Set-SIProSetting
Set or reset one Pro setting
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Sets (or resets to the default) ONE SecurityInsight Pro setting by its name -- the same row the web app's Settings page writes, with its change-log entry and the reason given.
When to run it
When a setting must change without the web app (a guard switch at night, a setting the web app does not offer yet).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| sql | the install's identity (db_datawriter on the Pro database) | the Pro database | to write the setting and its change-log row |
| sql | the Invardia Support app (-SupportSql), with its support grant at the setup level (at most 1 hour) where it holds no standing database admin | the install's product databases | to write the setting from a Support session: the grant is opened first, read back, the setting written and the grant closed again; when the grant cannot be opened the setting is not written and the script fails, saying why |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure SQL (Pro) | update | one setting row and its change-log row | the engines read it from their next run | set the old value again, or -Reset |
What it only reads
- the settings catalog (config\settings.catalog.locked.json)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Name | yes | ||
| -Value | no | The value as text (true / false, a number, a word, or JSON for a list). A list also takes plain text as ONE item (a mail address setting, name ending in _To: addresses separated by commas). Not for a secret: give -KeyVaultSecretName. | |
| -KeyVaultSecretName | no | ||
| -Reset | no | Remove the row: the setting goes back to its default. | |
| -Scope | no | '' | 'solution' (every engine, the default) or 'engine:<name>' (the web app's own settings: 'engine:management-web'). |
| -Reason | yes | ||
| -Apply | no | ||
| -SqlServer | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -SupportSql | no | Reach the database through the Invardia Support app's audited SQL (Invoke-InvardiaSupportSql; open the session first). | |
| -SubscriptionId | no | '' | With -SupportSql: where the install is, for the support grant (else the Support session finds it). |
| -ResourceGroupName | no | '' | |
| -Store | no | The database, already open (New-SIProSettingsStore -Invoke ...): a test's fake, or a caller's store. | |
| -PassThru | no |
Preview with -WhatIf
Prints what it would write; the setting is not written.
Undo
Run again with the previous value, or with -Reset.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, portal.invardia.com, storage.azure.com, vault.azure.net
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight