Install-SIFlowTask
Run the engines as one daily flow (VM install)
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
On a VM install (Task Scheduler): registers one scheduled task that runs the engines as ONE flow, and disables the per-engine tasks the flow replaces. -Remove is the reverse.
When to run it
Once, on a VM install, to switch from one scheduled task per engine to the flow; -Remove to switch back.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | local Administrator | the VM | to register, enable and disable scheduled tasks that run as SYSTEM |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Windows Task Scheduler | create | the task \SecurityInsight\SecurityInsight (flow), running as SYSTEM every 5 minutes | it starts the flow when it is due | run with -Remove | ||
| Windows Task Scheduler | update | the per-engine SecurityInsight tasks the flow replaces: disabled, not deleted | the flow runs those engines now | run with -Remove: exactly the recorded tasks are enabled again | ||
| the install folder | create | data\flow\replaced-tasks.json -- the record of the disabled tasks | so -Remove can enable exactly those tasks again | run with -Remove |
What it only reads
- the scheduled tasks on the VM
- the flow definition (config\job-flow.custom.json or the shipped default)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Apply | no | ||
| -Remove | no | ||
| -Flavour | no | 'community-vm' | (the start time / cadence is the flow definition's -- the task only wakes the runner) |
| -TaskPath | no | '\SecurityInsight\' | |
| -TaskName | no | 'SecurityInsight (flow)' | |
| -RunAs | no | 'SYSTEM' |
Preview with -WhatIf
Prints what -Apply (or -Remove) would do; no task is registered, enabled or disabled and no file is written.
Undo
Run with -Remove.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, sts.windows.net, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight