Skip to content

Commit e2d5ebc

Browse files
nitsiNitsan Bracha
nitsi
and
Nitsan Bracha
authored
Adding AlertsSuppressionRule cmdlets to Az.Security (Azure#17763)
* Adding AlertsSuppressionRule cmdlets to Az.Microsoft * Adding parameters to "Set" so users can use the PS directly without creating an object * Adding new helper function `New-AzAlertsSuppressionRuleScope` * New-AzAlertsSuppressionRuleScope was using `Contains` and `In` parameters which creates a conflict with PowerShell operators * Revert manual version change * NewAlertsSuppressionRuleScope SupportsShouldProcess = false as it creates a local variable. * Adding signature exception for New-AzAlertsSuppressionRuleScope Co-authored-by: Nitsan Bracha <[email protected]>
1 parent 374a4a2 commit e2d5ebc

25 files changed

+1831
-1
lines changed

‎src/Accounts/Accounts/AzureRmAlias/Mappings.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2068,6 +2068,10 @@
20682068
"Remove-AzSearchQueryKey": "Remove-AzureRmSearchQueryKey"
20692069
},
20702070
"Az.Security": {
2071+
"New-AzAlertsSuppressionRuleScope": "New-AzureRmAlertsSuppressionRuleScope",
2072+
"Get-AzAlertsSuppressionRule": "Get-AzureRmAlertsSuppressionRule",
2073+
"Set-AzAlertsSuppressionRule": "Set-AzureRmAlertsSuppressionRule",
2074+
"Remove-AzAlertsSuppressionRule": "Remove-AzureRmAlertsSuppressionRule",
20712075
"Get-AzSecurityAlert": "Get-AzureRmSecurityAlert",
20722076
"Set-AzSecurityAlert": "Set-AzureRmSecurityAlert",
20732077
"Get-AzSecurityAutoProvisioningSetting": "Get-AzureRmSecurityAutoProvisioningSetting",

‎src/Security/Security.Test/ScenarioTests/AlertsSuppressionRuleTests.cs

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest;
16+
using Microsoft.Azure.ServiceManagement.Common.Models;
17+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
18+
using Xunit;
19+
20+
namespace Microsoft.Azure.Commands.Security.Test.ScenarioTests
21+
{
22+
public class AlertsSuppressionRuleTests
23+
{
24+
private readonly XunitTracingInterceptor _logger;
25+
26+
public AlertsSuppressionRuleTests(Xunit.Abstractions.ITestOutputHelper output)
27+
{
28+
_logger = new XunitTracingInterceptor(output);
29+
XunitTracingInterceptor.AddToContext(_logger);
30+
TestExecutionHelpers.SetUpSessionAndProfile();
31+
}
32+
33+
[Fact]
34+
[Trait(Category.AcceptanceType, Category.CheckIn)]
35+
public void GetSubscriptionScope()
36+
{
37+
TestController.NewInstance.RunPowerShellTest(_logger, "Get-AzAlertsSuppressionRule-SubscriptionScope");
38+
}
39+
40+
[Fact]
41+
[Trait(Category.AcceptanceType, Category.CheckIn)]
42+
public void CreateAndDeleteAlertsSuppressionRule()
43+
{
44+
TestController.NewInstance.RunPowerShellTest(_logger, "CreateAndDelete-AzAlertsSuppressionRule");
45+
}
46+
}
47+
}

‎src/Security/Security.Test/ScenarioTests/AlertsSuppressionRuleTests.ps1

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Get alerts suppression rules on a subscription scope
18+
#>
19+
function Get-AzAlertsSuppressionRule-SubscriptionScope
20+
{
21+
$alertsSuppressionRule = Get-AzAlertsSuppressionRule
22+
Validate-AlertsSuppressionRule $alertsSuppressionRule
23+
}
24+
25+
<#
26+
.SYNOPSIS
27+
Get security contacts on a subscription
28+
#>
29+
function CreateAndDelete-AzAlertsSuppressionRule
30+
{
31+
$ruleName = "Powershell-UT-RuleName"
32+
33+
34+
$rule = Get-AzAlertsSuppressionRule | where { $_.Name -eq $ruleName }
35+
Assert-True { $rule.Count -eq 0 }
36+
37+
$newRequest = New-Object Microsoft.Azure.Commands.Security.Models.AlertsSuppressionRules.PSAlertsSuppressionRule -Property @{
38+
Name = $ruleName
39+
AlertType = "PS-UT-AlertType"
40+
Reason = "Other"
41+
Comment = "PS-UT-Comment"
42+
}
43+
44+
Set-AzAlertsSuppressionRule -InputObject $newRequest
45+
$rule = Get-AzAlertsSuppressionRule | where { $_.Name -eq $ruleName }
46+
Assert-True { $rule.Count -eq 1 }
47+
48+
Remove-AzAlertsSuppressionRule -Name $ruleName
49+
}
50+
51+
<#
52+
.SYNOPSIS
53+
Validates a list of alert suppression rules
54+
#>
55+
function Validate-AlertsSuppressionRule
56+
{
57+
param($alertsSuppressionRule)
58+
59+
Assert-True { $alertsSuppressionRule.Count -gt 0 }
60+
61+
Foreach($alertsSuppressionRule in $alertsSuppressionRule)
62+
{
63+
Validate-AllowedConnection $alertsSuppressionRule
64+
}
65+
}
66+
67+
<#
68+
.SYNOPSIS
69+
Validates a single alert suppression rule
70+
#>
71+
function Validate-AlertsSuppressionRule
72+
{
73+
param($alertsSuppressionRule)
74+
75+
Assert-NotNull $alertsSuppressionRule
76+
}

‎src/Security/Security.Test/SessionRecords/Microsoft.Azure.Commands.Security.Test.ScenarioTests.AlertsSuppressionRuleTests/CreateAndDeleteAlertsSuppressionRule.json

