Giter Club home page Giter Club logo

azworkspacemanager's Introduction

image

Maintenance PRs Welcome

Good First Issues Needs Feedback

Az Workspace Manager (Preview)

Why this PowerShell Module

Currently the Microsoft Sentinel Workspace Manager (Preview) is only available through the Azure Portal of via the REST API.
Because the Azure Portal is using API calls in the background, and because the Microsoft Sentinel Workspace Manager API
contains some errors, I have decided to create a PowerShell Module called AzWorkspaceManager

This module is especially useful in scenario's where you want to manage the Workspace Manager using Infrastructure as Code or using pipelines.

Installation

To get started with this PowerShell module you only need to follow these basic steps.

Click on the topics below to fold them out.

Prerequisites
Install Module
Install-Module AzWorkspaceManager

Get started with the module

This section shows a couple of examples on how to get started with this module.

Workspace Manager Configuration

Create a Workspace Manager configuration

Creating a Workspace Manager configuration in the parent Microsoft Sentinel instance.

Add-AzWorkpaceManager -Name 'myWorkspace' -ResourceGroup 'myResourceGroup'


Add-WorkspaceManager

Add Workspace Manager Members and Groups

Add a Workspace Manager Member

Creating Workspace Manager members in the Workspace Manager Configuration.

To add a workspace member the identlty used has to have Microsoft Sentinel Contributor permissions on the target workspace.

$arguments = @{
    workspaceName = 'myWorkspace'
    resourceId    = $resourceId
    tenantId      = $tenantId
}

  Add-AzWorkpaceManagerMember @arguments

Add a Workspace Manager Group

$arguments = @{
    workspaceName           = 'myWorkspace'
    name                    = 'myGroup'
    workspaceManagerMembers = 'mySecondWorkspace(f6426b36-04fa-4a41-a9e4-7f13abe34d55)'
}

  Add-AzWorkpaceManagerGroup @arguments

Create a member and add through pipeline to group

$arguments = @{
    workspaceName = 'myWorkspace'
    resourceId    = $resourceId
    tenantId      = $tenantId
}

  Add-AzWorkpaceManagerMember @arguments | Add-AzWorkspaceManagerGroup -GroupName 'myGroup'
}

Add-WorkspaceManagerMember-Group

Add Workspace Manager Assignments

Add a Workspace Manager Assignment

This example creates an empty assignment.
Because the assignment name is not provided, the 'GroupName' value will be used.

$arguments = @{
    workspaceName = 'myWorkspace'
    groupName     = 'myGroup'
    resourceId    = $resourceId
}

  Add-AzWorkspaceManagerAssignment @arguments

Add an Alert Rules to a Workspace Manager Assignment

This example adds the resourceId of an alert rule to an assignment

$arguments = @{
    workspaceName = 'myWorkspace'
    name          = 'myAssignment'
    groupName     = 'myGroup'
    resourceId    = $resourceId
}

  Add-AzWorkspaceManagerAssignment @arguments

Add Alert Rules to a Workspace Manager Assignment

This example gets all saved searches and adds them to an assignment

$SavedSearches = Get-AzWorkspaceManagerItem -WorkspaceName 'myWorkspace' -Type SavedSearches

$arguments = @{
    workspaceName = 'myWorkspace'
    name          = 'myAssignment'
    groupName     = 'myGroup'
    resourceId    = $SavedSearches.resourceId
}

  Add-AzWorkspaceManagerAssignment @arguments

Create an Assignment Job and get status

Adding a Workspace Manager Assignment Job

Creating a Workspace Manager assignment job.

$arguments = @{
    workspaceName = 'myWorkspace'
    name          = 'myAssignment'
}

  Add-AzWorkspaceManagerAssignmentJob @arguments

Add a Workspace Manager Assignment Job for all assignments

This example creates an assignment job for each Workspace Manager assignment

$arguments = @{
    workspaceName = 'myWorkspace'
}

  Get-AzWorkspaceManagerAssignment @arguments | Add-AzWorkspaceManagerAssignmentJob

Get all Workspace Manager Assignment Jobs for an assignment

This example gets all jobs for a Workspace Manager Assignment

$arguments = @{
    workspaceName = 'myWorkspace'
    name          = 'myAssignment'
}

  Get-AzWorkspaceManagerAssignmentJob @arguments

Community

We all thrive on feedback and community involvement!

Have a question? โ†’ open a GitHub issue.

Want to get involved? โ†’ Learn how to contribute.

Buy me a Coffee

I am running on coffee and good music when writing code. So feel free to buy me a coffee.

Feedback

If you encounter any issues, have suggestions for improvements or anything else, feel free to open an Issue I will try to respond to each issue and Pull requests within 48 hours.

