabaseVulnerabilityAssessmentScan -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1
# Download the scan results Excel summary file
$connectionStringToStorageAccount = "DefaultEndpointsProtocol=https;AccountName=......."
$convertedScanResultsDownloadLocalFolder = "C:\ScanResults\"
$storageAccountContext = New-AzureStorageContext -ConnectionString $connectionStringToStorageAccount
$convertScanResultSplitted = $convertScanResult.ExportedReportLocation -split "/"
$containerName = $convertScanResultSplitted
Get-AzureStorageBlobContent -Blob ($convertScanResult.ExportedReportLocation -split $containerName + '/')[1] -Container $containerName -Destination $convertedScanResultsDownloadLocalFolder -Context $storageAccountContext
}