AzureScout

3.3.1

manifests/collectors/Networking/AzureFirewall.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Networking/AzureFirewall.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'microsoft.network/azurefirewalls'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    SetupPreamble = @'
$AzureFirewall = $Resources | Where-Object { $_.TYPE -eq 'microsoft.network/azurefirewalls' }
    $AzureFWPolicies = $Resources | Where-Object { $_.TYPE -eq 'microsoft.network/firewallpolicies' }
    $AzureFWPoliciesRules = $Resources | Where-Object { $_.TYPE -eq 'microsoft.network/firewallpolicies/rulecollectiongroups' }
    $AzureIPGroups = $Resources | Where-Object { $_.TYPE -eq 'microsoft.network/ipgroups' }
'@

    SetupVariables = @(
        'AzureFirewall'
        'AzureFWPolicies'
        'AzureFWPoliciesRules'
        'AzureIPGroups'
    )

    Preamble = @'
$ResUCount = $null
                    $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }
                    $data = $1.PROPERTIES
                    if ($1.zones) { $Zones = $1.zones } Else { $Zones = "Not Configured" }
                    $Retired = Foreach ($Retirement in $Retirements)
                    {
                        if ($Retirement.id -eq $1.id) { $Retirement }
                    }
                    if ($Retired)
                        {
                            $RetiredFeature = foreach ($Retire in $Retired)
                                {
                                    $RetiredServiceID = $Unsupported | Where-Object {$_.Id -eq $Retired.ServiceID}
                                    $tmp0 = [pscustomobject]@{
                                            'RetiredFeature' = $RetiredServiceID.RetiringFeature
                                            'RetiredDate' = $RetiredServiceID.RetirementDate
                                        }
                                    $tmp0
                                }
                            $RetiringFeature = if (@($RetiredFeature.RetiredFeature).count -gt 1) { $RetiredFeature.RetiredFeature | ForEach-Object { $_ + ' ,' } }else { $RetiredFeature.RetiredFeature}
                            $RetiringFeature = [string]$RetiringFeature
                            $RetiringFeature = if ($RetiringFeature -like '* ,*') { $RetiringFeature -replace ".$" }else { $RetiringFeature }
 
                            $RetiringDate = if (@($RetiredFeature.RetiredDate).count -gt 1) { $RetiredFeature.RetiredDate | ForEach-Object { $_ + ' ,' } }else { $RetiredFeature.RetiredDate}
                            $RetiringDate = [string]$RetiringDate
                            $RetiringDate = if ($RetiringDate -like '* ,*') { $RetiringDate -replace ".$" }else { $RetiringDate }
                        }
                    else
                        {
                            $RetiringFeature = $null
                            $RetiringDate = $null
                        }
                    $Threat = if($data.threatintelmode -eq 'deny'){'Alert and deny'}elseif($data.threatintelmode -eq 'alert'){'Alert only'}else{'Off'}
                    $Tags = if ($null -ne $1.PSObject.Properties['tags'] -and $1.tags -and @($1.tags.PSObject.Properties).Count -gt 0) { $1.tags.PSObject.Properties } else { '0' }
                     
                    $VNETs = @()
                    $PIPs = @()
                    $PrivIPs = @()
                    Foreach($2 in $data.ipConfigurations)
                        {
                            $PIPs += $2.name
                            $VNETs += if(![string]::IsNullOrEmpty($2.properties.subnet.id)){(Get-AZSCIdSegment -Id $2.properties.subnet.id -Index 8)}else{$null}
                            $PrivIPs += $2.properties.privateIPAddress
                        }
                     
                    $Policy = $AzureFWPolicies | Where-Object {$_.id -eq $data.firewallpolicy.id}
                    $Policy = if(![string]::IsNullOrEmpty($Policy)){$Policy}else{'0'}
                    $PolicyRuleCollectionGroupIds = Get-AZSCSafeProperty -InputObject $Policy -Path 'properties.rulecollectiongroups.id' -Enumerate
                    $Rules = $AzureFWPoliciesRules | Where-Object {$_.id -eq $PolicyRuleCollectionGroupIds}
                    $Rules = if(![string]::IsNullOrEmpty($Rules)){$Rules}else{'0'}
                    $FinalPIP = if ($PIPs.count -gt 1) { $PIPs | ForEach-Object { $_ + ' ,' } }else { $PIPs }
                    $FinalPIP = [string]$FinalPIP
                    $FinalPIP = if ($FinalPIP -like '* ,*') { $FinalPIP -replace ".$" }else { $FinalPIP }
                    $FinalVNET = if ($VNETs.count -gt 1) { $VNETs | ForEach-Object { $_ + ' ,' } }else { $VNETs }
                    $FinalVNET = [string]$FinalVNET
                    $FinalVNET = if ($FinalVNET -like '* ,*') { $FinalVNET -replace ".$" }else { $FinalVNET }
                    $FinalPrivIP = if ($PrivIPs.count -gt 1) { $PrivIPs | ForEach-Object { $_ + ' ,' } }else { $PrivIPs }
                    $FinalPrivIP = [string]$FinalPrivIP
                    $FinalPrivIP = if ($FinalPrivIP -like '* ,*') { $FinalPrivIP -replace ".$" }else { $FinalPrivIP }
                    $PolicyDnsServers = Get-AZSCSafeProperty -InputObject $Policy -Path 'properties.dnssettings.servers'
                    $FinalDNSServers = if (@($PolicyDnsServers).count -gt 1) { $PolicyDnsServers | ForEach-Object { $_ + ' ,' } }else { $PolicyDnsServers }
                    $FinalDNSServers = [string]$FinalDNSServers
                    $FinalDNSServers = if ($FinalDNSServers -like '* ,*') { $FinalDNSServers -replace ".$" }else { $FinalDNSServers }
'@

    AdditionalRowLoops = @(
        @{
            Variable = 'CoreRule'
            # AB#6845 decision ($CoreRule): NO EmitNullWhenEmpty, deliberately. $Rules falls back
            # to '0', so a rule collection carrying no rules still yields one iteration and the
            # firewall keeps its row. This is the innermost of three nested sentinels in this
            # collector; all three must hold for a firewall with no policy at all to survive, and
            # the sparse-payload suite asserts that end to end rather than per layer.
            Source = '$Rules'
            Preamble = @'
$CoreCollections = Get-AZSCSafeProperty -InputObject $CoreRule -Path 'properties.rulecollections'
                            $CoreCollections = if(![string]::IsNullOrEmpty($CoreCollections)){$CoreCollections}else{'0'}
'@
        }
        @{
            Variable = 'RuleCollection'
            # AB#6845 decision ($RuleCollection): NO EmitNullWhenEmpty, deliberately.
            # $CoreCollections falls back to '0', so a firewall whose policy carries no rule
            # collection groups still iterates once here -- which is also what lets the nested
            # $CoreRule loop below run at all. A firewall is a first-class resource and an
            # expensive one; it must appear whether or not anyone has written a rule yet.
            Source = '$CoreCollections'
            Preamble = @'
$RuleCoreCollections = Get-AZSCSafeProperty -InputObject $RuleCollection -Path 'rules'
                                    $RuleCoreCollections = if(![string]::IsNullOrEmpty($RuleCoreCollections)){$RuleCoreCollections}else{'0'}
'@
        }
        @{
            Variable = 'Rule'
            # AB#6845 decision ($Rule): NO EmitNullWhenEmpty, deliberately. $RuleCoreCollections
            # falls back to '0' for the same reason as the two loops above, and by the same
            # mechanism. The flag would be unreachable on all three.
            Source = '$RuleCoreCollections'
            Preamble = @'
$RuleProtocols = Get-AZSCSafeProperty -InputObject $Rule -Path 'ipprotocols'
                                            $FinalProtocol = if (@($RuleProtocols).count -gt 1) { $RuleProtocols | ForEach-Object { $_ + ' ,' } }else { $RuleProtocols}
                                            $FinalProtocol = [string]$FinalProtocol
                                            $FinalProtocol = if ($FinalProtocol -like '* ,*') { $FinalProtocol -replace ".$" }else { $FinalProtocol }
 
