Skip to content

Rename Threat Detection cmdlets to Advanced Threat Protection #9213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
May 20, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/Sql/Sql.Test/ScenarioTests/AdvancedDataSecurityTests.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -52,12 +52,12 @@ function Test-AdvancedDataSecurityPolicyTest
Assert-False { $policy.IsEnabled }

# See that ATP cmdlets don't mess up the Threat Detection policy
Set-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType Sql_Injection_Vulnerability
Update-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType Sql_Injection_Vulnerability

Disable-AzSqlServerAdvancedDataSecurity -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName
Assert-AreEqual $policy.ThreatDetectionState "Disabled"
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
Assert-False {$policy.EmailAdmins}
Expand All @@ -67,7 +67,7 @@ function Test-AdvancedDataSecurityPolicyTest
Enable-AzSqlServerAdvancedDataSecurity -ResourceGroupName $params.rgname -ServerName $params.serverName -DoNotConfigureVulnerabilityAssessment

# Assert
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
Assert-False {$policy.EmailAdmins}
Expand Down
58 changes: 29 additions & 29 deletions src/Sql/Sql.Test/ScenarioTests/ThreatDetectionTests.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ function Test-ThreatDetectionGetDefualtPolicy
try
{
# Test
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Disabled"
Expand All @@ -35,7 +35,7 @@ function Test-ThreatDetectionGetDefualtPolicy
Assert-AreEqual $policy.ExcludedDetectionTypes.Count 0

# Test
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Disabled"
Expand Down Expand Up @@ -64,8 +64,8 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
try
{
# Test
Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType "Sql_Injection_Vulnerability" -StorageAccountName $params.storageAccount
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType "Sql_Injection_Vulnerability" -StorageAccountName $params.storageAccount
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand All @@ -76,8 +76,8 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)}

# Test
Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "Sql_Injection", "Sql_Injection_Vulnerability", "Access_Anomaly", "Data_Exfiltration", "Unsafe_Action"
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "Sql_Injection", "Sql_Injection_Vulnerability", "Access_Anomaly", "Data_Exfiltration", "Unsafe_Action"
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand All @@ -92,8 +92,8 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Unsafe_Action)}

# Test
Remove-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Clear-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Disabled"
Expand All @@ -107,8 +107,8 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Unsafe_Action)}

# Test
Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "None"
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "None"
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand Down Expand Up @@ -137,8 +137,8 @@ function Test-ThreatDetectionServerUpdatePolicy
try
{
# Test
Set-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType Sql_Injection_Vulnerability -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
Update-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType Sql_Injection_Vulnerability -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand All @@ -148,8 +148,8 @@ function Test-ThreatDetectionServerUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)}

# Test
Set-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -ExcludedDetectionType Sql_Injection, Sql_Injection_Vulnerability, Access_Anomaly, Data_Exfiltration, Unsafe_Action -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
Update-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -ExcludedDetectionType Sql_Injection, Sql_Injection_Vulnerability, Access_Anomaly, Data_Exfiltration, Unsafe_Action -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand All @@ -163,8 +163,8 @@ function Test-ThreatDetectionServerUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Unsafe_Action)}

# Test
Remove-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
Clear-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Disabled"
Expand All @@ -178,8 +178,8 @@ function Test-ThreatDetectionServerUpdatePolicy
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Unsafe_Action)}

# Test
Set-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -ExcludedDetectionType None -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName
Update-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -ExcludedDetectionType None -StorageAccountName $params.storageAccount
$policy = Get-AzSqlServerAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
Expand Down Expand Up @@ -208,22 +208,22 @@ function Test-DisablingThreatDetection
try
{
# 1. Test
Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -EmailAdmins $true
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -EmailAdmins $true
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Enabled"

# 2. Test
Remove-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Clear-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName

# Assert
Assert-AreEqual $policy.ThreatDetectionState "Disabled"

# 3. Test - that no exception is thrown
Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -EmailAdmins $true
$policy = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -EmailAdmins $true
$policy = Get-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
}
finally
{
Expand All @@ -246,17 +246,17 @@ function Test-InvalidArgumentsThreatDetection
try
{
# turning on threat detection without storage account
Assert-Throws {Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName}
Assert-Throws {Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName}

# Check that NotificationRecipientsEmails are in correct format
Assert-Throws {Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "kokogmail.com"}
Assert-Throws {Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "kokogmail.com"}

# Check that EmailAdmins is not False and NotificationRecipientsEmails is not empty
Assert-Throws {Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false -StorageAccountName $params.storageAccount}
Assert-Throws {Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false -NotificationRecipientsEmails "" -StorageAccountName $params.storageAccount}
Assert-Throws {Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false -StorageAccountName $params.storageAccount}
Assert-Throws {Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false -NotificationRecipientsEmails "" -StorageAccountName $params.storageAccount}

