Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Merge pull request #2026 from andedevsecops/master 

GitHub Azure Function Fix
This commit is contained in:
Sarah Young 2021-03-29 14:11:10 +13:00 коммит произвёл GitHub
Родитель b297777de6 d940c44714
Коммит ceed5de745
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
4 изменённых файлов: 17 добавлений и 32 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

Двоичные данные
DataConnectors/GithubFunction/AzureFunctionGitHub/GitHubTimerTrigger.zip
Просмотреть файл

Двоичный файл не отображается.

30
DataConnectors/GithubFunction/AzureFunctionGitHub/GitHubTimerTrigger/run.ps1
Просмотреть файл

@ -3,7 +3,7 @@
Language: PowerShell
Version: 1.2
Author: Nicholas Dicola, Sreedhar Ande
Last Modified: 03/12/2021
Last Modified: 03/29/2021
DESCRIPTION
This Function App calls the GitHub REST API (https://api.github.com/) to pull the GitHub
@ -202,8 +202,8 @@ $headers = @{
$storageAccountContext = New-AzStorageContext -ConnectionString $AzureWebJobsStorage
$checkBlob = Get-AzStorageBlob -Blob ORGS.json -Container $storageAccountContainer -Context $storageAccountContext
if($checkBlob -ne $null){
Get-AzStorageBlobContent -Blob ORGS.json -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:TMPDIR\orgs.json" -Force
$githubOrgs = Get-Content "$env:TMPDIR\orgs.json" | ConvertFrom-Json
Get-AzStorageBlobContent -Blob ORGS.json -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:temp\orgs.json" -Force
$githubOrgs = Get-Content "$env:temp\orgs.json" | ConvertFrom-Json
}
else{
Write-Error "No ORGS.json file, exiting"
@ -222,8 +222,8 @@ foreach($org in $githubOrgs){
$checkBlob = Get-AzStorageBlob -Blob "lastrun-Audit.json" -Container $storageAccountContainer -Context $storageAccountContext
if($checkBlob -ne $null){
#Blob found get data
Get-AzStorageBlobContent -Blob "lastrun-Audit.json" -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:TMPDIR\lastrun-Audit.json" -Force
$lastRunAuditContext = Get-Content "$env:TMPDIR\lastrun-Audit.json" | ConvertFrom-Json
Get-AzStorageBlobContent -Blob "lastrun-Audit.json" -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:temp\lastrun-Audit.json" -Force
$lastRunAuditContext = Get-Content "$env:temp\lastrun-Audit.json" | ConvertFrom-Json
}
else {
#no blob create the context
@ -235,7 +235,7 @@ foreach($org in $githubOrgs){
"lastContext": ""
}
"@
$lastRunAudit | Out-File "$env:TMPDIR\lastrun-Audit.json"
$lastRunAudit | Out-File "$env:temp\lastrun-Audit.json"
$lastRunAuditContext = $lastRunAudit | ConvertFrom-Json
}
@ -280,8 +280,8 @@ foreach($org in $githubOrgs){
$lastRunContext.org = $orgName
$lastRunContext.lastContext = $lastRunContext.lastContext
$lastRunContext.lastRun = $currentStartTime
$lastRunAuditContext | ConvertTo-Json | Out-File "$env:TMPDIR\lastrun-Audit.json"
Set-AzStorageBlobContent -Blob "lastrun-Audit.json" -Container $storageAccountContainer -Context $storageAccountContext -File "$env:TMPDIR\lastrun-Audit.json" -Force
$lastRunAuditContext | ConvertTo-Json | Out-File "$env:temp\lastrun-Audit.json"
Set-AzStorageBlobContent -Blob "lastrun-Audit.json" -Container $storageAccountContainer -Context $storageAccountContext -File "$env:temp\lastrun-Audit.json" -Force
}
} until ($hasNextPage -eq $false)
@ -420,8 +420,8 @@ foreach($org in $githubOrgs){
foreach($repo in $repoList){
$repoName = $repo.name
if($blobs.Name -contains "lastrun-$orgName-$repoName.json"){
Get-AzStorageBlobContent -Blob "lastrun-$orgName-$repoName.json" -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:TMPDIR\lastrun-$orgName-$repoName.json" -Force
$lastRunVulnContext = Get-Content "$env:TMPDIR\lastrun-$orgName-$repoName.json" | ConvertFrom-Json
Get-AzStorageBlobContent -Blob "lastrun-$orgName-$repoName.json" -Container $storageAccountContainer -Context $storageAccountContext -Destination "$env:temp\lastrun-$orgName-$repoName.json" -Force
$lastRunVulnContext = Get-Content "$env:temp\lastrun-$orgName-$repoName.json" | ConvertFrom-Json
}
else {
$lastRun = $currentStartTime
@ -431,9 +431,9 @@ foreach($org in $githubOrgs){
"lastContext": ""
}
"@
$lastRunVuln| Out-File "$env:TMPDIR\lastrun-$orgName-$repoName.json"
$lastRunVuln| Out-File "$env:temp\lastrun-$orgName-$repoName.json"
$lastRunVulnContext = $lastRunVuln | ConvertFrom-Json
Set-AzStorageBlobContent -Container $storageAccountContainer -Context $storageAccountContext -File "$env:TMPDIR\lastrun-$orgName-$repoName.json" -Force
Set-AzStorageBlobContent -Container $storageAccountContainer -Context $storageAccountContext -File "$env:temp\lastrun-$orgName-$repoName.json" -Force
}
#Build the query based on previous context or not
@ -476,11 +476,13 @@ foreach($org in $githubOrgs){
else {
$lastRunVulnContext.lastContext = $lastRunContext
$lastRunVulnContext.lastRun = $currentStartTime
$lastRunVulnContext | ConvertTo-Json | Out-File "$env:TMPDIR\lastrun-$orgName-$repoName.json"
Set-AzStorageBlobContent -Blob "lastrun-$orgName-$repoName.json" -Container $storageAccountContainer -Context $storageAccountContext -File "$env:TMPDIR\lastrun-$orgName-$repoName.json" -Force
$lastRunVulnContext | ConvertTo-Json | Out-File "$env:temp\lastrun-$orgName-$repoName.json"
Set-AzStorageBlobContent -Blob "lastrun-$orgName-$repoName.json" -Container $storageAccountContainer -Context $storageAccountContext -File "$env:temp\lastrun-$orgName-$repoName.json" -Force
}
} until ($hasNextPage -eq $false)
}
#clear the repo list for next org
$repoList = @()
#clear the temp folder
Remove-Item $env:temp\* -Recurse -Force -ErrorAction SilentlyContinue
}

3
DataConnectors/GithubFunction/azuredeploy.json
Просмотреть файл

@ -191,8 +191,7 @@
"AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', toLower(variables('StorageAccountName')),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName')), '2019-06-01').keys[0].value, ';EndpointSuffix=',toLower(variables('StorageSuffix')))]",
"WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('DefaultEndpointsProtocol=https;AccountName=', toLower(variables('StorageAccountName')),';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('StorageAccountName')), '2019-06-01').keys[0].value, ';EndpointSuffix=',toLower(variables('StorageSuffix')))]",
"WEBSITE_CONTENTSHARE": "[toLower(variables('FunctionName'))]",
"PersonalAccessToken": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('GitAPIToken')).secretUriWithVersion, ')')]",
"TMPDIR": "C:\\local\\Temp",
"PersonalAccessToken": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('GitAPIToken')).secretUriWithVersion, ')')]",
"WorkspaceId": "[parameters('WorkspaceId')]",
"WorkspaceKey": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('LogAnalyticsWorkspaceKey')).secretUriWithVersion, ')')]",
"Schedule": "[parameters('FunctionSchedule')]",

16
DataConnectors/GithubFunction/readme.md
Просмотреть файл

@ -116,21 +116,5 @@ A GitHub API Token is required. See the documentation to learn more about the [G
```
**Note: For a `TimerTrigger` to work, you provide a schedule in the form of a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression)(See the link for full details). A cron expression is a string with 6 separate expressions which represent a given schedule via patterns. The pattern we use to represent every 5 minutes is `0 */5 * * * *`. This, in plain text, means: "When seconds is equal to 0, minutes is divisible by 5, for any hour, day of the month, month, day of the week, or year".**
7. Once Azure Function App is deployed
```
a. Go to `<<Function App Name>><<uniqueid>>`
b. Click on "Advanced Tools" under Development Tools
c. Click on Go --> You will be redirected to Web App --> Check Temp folder path.
d. It can be either C:\local\Temp\ or D:\local\Temp\.
```
8. After finding Temp folder path
```
a. Go to `<<Function App Name>><<uniqueid>>`
b. Click on "Configuration" under Settings
c. Click on "TMPDIR" under "Application Settings"
d. Update Drive (C//D) based on your findings from Step 9.
```
**Note: Make sure the value in "TMPDIR" doesnt have "\\" at the end.**
Note: there are two parsers (here)[https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/GitHub] to make the logs useful