$RuleDestinationPorts = Get-AZSCSafeProperty -InputObject $Rule -Path 'destinationports'
                                            $FinalPort = if (@($RuleDestinationPorts).count -gt 1) { $RuleDestinationPorts | ForEach-Object { $_ + ' ,' } }else { $RuleDestinationPorts}
                                            $FinalPort = [string]$FinalPort
                                            $FinalPort = if ($FinalPort -like '* ,*') { $FinalPort -replace ".$" }else { $FinalPort }
 
                                            $RuleSourceIpGroups = Get-AZSCSafeProperty -InputObject $Rule -Path 'sourceipgroups'
                                            if(![string]::IsNullOrEmpty($RuleSourceIpGroups))
                                                {
                                                    $SourceIpGroup = Get-AZSCSafeProperty -InputObject ($AzureIPGroups | Where-Object {$_.id -eq $RuleSourceIpGroups}) -Path 'properties.ipaddresses' -Enumerate
                                                    $SourceIP = if (@($SourceIpGroup).count -gt 1) { $SourceIpGroup | ForEach-Object { $_ + ' ,' } }else { $SourceIpGroup }
                                                    $SourceIP = [string]$SourceIP
                                                    $SourceIP = if ($SourceIP -like '* ,*') { $SourceIP -replace ".$" }else { $SourceIP }
                                                    $SourceType = 'IP Group'
                                                }
                                            else
                                                {
                                                    $SourceIP = [string](Get-AZSCSafeProperty -InputObject $Rule -Path 'sourceaddresses')
                                                    $SourceType = 'IP Address'
                                                }
 
                                            $RuleDestinationIpGroups = Get-AZSCSafeProperty -InputObject $Rule -Path 'destinationipgroups'
                                            if(![string]::IsNullOrEmpty($RuleDestinationIpGroups))
                                                {
                                                    $DestinationIpGroup = Get-AZSCSafeProperty -InputObject ($AzureIPGroups | Where-Object {$_.id -eq $RuleDestinationIpGroups}) -Path 'properties.ipaddresses' -Enumerate
                                                    $DestinationIP = if (@($DestinationIpGroup).count -gt 1) { $DestinationIpGroup | ForEach-Object { $_ + ' ,' } }else { $DestinationIpGroup }
                                                    $DestinationIP = [string]$DestinationIP
                                                    $DestinationIP = if ($DestinationIP -like '* ,*') { $DestinationIP -replace ".$" }else { $DestinationIP }
                                                    $DestionationType = 'IP Group'
                                                }
                                            elseif(![string]::IsNullOrEmpty((Get-AZSCSafeProperty -InputObject $Rule -Path 'destinationfqdns')))
                                                {
                                                    $DestinationIP = [string](Get-AZSCSafeProperty -InputObject $Rule -Path 'destinationfqdns')
                                                    $DestionationType = 'FQDN'
                                                }
                                            else
                                                {
                                                    $DestinationIP = [string](Get-AZSCSafeProperty -InputObject $Rule -Path 'destinationaddresses')
                                                    $DestionationType = 'IP Address'
                                                }
'@
        }
    )

    TagLoop = @{
        Variable = 'Tag'
        Source = '$Tags'
        Preamble = ''
    }