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
{
2+
"Entries": [
3+
{
4+
"RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview",
5+
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzU3VwcHJlc3Npb25SdWxlcz9hcGktdmVyc2lvbj0yMDE5LTAxLTAxLXByZXZpZXc=",
6+
"RequestMethod": "GET",
7+
"RequestBody": "",
8+
"RequestHeaders": {
9+
"x-ms-client-request-id": [
10+
"1e6dc64b-bec0-4f56-9023-be0cb94734fd"
11+
],
12+
"Accept-Language": [
13+
"en-US"
14+
],
15+
"User-Agent": [
16+
"FxVersion/4.700.22.11601",
17+
"OSName/Windows",
18+
"OSVersion/Microsoft.Windows.10.0.22000",
19+
"Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0"
20+
]
21+
},
22+
"ResponseHeaders": {
23+
"Cache-Control": [
24+
"no-cache"
25+
],
26+
"Pragma": [
27+
"no-cache"
28+
],
29+
"x-ms-ratelimit-remaining-subscription-resource-requests": [
30+
"749"
31+
],
32+
"Strict-Transport-Security": [
33+
"max-age=31536000; includeSubDomains"
34+
],
35+
"Server": [
36+
"Kestrel"
37+
],
38+
"x-ms-request-id": [
39+
"06e7418d-b854-454e-b21e-e13c80bf294f"
40+
],
41+
"x-ms-correlation-request-id": [
42+
"06e7418d-b854-454e-b21e-e13c80bf294f"
43+
],
44+
"x-ms-routing-request-id": [
45+
"SWITZERLANDNORTH:20220407T091537Z:06e7418d-b854-454e-b21e-e13c80bf294f"
46+
],
47+
"X-Content-Type-Options": [
48+
"nosniff"
49+
],
50+
"Date": [
51+
"Thu, 07 Apr 2022 09:15:37 GMT"
52+
],
53+
"Content-Length": [
54+
"1285"
55+
],
56+
"Content-Type": [
57+
"application/json; charset=utf-8"
58+
],
59+
"Expires": [
60+
"-1"
61+
]
62+
},
63+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/SDK_Test1\",\r\n \"name\": \"SDK_Test1\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"Storage.Blob_ApplicationAnomaly\",\r\n \"lastModifiedUTC\": \"2021-12-05T16:41:05.6018728Z\",\r\n \"expirationDateUTC\": \"2032-10-18T16:32:12Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\",\r\n \"comment\": \"Test Rule \",\r\n \"suppressionAlertsScope\": {\r\n \"allOf\": []\r\n }\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/2a71184ea21e42a1947330e47d442b80\",\r\n \"name\": \"2a71184ea21e42a1947330e47d442b80\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"SKDAlertType\",\r\n \"lastModifiedUTC\": \"2021-12-05T16:42:57.9624898Z\",\r\n \"expirationDateUTC\": \"2022-06-05T16:42:57.9624898Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/85a979d9847c45bba607dc250fddaec0\",\r\n \"name\": \"85a979d9847c45bba607dc250fddaec0\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"SKDAlertType\",\r\n \"lastModifiedUTC\": \"2021-12-07T11:24:25.2968931Z\",\r\n \"expirationDateUTC\": \"2022-06-07T11:24:25.2968931Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\"\r\n }\r\n }\r\n ]\r\n}",
64+
"StatusCode": 200
65+
},
66+
{
67+
"RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview",
68+
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzU3VwcHJlc3Npb25SdWxlcz9hcGktdmVyc2lvbj0yMDE5LTAxLTAxLXByZXZpZXc=",
69+
"RequestMethod": "GET",
70+
"RequestBody": "",
71+
"RequestHeaders": {
72+
"x-ms-client-request-id": [
73+
"f29b780c-15f2-4266-9b1d-44a8a92d1a1e"
74+
],
75+
"Accept-Language": [
76+
"en-US"
77+
],
78+
"User-Agent": [
79+
"FxVersion/4.700.22.11601",
80+
"OSName/Windows",
81+
"OSVersion/Microsoft.Windows.10.0.22000",
82+
"Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0"
83+
]
84+
},
85+
"ResponseHeaders": {
86+
"Cache-Control": [
87+
"no-cache"
88+
],
89+
"Pragma": [
90+
"no-cache"
91+
],
92+
"x-ms-ratelimit-remaining-subscription-resource-requests": [
93+
"748"
94+
],
95+
"Strict-Transport-Security": [
96+
"max-age=31536000; includeSubDomains"
97+
],
98+
"Server": [
99+
"Kestrel"
100+
],
101+
"x-ms-request-id": [
102+
"76274c91-5816-419e-9b42-47d479006b39"
103+
],
104+
"x-ms-correlation-request-id": [
105+
"76274c91-5816-419e-9b42-47d479006b39"
106+
],
107+
"x-ms-routing-request-id": [
108+
"SWITZERLANDNORTH:20220407T091538Z:76274c91-5816-419e-9b42-47d479006b39"
109+
],
110+
"X-Content-Type-Options": [
111+
"nosniff"
112+
],
113+
"Date": [
114+
"Thu, 07 Apr 2022 09:15:38 GMT"
115+
],
116+
"Content-Length": [
117+
"1710"
118+
],
119+
"Content-Type": [
120+
"application/json; charset=utf-8"
121+
],
122+
"Expires": [
123+
"-1"
124+
]
125+
},
126+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/SDK_Test1\",\r\n \"name\": \"SDK_Test1\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"Storage.Blob_ApplicationAnomaly\",\r\n \"lastModifiedUTC\": \"2021-12-05T16:41:05.6018728Z\",\r\n \"expirationDateUTC\": \"2032-10-18T16:32:12Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\",\r\n \"comment\": \"Test Rule \",\r\n \"suppressionAlertsScope\": {\r\n \"allOf\": []\r\n }\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/2a71184ea21e42a1947330e47d442b80\",\r\n \"name\": \"2a71184ea21e42a1947330e47d442b80\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"SKDAlertType\",\r\n \"lastModifiedUTC\": \"2021-12-05T16:42:57.9624898Z\",\r\n \"expirationDateUTC\": \"2022-06-05T16:42:57.9624898Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/85a979d9847c45bba607dc250fddaec0\",\r\n \"name\": \"85a979d9847c45bba607dc250fddaec0\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"SKDAlertType\",\r\n \"lastModifiedUTC\": \"2021-12-07T11:24:25.2968931Z\",\r\n \"expirationDateUTC\": \"2022-06-07T11:24:25.2968931Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/Powershell-UT-RuleName\",\r\n \"name\": \"Powershell-UT-RuleName\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"PS-UT-AlertType\",\r\n \"lastModifiedUTC\": \"2022-04-07T09:15:38.1181944Z\",\r\n \"expirationDateUTC\": \"2022-10-07T09:15:38.1181944Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\",\r\n \"comment\": \"PS-UT-Comment\"\r\n }\r\n }\r\n ]\r\n}",
127+
"StatusCode": 200
128+
},
129+
{
130+
"RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/Powershell-UT-RuleName?api-version=2019-01-01-preview",
131+
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzU3VwcHJlc3Npb25SdWxlcy9Qb3dlcnNoZWxsLVVULVJ1bGVOYW1lP2FwaS12ZXJzaW9uPTIwMTktMDEtMDEtcHJldmlldw==",
132+
"RequestMethod": "PUT",
133+
"RequestBody": "{\r\n \"properties\": {\r\n \"alertType\": \"PS-UT-AlertType\",\r\n \"reason\": \"Other\",\r\n \"state\": \"Enabled\",\r\n \"comment\": \"PS-UT-Comment\"\r\n }\r\n}",
134+
"RequestHeaders": {
135+
"x-ms-client-request-id": [
136+
"d14a39e2-dc39-4d62-a707-f7ec7c66e1c8"
137+
],
138+
"Accept-Language": [
139+
"en-US"
140+
],
141+
"User-Agent": [
142+
"FxVersion/4.700.22.11601",
143+
"OSName/Windows",
144+
"OSVersion/Microsoft.Windows.10.0.22000",
145+
"Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0"
146+
],
147+
"Content-Type": [
148+
"application/json; charset=utf-8"
149+
],
150+
"Content-Length": [
151+
"146"
152+
]
153+
},
154+
"ResponseHeaders": {
155+
"Cache-Control": [
156+
"no-cache"
157+
],
158+
"Pragma": [
159+
"no-cache"
160+
],
161+
"x-ms-ratelimit-remaining-subscription-writes": [
162+
"1199"
163+
],
164+
"Strict-Transport-Security": [
165+
"max-age=31536000; includeSubDomains"
166+
],
167+
"Server": [
168+
"Kestrel"
169+
],
170+
"x-ms-request-id": [
171+
"5f57a7a6-09f4-491a-89e4-a768aaa9f343"
172+
],
173+
"x-ms-correlation-request-id": [
174+
"5f57a7a6-09f4-491a-89e4-a768aaa9f343"
175+
],
176+
"x-ms-routing-request-id": [
177+
"SWITZERLANDNORTH:20220407T091538Z:5f57a7a6-09f4-491a-89e4-a768aaa9f343"
178+
],
179+
"X-Content-Type-Options": [
180+
"nosniff"
181+
],
182+
"Date": [
183+
"Thu, 07 Apr 2022 09:15:37 GMT"
184+
],
185+
"Content-Length": [
186+
"424"
187+
],
188+
"Content-Type": [
189+
"application/json; charset=utf-8"
190+
],
191+
"Expires": [
192+
"-1"
193+
]
194+
},
195+
"ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alertsSuppressionRules/Powershell-UT-RuleName\",\r\n \"name\": \"Powershell-UT-RuleName\",\r\n \"type\": \"Microsoft.Security/alertsSuppressionRules\",\r\n \"properties\": {\r\n \"alertType\": \"PS-UT-AlertType\",\r\n \"lastModifiedUTC\": \"2022-04-07T09:15:38.1181944Z\",\r\n \"expirationDateUTC\": \"2022-10-07T09:15:38.1181944Z\",\r\n \"state\": \"Enabled\",\r\n \"reason\": \"Other\",\r\n \"comment\": \"PS-UT-Comment\"\r\n }\r\n}",
196+
"StatusCode": 200
197+
}
198+
],
199+
"Names": {},
200+
"Variables": {
201+
"SubscriptionId": "487bb485-b5b0-471e-9c0d-10717612f869"
202+
}
203+
}

0 commit comments

Comments
 (0)