# Check that ExcludedDetectionType doesn't hold None and any other type
Assert-Throws {Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $true -ExcludedDetectionType "None", "Sql_Injection_Vulnerability" -StorageAccountName $params.storageAccount}
Assert-Throws {Update-AzSqlDatabaseAdvancedThreatProtectionSettings -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $true -ExcludedDetectionType "None", "Sql_Injection_Vulnerability" -StorageAccountName $params.storageAccount}
}
finally
{
Expand Down
23 changes: 15 additions & 8 deletions src/Sql/Sql/Az.Sql.psd1
Original file line number Diff line number Diff line change
Expand Up @@ -111,12 +111,7 @@ CmdletsToExport = 'Get-AzSqlDatabaseTransparentDataEncryption',
'Remove-AzSqlDatabaseDataMaskingRule',
'Set-AzSqlDatabaseDataMaskingPolicy',
'Set-AzSqlDatabaseDataMaskingRule', 'Get-AzSqlCapability',
'Get-AzSqlServerThreatDetectionPolicy',
'Remove-AzSqlServerThreatDetectionPolicy',
'Set-AzSqlServerThreatDetectionPolicy',
'Get-AzSqlDatabaseThreatDetectionPolicy',
'Set-AzSqlDatabaseThreatDetectionPolicy',
'Remove-AzSqlDatabaseThreatDetectionPolicy', 'Get-AzSqlDatabase',
'Get-AzSqlDatabase',
'Get-AzSqlDatabaseActivity', 'Get-AzSqlDatabaseExpanded',
'New-AzSqlDatabase', 'Remove-AzSqlDatabase', 'Set-AzSqlDatabase',
'Get-AzSqlDatabaseImportExportStatus', 'New-AzSqlDatabaseExport',
Expand Down Expand Up @@ -217,7 +212,13 @@ CmdletsToExport = 'Get-AzSqlDatabaseTransparentDataEncryption',
'Get-AzSqlVirtualCluster', 'Remove-AzSqlVirtualCluster',
'Enable-AzSqlServerAdvancedDataSecurity',
'Disable-AzSqlServerAdvancedDataSecurity',
'Get-AzSqlServerAdvancedDataSecurityPolicy'
'Get-AzSqlServerAdvancedDataSecurityPolicy',
'Get-AzSqlServerAdvancedThreatProtectionSettings',
'Clear-AzSqlServerAdvancedThreatProtectionSettings',
'Update-AzSqlServerAdvancedThreatProtectionSettings',
'Get-AzSqlDatabaseAdvancedThreatProtectionSettings',
'Update-AzSqlDatabaseAdvancedThreatProtectionSettings',
'Clear-AzSqlDatabaseAdvancedThreatProtectionSettings'

# Variables to export from this module
# VariablesToExport = @()
Expand Down Expand Up @@ -245,7 +246,13 @@ AliasesToExport = 'Get-AzSqlDatabaseServerAuditingPolicy',
'Clear-AzSqlServerVulnerabilityAssessmentSettings',
'Enable-AzSqlServerAdvancedThreatProtection',
'Disable-AzSqlServerAdvancedThreatProtection',
'Get-AzSqlServerAdvancedThreatProtectionPolicy'
'Get-AzSqlServerAdvancedThreatProtectionPolicy',
'Get-AzSqlServerThreatDetectionPolicy',
'Remove-AzSqlServerThreatDetectionPolicy',
'Set-AzSqlServerThreatDetectionPolicy',
'Get-AzSqlDatabaseThreatDetectionPolicy',
'Set-AzSqlDatabaseThreatDetectionPolicy',
'Remove-AzSqlDatabaseThreatDetectionPolicy'

# DSC resources to export from this module
# DscResourcesToExport = @()
Expand Down
1 change: 1 addition & 0 deletions src/Sql/Sql/ChangeLog.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
## Upcoming Release
* Add DnsZonePartner Parameter for New-AzureSqlInstance cmdlet to support AutoDr for Managed Instance.
* Deprecating Get-AzSqlDatabaseSecureConnectionPolicy cmdlet
* Rename Threat Detection cmdlets to Advanced Threat Protection

## Version 1.10.0
* Rename Advanced Threat Protection cmdlets to Advanced Data Security and enable Vulnerability Assessment by default
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,16 @@

using Microsoft.Azure.Commands.Sql.ThreatDetection.Model;
using System.Management.Automation;
using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;

namespace Microsoft.Azure.Commands.Sql.ThreatDetection.Cmdlet
{
/// <summary>
/// Returns the auditing policy of a specific database.
/// Returns the advanced threat protection settings of a specific database.
/// </summary>
[Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlDatabaseThreatDetectionPolicy", SupportsShouldProcess = true),OutputType(typeof(DatabaseThreatDetectionPolicyModel))]
[GenericBreakingChange("Get-AzSqlDatabaseThreatDetectionPolicy alias will be removed in an upcoming breaking change release", "2.0.0")]
[Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "SqlDatabaseAdvancedThreatProtectionSettings", SupportsShouldProcess = true),OutputType(typeof(DatabaseThreatDetectionPolicyModel))]
[Alias("Get-AzSqlDatabaseThreatDetectionPolicy")]
public class AzureRmSqlDatabaseThreatDetectionPolicy : SqlDatabaseThreatDetectionCmdletBase
{
/// <summary>
Expand Down
Loading