Validate-SILogAnalytics
Provision the Log Analytics workspace, DCE and DCR
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Creates (when missing) the resource groups, the Log Analytics workspace, the data collection endpoint, the SI_IdentityAssets table and its data collection rule, and grants the SecurityInsight app its roles on them. Idempotent.
When to run it
Once, when setting up a VM install by hand (the guided install does this itself).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner (or Contributor + User Access Administrator) | the subscription (or the resource groups) | to create the resources and assign the roles |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure | create | the resource groups, the Log Analytics workspace, the data collection endpoint, the table SI_IdentityAssets_CL and its data collection rule | the place SecurityInsight sends its data to | delete the resources | ||
| Azure RBAC | grant | the SecurityInsight app | Monitoring Metrics Publisher, Monitoring Contributor, Log Analytics Contributor | Monitoring Metrics Publisher and Monitoring Contributor on the DCE and DCR resource groups; Log Analytics Contributor on the workspace | to send data through the data collection rules, and to let a run create its own tables and rules (no plain Contributor: a run creates no other resource and assigns no role) | remove the role assignments |
What it only reads
- the existing resource groups, workspace, DCEs and DCRs
- the SecurityInsight app's service principal
Parameters
None.
Preview with -WhatIf
Every create and every role assignment is printed as [WHATIF] and not done; the reads still run.
Undo
Delete the resources it created and remove the role assignments.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, outlook.office.com, outlook.office365.com, storage.azure.com, vault.azure.net
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight