AzureScout

3.1.0

manifests/collectors/Security/DefenderAssessments.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Security/DefenderAssessments.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'AZSC/Subscription/SecurityPolicySweep'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    RowSource = @{
        Expression = @'
foreach ($sweep in @($Resources | Where-Object { $_.TYPE -eq 'AZSC/Subscription/SecurityPolicySweep' })) {
            @($sweep.PROPERTIES.DefenderAssessments) | Where-Object { $_.Id -match "/subscriptions/$($sweep.subscriptionId)/" }
        }
'@
    }

    Preamble = @'
$ResUCount = 1
                $assessmentId = Get-AZSCSafeProperty -InputObject $1 -Path 'Id'
                $sub1 = $SUB | Where-Object { (Get-AZSCSafeProperty -InputObject $_ -Path 'Id') -eq (Get-AZSCIdSegment -Id $assessmentId -Index 2) } | Select-Object -First 1
                $data = $1
 
                # Extract resource details from ID
                $resourceId = if (Get-AZSCSafeProperty -InputObject $data -Path 'ResourceDetails.Id') { Get-AZSCSafeProperty -InputObject $data -Path 'ResourceDetails.Id' } else { 'Subscription-level' }
                $resourceType = if ($resourceId -ne 'Subscription-level') {
                    ($resourceId -split '/')[6..7] -join '/'
                } else { 'Subscription' }
 
                $resourceName = if ($resourceId -ne 'Subscription-level') {
                    ($resourceId -split '/')[-1]
                } else { Get-AZSCSafeProperty -InputObject $sub1 -Path 'Name' }
 
                $resourceGroup = if ($resourceId -match '/resourceGroups/([^/]+)') {
                    $Matches[1]
                } else { 'N/A' }
 
                # Parse status and severity
                $status = Get-AZSCSafeProperty -InputObject $data -Path 'Status.Code'
                $severity = Get-AZSCSafeProperty -InputObject $data -Path 'Status.Severity'
                $healthyStatus = if ($status -eq 'Healthy') { 'Compliant' } elseif ($status -eq 'Unhealthy') { 'Non-Compliant' } else { 'Not Applicable' }
 
                # Get remediation steps
                $remediationSteps = if (Get-AZSCSafeProperty -InputObject $data -Path 'Status.Description') {
                    Get-AZSCSafeProperty -InputObject $data -Path 'Status.Description'
                } else {
                    'See Azure Portal for details'
                }
 
                # Get affected resources count
                $affectedResources = if (Get-AZSCSafeProperty -InputObject $data -Path 'AdditionalData.AssessedResourceType') {
                    Get-AZSCSafeProperty -InputObject $data -Path 'AdditionalData.AssessedResourceType'
                } else { 'N/A' }
'@

    AdditionalRowLoops = @()

    TagLoop = $null

    Fields = @(
        @{
            Name = 'ID'
            Expression = 'Get-AZSCSafeProperty -InputObject $1 -Path ''Name'''
        }
        @{
            Name = 'Subscription'
            Expression = 'Get-AZSCSafeProperty -InputObject $sub1 -Path ''Name'''
        }
        @{
            Name = 'Assessment Name'
            Expression = 'Get-AZSCSafeProperty -InputObject $data -Path ''DisplayName'''
        }
        @{
            Name = 'Category'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.Category'') { ((Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.Category'') -join '', '') } else { ''General'' }'
        }
        @{
            Name = 'Severity'
            Expression = '$severity'
        }
        @{
            Name = 'Status'
            Expression = '$healthyStatus'
        }
        @{
            Name = 'Resource Name'
            Expression = '$resourceName'
        }
        @{
            Name = 'Resource Type'
            Expression = '$resourceType'
        }
        @{
            Name = 'Resource Group'
            Expression = '$resourceGroup'
        }
        @{
            Name = 'Remediation'
            Expression = '$remediationSteps'
        }
        @{
            Name = 'Implementation Effort'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.ImplementationEffort'') { Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.ImplementationEffort'' } else { ''N/A'' }'
        }
        @{
            Name = 'User Impact'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.UserImpact'') { Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.UserImpact'' } else { ''N/A'' }'
        }
        @{
            Name = 'Threats'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.Threats'') { ((Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.Threats'') -join '', '') } else { ''N/A'' }'
        }
        @{
            Name = 'Compliance Standards'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.AssessmentType'') { Get-AZSCSafeProperty -InputObject $data -Path ''Metadata.AssessmentType'' } else { ''N/A'' }'
        }
        @{
            Name = 'Portal Link'
            Expression = '"https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/$(Get-AZSCSafeProperty -InputObject $1 -Path ''Name'')"'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
    )

    Export = @{
        WorksheetName = 'Defender Assessments'
        TableNamePrefix = 'DefenderAssessTable_'
        Columns = @(
            'Subscription'
            'Assessment Name'
            'Category'
            'Severity'
            'Status'
            'Resource Name'
            'Resource Type'
            'Resource Group'
            'Remediation'
            'Implementation Effort'
            'User Impact'
            'Threats'
            'Compliance Standards'
            'Portal Link'
            'Resource U'
        )
        TagColumns = @()
        TagColumnsBefore = $null
        NumberFormat = '0'
        ConditionalText = @(
            'New-ConditionalText -Text ''High'' -BackgroundColor ''#FFC7CE'' -ConditionalTextColor ''#9C0006'''
            'New-ConditionalText -Text ''Non-Compliant'' -BackgroundColor ''#FFC7CE'' -ConditionalTextColor ''#9C0006'''
        )
    }

    SourceCollector = 'Modules/Public/InventoryModules/Security/DefenderAssessments.ps1'
}