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Subscription'
            Expression = '$sub1.Name'
        }
        @{
            Name = 'Resource Group'
            Expression = '$1.RESOURCEGROUP'
        }
        @{
            Name = 'Name'
            Expression = '$1.NAME'
        }
        @{
            Name = 'Location'
            Expression = '$1.LOCATION'
        }
        @{
            Name = 'SKU'
            Expression = '$data.sku.tier'
        }
        @{
            Name = 'Retiring Feature'
            Expression = '$RetiringFeature'
        }
        @{
            Name = 'Retiring Date'
            Expression = '$RetiringDate'
        }
        @{
            Name = 'Threat Intel Mode'
            Expression = '$Threat'
        }
        @{
            Name = 'Zone'
            Expression = '[string]$Zones'
        }
        @{
            Name = 'Public IP Name'
            Expression = '$FinalPIP'
        }
        @{
            Name = 'Firewall VNET'
            Expression = '$FinalVNET'
        }
        @{
            Name = 'Firewall Private IP'
            Expression = '$FinalPrivIP'
        }
        @{
            Name = 'Policy Name'
            Expression = 'Get-AZSCSafeProperty -InputObject $Policy -Path ''name'''
        }
        @{
            Name = 'DNS Proxy'
            Expression = 'Get-AZSCSafeProperty -InputObject $Policy -Path ''properties.dnssettings.enableproxy'''
        }
        @{
            Name = 'DNS Servers'
            Expression = '$FinalDNSServers'
        }
        @{
            Name = 'Rule Collection Group'
            Expression = 'Get-AZSCSafeProperty -InputObject $CoreRule -Path ''name'''
        }
        @{
            Name = 'Rule Collection Group Priority'
            Expression = 'Get-AZSCSafeProperty -InputObject $CoreRule -Path ''properties.priority'''
        }
        @{
            Name = 'Rule Collection'
            Expression = 'Get-AZSCSafeProperty -InputObject $RuleCollection -Path ''name'''
        }
        @{
            Name = 'Rule Action'
            Expression = 'Get-AZSCSafeProperty -InputObject $RuleCollection -Path ''action.type'''
        }
        @{
            Name = 'Rule Priority'
            Expression = 'Get-AZSCSafeProperty -InputObject $RuleCollection -Path ''priority'''
        }
        @{
            Name = 'Rule Type'
            Expression = 'Get-AZSCSafeProperty -InputObject $Rule -Path ''ruletype'''
        }
        @{
            Name = 'Rule Name'
            Expression = 'Get-AZSCSafeProperty -InputObject $Rule -Path ''name'''
        }
        @{
            Name = 'Source Type'
            Expression = '$SourceType'
        }
        @{
            Name = 'Source'
            Expression = '$SourceIP'
        }
        @{
            Name = 'Protocol'
            Expression = '$FinalProtocol'
        }
        @{
            Name = 'Destination Port'
            Expression = '$FinalPort'
        }
        @{
            Name = 'Destination Type'
            Expression = '$DestionationType'
        }
        @{
            Name = 'Destination'
            Expression = '$DestinationIP'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
        @{
            Name = 'Tag Name'
            Expression = '[string]$Tag.Name'
        }
        @{
            Name = 'Tag Value'
            Expression = '[string]$Tag.Value'
        }
    )

    Export = @{
        WorksheetName = 'Azure Firewall'
        TableNamePrefix = 'AzFirewallTable_'
        Columns = @(
            'Subscription'
            'Resource Group'
            'Name'
            'Location'
            'SKU'
            'Retiring Feature'
            'Retiring Date'
            'Threat Intel Mode'
            'Zone'
            'Public IP Name'
            'Firewall VNET'
            'Firewall Private IP'
            'Policy Name'
            'DNS Proxy'
            'DNS Servers'
            'Rule Collection Group'
            'Rule Collection Group Priority'
            'Rule Collection'
            'Rule Action'
            'Rule Priority'
            'Rule Type'
            'Rule Name'
            'Source Type'
            'Source'
            'Protocol'
            'Destination Port'
            'Destination Type'
            'Destination'
            'Resource U'
        )
        TagColumns = @(
            'Tag Name'
            'Tag Value'
        )
        TagColumnsBefore = 'Resource U'
        NumberFormat = '0'
        ConditionalText = @(
            'New-ConditionalText -Range F2:F100 -ConditionalType ContainsText'
        )
    }

    SourceCollector = 'Modules/Public/InventoryModules/Networking/AzureFirewall.ps1'
}