Azure SQL and Database Vulnerability Assessment Scan via Azure CLI

Question

I want to pro-grammatically turn on the 'Vulnerability Assessment Scan' at both Azure SQL server and database level. It should be re-occurring.

The project i am working on has many power shell scripts that call Az modules.

Do you know which Az modules I should call to set the 'Vulnerability Assessment Scan' as re-occurring?

Answer 1

I think you can use Azure Powershell command , 
Start-AzSqlDatabaseVulnerabilityAssessmentScan.
This above triggers the start of a vulnerability assessment scan on a database.

The one below starts the instance scan.
Start-AzSqlInstanceDatabaseVulnerabilityAssessmentScan

You can use the below script :

{

# set parameters - resource group, server, database and storage account
$params =  @{ rgname = "rg";
     serverName = "my-server";
     databaseName = "my-db";
     storageAccount = "mystorage"
}
# Turn on ATP
Enable-AzureRmSqlServerAdvancedThreatProtection -ResourceGroupName $params.rgname -ServerName $params.serverName

# Set Vulnerability Assessment storage settings for all the databases in the server
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"}| Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -StorageAccountName $params.storageAccount 
# Update vulnerability assessment settings to turn ON recurring scans, and provide email to receive results
$scanNotificationEmail = @("[email protected]")
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName| where {$_.DatabaseName -ne "master"} | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings -RecurringScansInterval Weekly -NotificationEmail $scanNotificationEmail -EmailAdmins $true
# Set Vulnerability Assessment baseline for rule VA1143 on all the databases in the server 
$ruleId = "VA1143"
$baselineResult = @( '1')
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName | where {$_.DatabaseName -ne "master"} | Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline -RuleId $ruleId -BaselineResult $baselineResult
# Run a new scan on a database
$scanId1 = "custom-scan1"
$scanJob = Start-AzureRmSqlDatabaseVulnerabilityAssessmentScan -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1 -AsJob
$scanJob | Wait-Job
$scanRecord = $scanJob | Receive-Job
# Convert the raw scan results to an Excel file
$convertScanResult = Convert-AzureRmSqlDatabaseVulnerabilityAssessmentScan  -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ScanId $scanId1
# Download the scan results Excel summary file
$connectionStringToStorageAccount = "DefaultEndpointsProtocol=https;AccountName=......."
$convertedScanResultsDownloadLocalFolder = "C:\ScanResults\"
$storageAccountContext = New-AzureStorageContext -ConnectionString $connectionStringToStorageAccount
$convertScanResultSplitted = $convertScanResult.ExportedReportLocation -split "/"
$containerName = $convertScanResultSplitted
Get-AzureStorageBlobContent -Blob ($convertScanResult.ExportedReportLocation -split $containerName + '/')[1]  -Container $containerName -Destination $convertedScanResultsDownloadLocalFolder -Context $storageAccountContext
}