Clear-SIGuardEvents
Acknowledge every open guard event
Purpose
Acknowledges every open guard event (safety check) in the Pro database: a fresh start. Previewed without -Apply.
When to run it
After the causes of the open guard events are fixed.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | the install identity (service principal + certificate) | the Pro database | to update the guard events |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Pro SQL database | update | each open guard event: acknowledged, by, reason | the Pro database | start from a clean list of safety checks | none: acknowledgements are kept as history |
What it only reads
- the open guard events
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SqlServer | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -Reason | yes | Why (required, at least 10 characters): on every acknowledgement and on the audit trail. | |
| -AcknowledgeAll | no | Acknowledge every open guard event (the only mode -- named so the command says what it does). | |
| -Apply | no | Write. Without it the script only plans. | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -Store | no | The database, already open (New-SIProSettingsStore -Invoke ...): a test's fake, or a caller's store. | |
| -PassThru | no |
Preview with -WhatIf
The preview: the open events it would acknowledge; nothing is acknowledged (same as without -Apply).
Undo
Acknowledgements are history and are not reverted; a guard that trips again opens a new event.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, portal.invardia.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Clear-SIGuardEvents.ps1 -OutFile Clear-SIGuardEvents.ps1
.\Clear-SIGuardEvents.ps1 -Reason <Reason>To check the download first, compare its SHA-256 with the published one:
SHA-256 a96f87d07a7ef6cdfe089e9aaed2d2af2ae3f298dee9441d4e4ec74a157a7d5e
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Clear-SIGuardEvents.ps1 -Full · Source: Clear-SIGuardEvents.ps1
Every script, identity and permission for your security review: SecurityInsight