Publish-SITemplates
Publish configuration templates into the Pro database
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Publishes configuration templates (Risk Analysis reports, risk index, rules, asset tagging, service model) into the Pro settings database: the release's own, a template pack, a staged pack or a roll back -- customer overrides untouched.
When to run it
By every setup and update path (-InstallDefault); by hand to publish a template pack or roll one back.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| sql | the install's identity (db_datawriter; db_ddladmin with -CreateSchema) | the Pro database | to write the templates and, with -CreateSchema, the tables |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure SQL (Pro) | update | the templates in force, the template release record, the fingerprint and the audit trail | the Pro engines read the templates | roll back to the previous template pack (-RollbackToVersion, or in the web app) | ||
| Azure SQL (Pro) | create | the cfg schema (only with -CreateSchema / -InstallDefault) | the tables templates live in | drop the database (a new install) | ||
| Azure SQL (Pro) | create | a staged template pack for the web app (only with -Stage) | the web app offers it for review | remove the staged pack in the web app |
What it only reads
- the shipped templates or the pack file
- the templates and overrides in the Pro database
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -InstallPath | no | ||
| -Apply | no | ||
| -CreateSchema | no | ||
| -InstallDefault | no | What every setup / update path runs (#250): -Apply -CreateSchema of the shipped templates -- the schema, the #251 carry-over, and the default templates installed (or adopted) as template pack 1.0. | |
| -AcceptTemplateChange | no | The templates in force may change (the plan listed what changes). Without it a moved fingerprint writes nothing. | |
| -AcceptFingerprint | no | Accept only this fingerprint (at least its first 12 characters) -- what the plan printed. | |
| -Server | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -Families | no | Publish only these kinds (default: all). Retiring is limited to the same kinds. | |
| -Version | no | The version to stamp (default: the shipped template pack's version, engine\pro-settings\shipped-template-pack.json). | |
| -PackPath | no | A template pack file (si-templates-<packVersion>.json); its .sha256 beside it is checked when present. | |
| -PackSha256 | no | The pack's SHA-256 (overrides the .sha256 file). | |
| -FromStaged | no | A pack staged in cfg.TemplatePackStaged, by version. | |
| -RollbackToVersion | no | Republish the items as they were at this pack / release version (cfg.TemplateRevision). | |
| -Method | no | Only these detection methods ('<method>' or '<engine>/<method>'; '*' = all). | |
| -Stage | no | Put the pack (or the shipped templates) in cfg.TemplatePackStaged for the web app. | |
| -StageOrigin | no | ||
| -StageRing | no | ||
| -StageManifestB64 | no | A pack from Invardia: the SIGNED manifest it came with (manifestB64, signature, keyId), kept with the staged pack -- -FromStaged verifies it again against the keys embedded in this release before anything is installed. | |
| -StageSignature | no | ||
| -StageKeyId | no | ||
| -StrictJob | no | A job run: a publish that is blocked FAILS (the web app shows the job as failed) instead of ending as a plan. | |
| -RequestedBy | no | Who accepted this release in the web app (recorded in the release's reason; the actor stays the session). | |
| -Store | no | The database, already open (New-SIProSettingsStore -Invoke ...): the container updater's token, or a test's fake. | |
| -PassThru | no | Return the outcome as an object (the updater reads it). | |
| -InstallCurrent | no | #405: RING 1 (internal) -- every template shipped with this code installed DIRECTLY: no pack number, no gate, no pack recorded as a release (the r1 deploy passes it; setup\Invoke-SIContainerUpdate.ps1 -InstallTemplatesDirect). | |
| -Class | no | #405: with -RollbackToVersion, only the items of these classes (the one-click roll back of Microsoft content). | |
| -ClassificationReviewed | no | $null | Test seam: $true / $false instead of the shipped pack's ClassificationReviewed flag ($null = the flag decides). |
Preview with -WhatIf
Prints the plan (what would be inserted, updated, retired); nothing is written -- also with -InstallDefault, -InstallCurrent or -Stage.
Undo
Roll back to the previous template pack.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight