f-bader / SentinelARConverter

Sentinel Analytics Rule converter PowerShell module
MIT License
53 stars 11 forks source link

Feature/pester improvements based on #6 🚨 #13

Closed Manbearpiet closed 1 year ago

Manbearpiet commented 1 year ago

Module Functionality ⚒️

Developer conveniences👩‍💻

Manbearpiet commented 1 year ago

Hey @f-bader , can you be a bit more specific on what scenario's don't work? Like with examples? Because I want to write tests to check for the scenarios, but I'm not quite sure which scenario's you mean 😄👍.

f-bader commented 1 year ago

Sure thing @Manbearpiet

  1. Path not set when using UseDiplayNameAsFileName or UseIdAsFilename
Get-Content ./tests/examples/ScheduledMultiple.json -Raw | Convert-SentinelARArmToYaml -UseDisplayNameAsFilename -ErrorAction Stop -Verbose

image

  1. Filename is mandatory when using -Force

image

  1. After adding the fix the conversion fails because -Force is not part of the Pipeline parameter set

image

  1. Conversion of multiple rules results in entries for kind because not the current item, but all items are referenced.

image

  1. This does not happen for version because there the assignment works different, but the query still references all versions resulting in a possible yaml without a version attribute Modify tests/examples/ScheduledMultiple.json and remove one of the templateVersion attributes

image

After conversion the version attribute is missing in the resulting yaml

image

  1. Add support for non alertRules in the ARM file Add the following yaml to the resources part of tests/examples/ScheduledMultiple.json
        {
            "type": "Microsoft.Insights/dataCollectionEndpoints",
            "apiVersion": "2022-06-01",
            "name": "[parameters('dataCollectionEndpoints_Microsoft_Sentinel_ACC02BE87435EA6BDDD0F74A5_name')]",
            "location": "westeurope",
            "properties": {
                "immutableId": "dce-9c12a8242344490eb4fafc20c874aada",
                "configurationAccess": {},
                "logsIngestion": {},
                "networkAcls": {
                    "publicNetworkAccess": "Enabled"
                }
            }
        },

Result in the current version

image

Result in the modifed version

image

f-bader commented 1 year ago

@Manbearpiet There was an issue with the logic of the incremental file names, that prevented the correct creation of files. Please have a look at my suggestions. I was able to run all tests successfully

image