Get-SIDeviationReport
What have we switched off, changed or exempted?
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Reads the install's custom files and lists one row per deviation from the shipped defaults (settings, exclusions, disabled detections, tier moves, overrides, risk weights), with who changed it and when where known.
When to run it
Whenever you want to review or show what this install deviates from (an audit, a review with security).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | read access to the install folder | the SecurityInsight folder | it only reads the files |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| the local machine | create | the CSV file (only with -AsCsv) | the report as a file | delete the file |
What it only reads
- the install's custom and shipped files
- logs\settings-changes.log
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SIRoot | no | The SecurityInsight folder. Default: the folder above this script. | |
| -SettingsPath | no | Where the Risk Analysis exclusion and weights files live. Default: <SIRoot>\risk-analysis-detection (the engine's own default). | |
| -OverlayRoot | no | The tier rule overlay folder, when the install keeps its rules outside the code tree (SI_EnrichmentDataRoot). Default: $global:SI_EnrichmentDataRoot when it is set. | |
| -CatalogPath | no | A settings catalog to take the shipped defaults (and which settings are secrets) from. Without it the shipped defaults files are read. | |
| -Kind | no | Only these kinds (Exemption, Exclusion, DisabledDetection, TierMove, ItemOverride, RiskWeights, Setting). | |
| -AsCsv | no | Write the report to a CSV file instead of the pipeline; returns the file. | |
| -CsvPath | no | The CSV file to write (with -AsCsv). Default: .\SecurityInsight-deviations-<UTC time>.csv | |
| -ExpiringDays | no | 30 |
Preview with -WhatIf
Returns the report rows; with -AsCsv it says where it would write the CSV and writes nothing.
Undo
Nothing to undo -- delete the CSV if one was written.
Network
It connects to: invardia.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight