azure - Azure SQL 和数据库漏洞评估扫描通过 Azure CLI

我想以编程方式在 Azure SQL 服务器和数据库级别打开“漏洞评估扫描”。它应该再次发生。

我正在处理的项目有许多调用 Az 模块的 power shell 脚本。

您知道我应该调用哪些 Az 模块来将“漏洞评估扫描”设置为重复发生吗?


I think you can use Azure Powershell command , 
This above triggers the start of a vulnerability assessment scan on a database.

The one below starts the instance scan.

You can use the below script :


# set parameters - resource group, server, database and storage account
$params =  @{ rgname = "rg";
     serverName = "my-server";
     databaseName = "my-db";
     storageAccount = "mystorage"
# Turn on ATP
Enable-AzureRmSqlServerAdvancedThreatProtection -ResourceGroupName $params.rgname -ServerName $params.serverName

# Set Vulnerability Assessment storage settings for all the databases in the server
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"}| Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -StorageAccountName $params.storageAccount 
# Update vulnerability assessment settings to turn ON recurring scans, and provide email to receive results
$scanNotificationEmail = @("")
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName| where {$_.DatabaseName -ne "master"} | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -RecurringScansInterval Weekly -NotificationEmail $scanNotificationEmail -EmailAdmins $true
# Set Vulnerability Assessment baseline for rule VA1143 on all the databases in the server 
$ruleId = "VA1143"
$baselineResult = @( '1')
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"} | Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline -RuleId $ruleId -BaselineResult $baselineResult
# Run a new scan on a database
$scanId1 = "custom-scan1"
$scanJob = Start-AzureRmSqlDatabaseVulnerabilityAssessmentScan -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1 -AsJob
$scanJob | Wait-Job
$scanRecord = $scanJob | Receive-Job
# Convert the raw scan results to an Excel file
$convertScanResult = Convert-AzureRmSqlDatabaseVulnerabilityAssessmentScan  -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1
# Download the scan results Excel summary file
$connectionStringToStorageAccount = "DefaultEndpointsProtocol=https;AccountName=......."
$convertedScanResultsDownloadLocalFolder = "C:\ScanResults\"
$storageAccountContext = New-AzureStorageContext -ConnectionString $connectionStringToStorageAccount
$convertScanResultSplitted = $convertScanResult.ExportedReportLocation -split "/"
$containerName = $convertScanResultSplitted
Get-AzureStorageBlobContent -Blob ($convertScanResult.ExportedReportLocation -split $containerName + '/')[1]  -Container $containerName -Destination $convertedScanResultsDownloadLocalFolder -Context $storageAccountContext


shopify - 提交问题包括堆栈跟踪