Create Issue

azworkspacemanager's People

Contributors

azurekid avatar

Stargazers

 avatar  avatar

azworkspacemanager's Issues

spaces are not allowed in group names

Describe the bug
When providing a group name that contains spaces, an error is shown that the name does not match the expected pattern

To Reproduce
Steps to reproduce the behavior:

  1. Add-AzWorkspaceManagerGroup
  2. Use a name with space in it
  3. See error

Expected behavior
The names supported that are also allowed by the API.

Screenshots

image

Code questions

Hey @azurekid , awesome repo dude very shiny and feature-rich good job! ๐Ÿ˜„๐Ÿ‘
Sorry for taking so long, I was a bit tired but I found the time to look at your repo.
Thanks for the request to take a look. I'll sum up my findings and I am curious what you think of them.

Generic

try/catch

You use catch blocks with errors in them, while if someone uses $erroractionpreference = 'Continue" this'll continue around the error statement. You've entered a break statement, but these should be used around trap statements and switch statements. I personally prefer to use a throw statement in the try block and a $PSCmdlet.ThrowTerminatingError($_) in the catch block. But I'm going to check my sources on this ๐Ÿ˜„๐Ÿ‘.

Parameter attributes

This is maybe a bit nitpicky so beware.
In several of your functions your parameters have Mandatory and ValueFromPipelineByPropertyName attributes.
Both with:

[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true)]

The Mandatory and ValueFromPipelineByPropertyName in there implicitly already means it is true.
This is the same effectively:

[Parameter(Mandatory, ValueFromPipelineByPropertyName)]

A parameter being not Mandatory and just accepting ValueFromPipelineByPropertyName is just leaving out the non-wanted attributes. I.e. this being a non-mandatory parameter accepting pipeline values based on property name.

[Parameter(ValueFromPipelineByPropertyName)]

Functionnames

This is a personal preference thing, while I like the Az prefixes of the cmdlets, I'd personally always choose names that makes it clear you're not creating a Microsoft-made Azure Module (recognizable with the Az* in the noun). So personally I'd prefix my functionnames with something like AzWM or something, to create a distinction with Microsoft modules and preventing potential conflicts/confusion with function names/functionality.

Format-Result

There's a return statement at the end, return statements at the end aren't necessary.
They are useful when trying to return to a higher level scope early in a function:

function Format-Result {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [array]$Message
    )
        $result = @()

        foreach ($value in $Message) {
        $split = $value.id.Split('/')
            $result += [ordered]@{
                Name              = $split[-1]
                ResourceGroupName = $split[-9]
                ResourceType      = '{0}/{1}' -f $split[-3], $split[-2]
                WorkspaceName     = $split[-5]
                ResourceId        = $value.id
                Tags              = $value.tags
                Properties        = $value.properties
            } | ConvertTo-Json -Depth 10 | ConvertFrom-Json -Depth 10
        }
   $result
}

Maybe the author of the code has a background in C#/.NET where this is a common practice.
This is also applicable for several other functions.

Get-AccessToken

You've created custom functionality around fetching a token, potentially to circumvent a dependency on Az.Accounts.
But you've an implicit dependency on the customer being logged in and them having the Azure Profile file present.
So wouldn't it be simpler to just do Get-AzAccesstoken -ResourceTypeName Arm? Less code for you to test and maintain ๐Ÿ˜„.

Get-LogAnalyticsWorkspace

I see some custom functions build around calling REST-methods on Azure Resource Manager API's and building the right URI and setting the auth headers, don't know if you're familiar with Invoke-AzRestMethod it does some of the heavy lifting for you.

Invoke-AzWorkspaceManager

This accepts pipeline input but contains no process block. This is advised if you're feeding more than one object in a pipeline statement. Else you'll end up with just the last object, you can read more about it in here: UseProcessBlockForPipelineCommand

Testing

Your module provides excellent functionality on Workspace Manager functionality. It can be convenient to add some code tests to test if your functions behave like you expect them to. Pester can be an excellent testing framework to test your functions in. It would help in making sure you've accounted for expected usage scenario's and validate if future features implement breaking changes in existing code. With those tests you can release future versions in confidence.

A thanks to you is also in place today I learned about $MyInvocation thanks for that ๐Ÿ˜„.

I also thought of some comfort features like tab completion on the workspaces etc., but that is not necessary.
I haven't digged around in the Workspace Manager functionality itself, I'd have to get some flight hours with it before I use your module to fully understand what it's value is and provide in depth feedback. But all in all good job dude ๐Ÿ˜„๐Ÿ‘.

Payload output is shown on assignments

Describe the bug

When creating an assignment the payload is shown that is sent to the API

To Reproduce

  1. Create and assignment Add-AzWorkspaceManagerAssignment -WorkspaceName -'myWorkspace' -GroupName 'myGroup'

Expected behavior
No payload output is shown

Screenshots
If applicable, add screenshots to help explain your problem.

image

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.