Azure SQL与数据库漏洞评估扫描

Question

我想在Azure SQL server和数据库级别上以语法的方式打开“漏洞评估扫描”。应该再发生一次。

我正在处理的项目有许多调用Az模块的power shell脚本。

您知道我应该调用哪些Az模块来将“漏洞评估扫描”设置为重新发生吗？

Answer 1

I think you can use Azure Powershell command , 
Start-AzSqlDatabaseVulnerabilityAssessmentScan.
This above triggers the start of a vulnerability assessment scan on a database.

The one below starts the instance scan.
Start-AzSqlInstanceDatabaseVulnerabilityAssessmentScan

You can use the below script :

{

# set parameters - resource group, server, database and storage account
$params =  @{ rgname = "rg";
     serverName = "my-server";
     databaseName = "my-db";
     storageAccount = "mystorage"
}
# Turn on ATP
Enable-AzureRmSqlServerAdvancedThreatProtection -ResourceGroupName $params.rgname -ServerName $params.serverName

# Set Vulnerability Assessment storage settings for all the databases in the server
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"}| Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -StorageAccountName $params.storageAccount 
# Update vulnerability assessment settings to turn ON recurring scans, and provide email to receive results
$scanNotificationEmail = @("user1@microsoft.com")
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName| where {$_.DatabaseName -ne "master"} | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -RecurringScansInterval Weekly -NotificationEmail $scanNotificationEmail -EmailAdmins $true
# Set Vulnerability Assessment baseline for rule VA1143 on all the databases in the server 
$ruleId = "VA1143"
$baselineResult = @( '1')
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"} | Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline -RuleId $ruleId -BaselineResult $baselineResult
# Run a new scan on a database
$scanId1 = "custom-scan1"
$scanJob = Start-AzureRmSqlDatabaseVulnerabilityAssessmentScan -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1 -AsJob
$scanJob | Wait-Job
$scanRecord = $scanJob | Receive-Job
# Convert the raw scan results to an Excel file
$convertScanResult = Convert-AzureRmSqlDatabaseVulnerabilityAssessmentScan  -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1
# Download the scan results Excel summary file
$connectionStringToStorageAccount = "DefaultEndpointsProtocol=https;AccountName=......."
$convertedScanResultsDownloadLocalFolder = "C:\ScanResults\"
$storageAccountContext = New-AzureStorageContext -ConnectionString $connectionStringToStorageAccount
$convertScanResultSplitted = $convertScanResult.ExportedReportLocation -split "/"
$containerName = $convertScanResultSplitted
Get-AzureStorageBlobContent -Blob ($convertScanResult.ExportedReportLocation -split $containerName + '/')[1]  -Container $containerName -Destination $convertedScanResultsDownloadLocalFolder -Context $storageAccountContext
}