Test-SIInstall
Health check of a SecurityInsight install (read-only)
Purpose
Read-only health check: tables, each engine's last run, the data collection rules, and the identity's rights. Exit 1 when anything is wrong.
When to run it
Any time -- after an install, an update, or when something looks wrong.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Reader (and Log Analytics Reader on the workspace) | the install's resource group | to read the resources and query the tables |
What it changes
Nothing - it only reads.
What it only reads
- the workspace tables and run records
- the data collection rules
- the identity's role assignments
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -ConfigPath | no | The install's config file. Default: config/SecurityInsight.custom.ps1 of this copy. | |
| -SinceHours | no | 26 | How far back to look for data and runs (default 26: one daily run plus margin). |
| -RunningGraceHours | no | 4 | A run that started longer ago than this and never ended is reported (default 4). |
| -IdentityName | no | The install's user-assigned identity, when the config does not name it and its resource group holds more than one. | |
| -PrincipalId | no | The identity's object (principal) id -- any identity, also a VM's system-assigned one. | |
| -AllowedGrant | no | @() | Extra write grants that are allowed on purpose, as 'Role@/scope'. |
| -SignIn | no | 'Auto' | Auto (default: the SI_DIAGNOSTICS_* service principal when set, otherwise Config) | Config (the install's own identity). AzContext is no longer supported: SecurityInsight v3 uses no Az PowerShell session. |
| -PassThru | no |
Preview with -WhatIf
The same check -- it changes nothing in any case.
Undo
Nothing to undo: read-only.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Test-SIInstall.ps1 -OutFile Test-SIInstall.ps1
.\Test-SIInstall.ps1To check the download first, compare its SHA-256 with the published one:
SHA-256 058362deb5579c67f0be91e65cf6eca691dbe05efbd37d456b3c24fbd4d5a664
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Test-SIInstall.ps1 -Full · Source: Test-SIInstall.ps1
Every script, identity and permission for your security review: SecurityInsight