Install-SecurityInsight
Install SecurityInsight (two lines)
Purpose
Installs SecurityInsight with two lines. Line 1 downloads this one small file: Invoke-WebRequest https://invardia.com/support/si/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1. Line 2 runs it: ./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>', and only the settings you change are added to it as parameters (every other setting has its default). This copy installs SecurityInsight Pro from Invardia, never from GitHub; Pro and the trial install the same way. SecurityInsight Community installs with the same line 2; its line 1 downloads the Community copy from the latest public release on GitHub: Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1. It signs you in to Azure once (Azure Cloud Shell with no prompt, else your browser; the installer takes this sign-in over), asks Invardia for the SecurityInsight Pro package of your update ring (-UpdateRing, default ring 3; Invardia hands it out to a signed-in admin of a tenant with an Invardia environment for SecurityInsight) and checks it exactly as SecurityInsight's updater checks an update: the manifest's signature with Invardia's update-signing key, then the downloaded package's size and SHA-256. A refusal stops with Invardia's reason and nothing is installed. It unpacks the package in a new, empty temp folder and runs its installer (setup/Install-SecurityInsight.ps1) from there with exactly the parameters given. The installer checks first (sign-in, tenant, subscription, permissions, resource providers, free names), then creates the install step by step and reports every step. No answer file, no licence on the line and no PowerShell module: the install deploys without a licence, with every job parked until the licence is assigned.
When to run it
Once, to install SecurityInsight in Azure Cloud Shell: line 2 carries -TenantId and -SubscriptionId, and only the settings you change. Again with -Resume (the downloaded release and the install's own state are used again) when an install stopped.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner (or Contributor + User Access Administrator) | the subscription SecurityInsight is installed in | to create the resource group and its resources and to grant SecurityInsight's identity its roles |
| entraRole | Privileged Role Administrator (or Global Administrator) -- optional | the tenant | to grant the read-only API permissions; without it that step ends as a warning with the command for someone who can |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| This machine | create | a new folder in the temp folder with the downloaded package (removed after a successful install unless -KeepDownload; kept after a stop for -Resume), a temporary folder with the sign-in and package-check code this file carries (removed when it ends), and a small note with the package folder's path (~/clouddrive/invardia/securityinsight-launcher.json, else .invardia in the user profile) | the installer runs from the checked release; -Resume finds it again | delete the securityinsight-release-* folder in the temp folder and the note | ||
| Azure | create | the SecurityInsight resource group, Log Analytics workspace, data collection endpoint and rules, storage account, Key Vault, container registry and image, Container Apps environment and engine jobs | the resources SecurityInsight runs on | delete the resource group (removes everything the install created in it) | ||
| Azure | create | SecurityInsight's managed identity | the identity the engines run as | delete the identity in the resource group | ||
| Azure RBAC | grant | SecurityInsight's managed identity | Reader, Key Vault Secrets User, Monitoring Metrics Publisher, Log Analytics Reader, Storage Blob / Queue / Table Data Contributor, AcrPull | the subscriptions and resources SecurityInsight reads | the read and send roles the engines need (the same plan as Grant-SIIdentity) | remove the role assignments |
| Entra ID | grant | SecurityInsight's managed identity | the read-only application permissions Grant-SIIdentity lists | the tenant | the read-only API permissions (Microsoft Graph, Defender XDR, Defender for Endpoint) the collection reads with | remove the permissions on the enterprise application |
| Key Vault | create | the keys a switched-on feature needs (Azure OpenAI, Shodan, SMTP password -- asked for in the shell, never a parameter) | the install reads them at run time | delete the secrets in the install's Key Vault | ||
| Azure SQL | create | the database, its tables, templates and settings, and the web app | SecurityInsight keeps its data and settings there | delete the database and the web app | ||
| Entra ID | grant | Invardia Support access (only with -SupportAppId) | so Invardia support can help with the install | run Grant-SISupportAccess -Remove |
What it only reads
- the SecurityInsight Pro package of the update ring from Invardia (invardia.com, with your Azure sign-in) and the zip it names
- the tenant, subscriptions and resource providers (the installer's checks)
- whether the names are free
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -ConfigPath | no | Kept for compatibility only: a file with the answers, keyed as in setup\install-parameters.json. A parameter given wins over it. Not needed: every setting is a parameter. | |
| -TenantId | yes | The tenant SecurityInsight assesses (GUID). Required (with -SubscriptionId); every other setting has a default. | |
| -SubscriptionId | yes | The subscription for SecurityInsight's own resources (GUID). Required. | |
| -Location | no | The Azure region (default westeurope). | |
| -ResourceGroup | no | The resource group, created when it does not exist (default rg-si; an install that already runs keeps its own). | |
| -Owner | no | The resource group's 'owner' tag: a team or mailbox (default empty). | |
| -Hosting | no | Where SecurityInsight runs: container (Azure Container Apps jobs; the only choice). | |
| -WorkspaceMode | no | new (default: a dedicated Log Analytics workspace) or existing (with -WorkspaceId). | |
| -WorkspaceName | no | The new workspace's name (default log-si). | |
| -WorkspaceId | no | With -WorkspaceMode existing: the workspace's resource id. | |
| -SecurityWorkspaceId | no | The Microsoft Sentinel / Defender workspace (resource id, optional) Risk Analysis reads. | |
| -CollectionScope | no | What SecurityInsight reads in Azure: subscription (default), managementGroup (with -ManagementGroupId) or tenantRoot. | |
| -ManagementGroupId | no | The management group, with -CollectionScope managementGroup. | |
| -AiClassification | no | Switch: AI classification and summaries with your own Azure OpenAI (-OpenAiEndpoint, -OpenAiDeployment; the key is asked for in the shell). | |
| -OpenAiEndpoint | no | With -AiClassification: https://<name>.openai.azure.com/ | |
| -OpenAiDeployment | no | With -AiClassification: the deployment name. | |
| -Shodan | no | Switch: Shodan enrichment of public IP addresses (the key is asked for in the shell). | |
| -RunHourUtc | no | The daily run's UTC hour, 0-20 (default 4). | |
| -PipelineStartTime | no | HH:mm the daily pipeline starts (default 19:00 in the region's local time). | |
| -PipelineTimeZone | no | The time zone of -PipelineStartTime, e.g. Europe/Copenhagen (default: this machine's). | |
| -MailMode | no | sharedMailbox (default), smtp or none. | |
| -MailFrom | no | With sharedMailbox: the mailbox SecurityInsight sends as (default SecurityInsight@<your sign-in domain>). | |
| -MailboxCreate | no | With sharedMailbox: create the mailbox when it does not exist ($true, the default; -MailboxCreate $false = it must exist). | |
| -MailTo | no | Who receives the reports (default: you). A list, or one text with commas. | |
| -SmtpServer | no | With -MailMode smtp: the SMTP server. | |
| -SmtpPort | no | With -MailMode smtp: the port (default 587). | |
| -SmtpUser | no | With -MailMode smtp: the user (empty = anonymous relay; the password is asked for in the shell). | |
| -SmtpFrom | no | With -MailMode smtp: the sender address. | |
| -SqlLocation | no | The database's region (default swedencentral). | |
| -SqlAdminGroupId | no | The Entra group (object id) that administers the database (default: you). | |
| -WebApp | no | Install the web app ($true, the default; -WebApp $false = no web app). | |
| -WebAppAccess | no | external (default: from the internet behind Entra sign-in) or internal (from your network only). | |
| -WebAppAdmins | no | The web app's administrators (UPNs). Required when the install runs as an application. | |
| -AssetTaggingWrites | no | Switch: grant asset tagging the rights to write tags (writing is still switched on in the web app). | |
| -UpdateRing | no | The release ring this install follows: 1, 2 or 3 (default 3, broad). Recorded at install, also without a licence. SecurityInsight Pro installs the package Invardia serves to this ring. | |
| -ServiceNowUrl | no | https://<instance>.service-now.com (optional). | |
| -PrivateNetwork | no | Switch: SecurityInsight in a virtual network only, with private endpoints (give -VnetId, or -VnetAddressPrefix for its own network). | |
| -VnetId | no | With -PrivateNetwork: your virtual network's resource id (same region; Network Contributor on it). | |
| -VnetAddressPrefix | no | With -PrivateNetwork and no -VnetId: a free address range for SecurityInsight's own network, e.g. 10.0.24.0/24. | |
| -VnetName | no | The name of SecurityInsight's own network (default vnet-si). | |
| -AppsSubnetName | no | The container environment's subnet (default snet-si-apps; at least /27). | |
| -AppsSubnetPrefix | no | Its address range, only when the subnet is created. | |
| -EndpointsSubnetName | no | The private endpoints' subnet (default snet-si-endpoints; a /28 is enough). | |
| -EndpointsSubnetPrefix | no | Its address range, only when the subnet is created. | |
| -PrivateDnsZonesResourceGroupId | no | The resource group (resource id) of your central private DNS zones (optional: used, never written to). | |
| -HubVnetId | no | Your hub virtual network's resource id (optional): makes the network hand-off list exact. | |
| -LinkZonesToHub | no | Switch: SecurityInsight links its web app's DNS zone to the hub itself (needs Network Contributor on the hub). | |
| -PeerToHub | no | Switch: SecurityInsight peers its network with the hub in both directions (needs Network Contributor on both). | |
| -ReturnRouteRanges | no | With -HubVnetId: the address ranges your people browse from, e.g. '10.0.0.0/16,10.2.0.0/16' (optional). With -ReturnRouteNextHop, SecurityInsight's own network gets the route table rt-si on its apps subnet (each range -> your firewall) so replies find their way back; on your own network the route is on the network hand-off list. | |
| -ReturnRouteNextHop | no | With -ReturnRouteRanges: your hub firewall's private IP, e.g. 10.1.0.4 (the next hop of the return route). | |
| -CustomerManagedKeys | no | Switch: encrypt the database, storage and (with -CmkLogAnalytics) Log Analytics with your own key. | |
| -CmkKeyVaultId | no | The Key Vault (resource id) that holds the key (default: SecurityInsight's own). | |
| -CmkKeyName | no | The key's name (default si-data). | |
| -CmkLogAnalytics | no | off (default), cluster-existing (with -LogAnalyticsClusterId) or cluster-new. | |
| -LogAnalyticsClusterId | no | With -CmkLogAnalytics cluster-existing: your Log Analytics cluster's resource id. | |
| -SupportAppId | no | The Invardia Support app's client id in your tenant (optional; empty = no support access). | |
| -SupportAccess | no | troubleshoot (default) or setup. | |
| -ViaSupportApp | no | Invardia staff only: the same install, run inside a Connect-InvardiaSupport session for this tenant -- it signs in with the session (no browser, no person), so the web app's administrators come from -WebAppAdmins. Refused outside such a session or for another tenant, before anything is downloaded. | |
| -InstallId | no | 'securityinsight' | The install's name (default securityinsight): its state folder ~/clouddrive/invardia/<installId> keeps the answers, so the install continues with -Resume alone. |
| -LicencePath | no | Optional, not needed: without it the whole environment is installed with the paid features off; add the licence in the web app afterwards. | |
| -Reporter | no | { param($event) ... } -- called at the start and end of every step of the installer (its help has the event's fields). | |
| -PreflightOnly | no | Run the checks only. Nothing is created, changed or written (the release is still downloaded to the temp folder). | |
| -Resume | no | Continue an install that stopped: the release downloaded before is used again (when it is still there), and the installer skips the steps already done, with the answers of its first run (a parameter given now changes that one). | |
| -StatePath | no | The folder for the install's state file. Default: ~/clouddrive/invardia/<installId> (kept by Cloud Shell). | |
| -Version | no | the release to install (e.g. 3.0.21); default: the latest public release | |
| -KeepDownload | no | keep the downloaded release folder after a successful install |
Preview with -WhatIf
Signs you in, downloads and checks the package into the temp folder, then runs the installer's checks only (as -PreflightOnly): nothing is created, changed or written in Azure, and no note is written.
Undo
Delete the SecurityInsight resource group; remove the API permissions and the Invardia Support access from the enterprise applications; delete the downloaded release folder if it was kept.
Network
It connects to: invardia.com, login.microsoftonline.com, management.azure.com, *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.ipify.org, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, ifconfig.me, licenses.nuget.org, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.azure.com, portal.invardia.com, schema.management.azure.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
.\Install-SecurityInsight.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>To check the download first, compare its SHA-256 with the published one:
SHA-256 e49ec3564732c3c406225997f5fb5ff1ef88b5378baf4a0ea33e3bae05f45417
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Install-SecurityInsight.ps1 -Full · Source: Install-SecurityInsight.ps1
Every script, identity and permission for your security review: SecurityInsight