Import-SIProSettings
Move an install's configuration into the Pro database
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Moves an installation's configuration from its files (settings, documents, configuration items that differ from the templates, close-loop connectors) into the Pro settings database, lists what needs review, and with -RetireFiles moves the imported files aside.
When to run it
Once, when an install moves to SecurityInsight Pro (the guided install and an upgrade run it).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| sql | the install's identity (db_datawriter; db_ddladmin with -CreateSchema) | the Pro database | to write the settings and, with -CreateSchema, the tables |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure SQL (Pro) | create | the cfg schema and the default templates (only with -CreateSchema) | the tables the settings are written to | drop the database (a new install) | ||
| Azure SQL (Pro) | create | settings, documents, configuration items and connectors imported from the files, each with its change-log row | the Pro engines and the web app read them | reset each setting in the web app (Settings), or restore the configuration backup | ||
| the install folder | update | the imported custom files moved aside (only with -RetireFiles) | they are in the database now | move the files back | ||
| the install folder | create | OUTPUT\Import-SIProSettings.report.json, the import report | what was imported and what needs review | delete the file |
What it only reads
- the install's custom files (*.custom.*)
- the templates published in the Pro database
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -InstallPath | no | ||
| -Apply | no | ||
| -CreateSchema | no | ||
| -RetireFiles | no | ||
| -Server | no | [string]$global:SI_ProSqlServer | The Pro database and the engine identity. Defaults: the globals a loaded configuration sets. Passed explicitly when importing into an empty database -- loading the full configuration would already try to read it. |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -OverlayRoot | no | The rules overlay to import tier rules from. Default: SI_EnrichmentDataRoot -- the loaded value, else the plain value the solution's custom file sets. | |
| -AssetTaggingPath | no | Where the asset-tagging rules live. Default: where the asset-tagging launcher finds them (SettingsPath from the configuration files, else its default folder -- engine\asset-tagging\AssetTagging.Resolve.ps1). | |
| -ReportPath | no | The JSON import report. Default: OUTPUT\Import-SIProSettings.report.json under the solution. |
Preview with -WhatIf
Prints the plan and what needs review; nothing is written to the database, no file is retired and the report file is not written.
Undo
Restore the configuration backup in the web app, and move retired files back.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight