Upgrade-SIToPro
Upgrade a container install to Pro updates
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Switches a container install from updating by hand to Pro updates: installs the updater job (Install-SIUpdaterJob) with the container hosting the setup saved, and records the job in config\SecurityInsight.custom.ps1.
When to run it
Once, from the Pro package, on a container install that should receive Pro updates.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (and User Access Administrator with -GrantSpnRoles) | the install's resource group, registry and Key Vault | Install-SIUpdaterJob builds the image and creates the job |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure | create | the updater job and its identity (Install-SIUpdaterJob -Apply) | the job updates the containers from now on | delete the job caj-si-updater and its identity | ||
| the install folder | update | config\SecurityInsight.custom.ps1: the updater job recorded in the saved container hosting | so a manual update leaves the containers to the job | remove the SI_Bootstrap_UpdaterJob line |
What it only reads
- config\SecurityInsight.custom.ps1 (the saved container hosting)
- whether an updater job already owns the rollout
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -UpdateRing | no | -1 | The update ring this environment takes (0-3; your licence or Invardia support tells you which -- design partners 2, everyone else 3). Without it the ring recorded for the install is used; with none, the job asks for nothing. |
| -UseManagedIdentity | no | The job signs in as its own managed identity (recommended) -- no certificate. | |
| -CertSecretName | no | Without -UseManagedIdentity: the Key Vault secret holding the SPN certificate (PFX) the updater signs in with. | |
| -KeyVaultName | no | Your Key Vault. Default: SI_KeyVaultName from your config. | |
| -EnvName | no | The Container Apps environment, when your saved hosting predates SI_Bootstrap_EnvName. | |
| -JobName | no | 'caj-si-updater' | |
| -GrantSpnRoles | no | Passed to Install-SIUpdaterJob.ps1: grant the identity what the updater needs on the registry, resource group and vault. | |
| -Apply | no | Install the updater job. Without it, only the plan is printed. |
Preview with -WhatIf
Prints the plan, including anything missing; the updater job is not installed and nothing is recorded.
Undo
Delete the job caj-si-updater and remove SI_Bootstrap_UpdaterJob from config\SecurityInsight.custom.ps1.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight