Set-SICiCutoff
Set the one-time CI cut-off
Purpose
Sets (or takes back) the one-time CI cut-off: the CI build ignores records collected before it and retires at once the CIs built only from them. Plans by default: the CIs that would retire and whether data-out to a CMDB is on.
When to run it
When records of an old collection keep CIs current that are no longer collected, and a full CI build takes too long because of them.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | the install identity (service principal + certificate), or the Invardia Support session | the Pro database | to read the CIs and write the cut-off |
| azureRbac | Reader | the Pro SQL server | to check the server's public network access first (a private install is refused, nothing is opened) |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Pro SQL database | update | cfg.InstallState 'CiCutoff': the cut-off time, who set it, why | the Pro database | the CI build reads it and ignores the records collected before it | run again with -Clear (the row is kept, marked cleared) | |
| Pro SQL database | create | an audit trail row (cibuild.cutoff.set / cibuild.cutoff.clear) | the Pro database | who set the cut-off, when and why | none: audit rows are kept |
What it only reads
- the cut-off now set
- the look-back (SI_ActiveStaleDays) and the data-out outputs (SI_DataOut_Outputs)
- how many CIs would retire (a read-only count)
- the SQL server's public network access
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -CutoffUtc | no | The cut-off (UTC; a time without a zone is taken as UTC). Default: now. Never in the future, never older than the look-back. | |
| -Reason | yes | Why (required, at least 10 characters): in the state row, on every CI it retires and on the audit trail. | |
| -Clear | no | Take the cut-off back (the row is kept, marked cleared). | |
| -Apply | no | Write. Without it the script only plans. | |
| -SqlServer | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -ResourceGroupName | no | [string]$global:SI_Bootstrap_ResourceGroupName | The install's resource group: its database server's public network access is read first (a private install is refused). |
| -SubscriptionId | no | ||
| -InsideNetwork | no | This runs INSIDE the install's network (a machine in it, or the install's own job): the private check is not needed. | |
| -SupportSql | no | Reach the database through the Invardia Support app's audited SQL (Invoke-InvardiaSupportSql; open the session first). | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -Store | no | The database, already open (New-SIProSettingsStore -Invoke ...): a test's fake, or a caller's store. | |
| -NetworkAccess | no | TEST SEAM: { } -> the database server's public network access ('Enabled' | 'Disabled' | ...), instead of reading it from Azure. | |
| -PassThru | no |
Preview with -WhatIf
The preview: the cut-off now set, the look-back, how many CIs would retire and whether data-out to a CMDB is on; nothing is written (same as without -Apply).
Undo
Run again with -Clear. A CI the cut-off already retired stays retired until a source records it again; records are never deleted.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Set-SICiCutoff.ps1 -OutFile Set-SICiCutoff.ps1
.\Set-SICiCutoff.ps1 -Reason <Reason>To check the download first, compare its SHA-256 with the published one:
SHA-256 0ee990c58e3966680e3c5cfbb006e1593ab7e225cf9cac755422791dd4a5c98e
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-SICiCutoff.ps1 -Full · Source: Set-SICiCutoff.ps1
Every script, identity and permission for your security review: SecurityInsight