Reset-SIData
Start the data again from nothing
Purpose
Empties the install's data in place -- every table of the Pro database's data schemas and the run history that describes that data -- and keeps the install itself: the databases, users, roles, grants, settings, templates, the change journal, the audit trail and, by default, the identity ledger (stable ids; an object out of scope makes no CI). Plans by default: the rows and MB per table that would go, and what is kept.
When to run it
When the data should start again from nothing, for example after a scope mistake collected objects that were never wanted, and nobody uses the data yet. The scheduled pipeline fills the data again from the sources.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | the install identity (service principal + certificate), or the Invardia Support session | the Pro database (and the identity ledger database with -IncludeIdentityLedger) | to read the tables and empty the data tables |
| azureRbac | Reader | the Pro SQL server | to check the server's public network access first (a private install is refused, nothing is opened) |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Pro SQL database | remove | every row of the data schemas' tables and of the connectors' run and change log and the data-out items and batches | the Pro database | a fresh start: the pipeline fills the data again from the sources | none: the rows are not kept; the next pipeline runs collect the data again | |
| identity ledger SQL database | remove | only with -IncludeIdentityLedger (opt-in): every row of the identity ledger (its schema record is kept) | the identity ledger database | the objects get their ids again from the fresh data | none: the ledger is filled again by the next CI correlation | |
| Pro SQL database | update | the install lock (cfg.PipelineLock 'install'), held during the reset and released at its end | the Pro database | no pipeline run, update or index build starts while the tables are emptied | released at the end; a lock left behind frees itself 15 minutes after its last sign of life | |
| Pro SQL database | create | an audit trail row (data.store.reset) with the rows per table | the Pro database | who started the data again, when and why | none: audit rows are kept |
What it only reads
- the tables of both databases with their rows and size
- whether a pipeline run, an update, the clean-up or the index build is running
- whether a live ServiceNow / REST output holds SecurityInsight's keys
- the identity scope settings SI_Identity_SkipNeverSyncedDisabledAd and SI_Identity_SkipDeletedGroups
- the SQL server's public network access
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Reason | yes | Why (required, at least 10 characters): on the audit trail. | |
| -Apply | no | Empty the tables. Without it the script only plans. | |
| -AcceptExternalKeysLost | no | Go on although a live ServiceNow / REST output holds SecurityInsight's keys (the fresh data gets new keys). | |
| -IncludeIdentityLedger | no | Opt-in: empty the identity ledger database too (default: kept -- stable ids; an object out of scope makes no CI). | |
| -SqlServer | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -IdentityDatabase | no | The identity ledger database (default: the install's SI_LedgerDatabase setting, else sqldb-si-identity) and its server. | |
| -IdentitySqlServer | no | ||
| -ResourceGroupName | no | [string]$global:SI_Bootstrap_ResourceGroupName | The install's resource group: its database server's public network access is read first (a private install is refused). |
| -SubscriptionId | no | ||
| -InsideNetwork | no | This runs INSIDE the install's network (a machine in it, or the install's own job): the private check is not needed. | |
| -SupportSql | no | Reach the databases through the Invardia Support app's audited SQL (Invoke-InvardiaSupportSql; open the session first). | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -Store | no | The databases, already open (New-SIProSettingsStore -Invoke ...): a test's fake, or a caller's store. | |
| -IdentityStore | no | ||
| -NetworkAccess | no | TEST SEAM: { } -> the database server's public network access ('Enabled' | 'Disabled' | ...), instead of reading it from Azure. | |
| -Pause | no | TEST SEAM: { param([int]$ms) } -- the pause between two batches. | |
| -PassThru | no |
Preview with -WhatIf
The preview: per table the rows and MB that would go, what is kept, and anything that would hold the reset; nothing is changed (same as without -Apply).
Undo
None: the emptied rows are not kept. The configuration is untouched, and the scheduled pipeline collects the data again from the sources.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Reset-SIData.ps1 -OutFile Reset-SIData.ps1
.\Reset-SIData.ps1 -Reason <Reason>To check the download first, compare its SHA-256 with the published one:
SHA-256 878055bb756a8230635b229887a1a5c5970d777cf5b5e8a32cb4b96db8d6da36
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Reset-SIData.ps1 -Full · Source: Reset-SIData.ps1
Every script, identity and permission for your security review: SecurityInsight