Minor cleanup and chaning ProcessLogs to skip processing empty files

Deploy/README.md

@@ -1 +1,3 @@
+# zMonitor
+
 Please refer to the [documentation](../README.md) for deployment instructions.

Deploy/ServiceProvider/PS-Ops-CleanupDaily.ps1

@@ -10,7 +10,7 @@ $StorageAccountKey = "<STORAGE ACCOUNT KEY>"
 
 $Ctx = New-AzureStorageContext $StorageAccountName -StorageAccountKey $StorageAccountKey
 
-#Cleanup all 0 byte files - no data
+#Cleanup all 0 byte files - should no longer be needed
 Get-AzureStorageBlob -Container $StorageContainerName -Context @Ctx | Where-Object {$_.Length -eq 0} | Remove-AzureStorageBlob
 
 #Get all blobs older than an hour

Deploy/Tenant/RB-Ops-Hourly.ps1

@@ -6,7 +6,7 @@
 #All detected threats based on threat status rank.
 .\RB-ProcessLogs.ps1 `
 		-ReportName "securitydetectedthreats" `
-		-dynamicQuery "Type=ProtectionStatus ThreatStatusRank > 199 ThreatStatusRank != 470 | measure max(ThreatStatusRank) as Rank by Computer | Top 50000"
+		-dynamicQuery "Type=ProtectionStatus ThreatStatusRank > 199 ThreatStatusRank != 470 | measure max(ThreatStatusRank) as Rank by Computer | Top 5000"
 
 #All Windows security login failures in the past 1 hours.
 .\RB-ProcessLogs.ps1 `

Deploy/Tenant/RB-ProcessLogs.ps1

@@ -16,17 +16,17 @@ $StorageAccountName = "<STORAGE ACCOUNT>"
 $StorageContainerName = "<STORAGE CONTAINER NAME>"
 $StorageAccountKey = "<STORAGE ACCOUNT KEY>"
 $Ctx = New-AzureStorageContext $StorageAccountName -StorageAccountKey $StorageAccountKey
-#Get-AzureStorageContainer -Name $StorageContainerName -Context $Ctx
 
 $workspace = Get-AutomationVariable -Name "OMSWorkspaceName"
 $date = get-date -f yyyyMMddHHmm
-#$reportname = "activealertscritical"
-#$dynamicQuery = "Type=Alert (AlertSeverity=error or AlertSeverity=critical) TimeGenerated>NOW-24HOUR AlertState!=Closed"
 
-# Run the OMS Query Search - Edit Workspace Name Per Tenant
-# NOTE : Results are limited to 5000 results
+# Run the OMS Query Search
+# NOTE : Results are limited to 5000 results by the API
 $result = Get-AzureRmOperationalInsightsSearchResults -ResourceGroupName "zMonitor" -WorkspaceName $($workspace) -Top 5000 -Query $dynamicQuery
 
+# Process the report if it contains data
+if ($result.Value.Count -gt 0)
+{
     $result.Value | ConvertFrom-Json | Export-Csv -NoTypeInformation $env:TEMP\$($workspace)-$($reportname)-$($date)-temp.csv -Force
 
     Import-Csv $env:TEMP\$(Get-AutomationVariable -Name "OMSWorkspaceName")-$($reportname)-$($date)-temp.csv | 
@@ -35,3 +35,4 @@ Import-Csv $env:TEMP\$(Get-AutomationVariable -Name "OMSWorkspaceName")-$($repor
 
     #Write-Output "Moving CSV Results File to Azure Blob Storage."
     Set-AzureStorageBlobContent -Context $Ctx -File $env:TEMP\$($workspace)-$($reportname)-$($date).csv -Container $StorageContainerName -Force | Out-Null
+}

Documentation/Deploy-Tenant.md

@@ -67,7 +67,7 @@ The overall process for tenant monitoring is:
         $StorageContainerName = "<privatecontainer>"
         $StorageAccountKey = "<storageaccountkey>"
         ```
-        These are the settings in the service providers BLOB storage account 
+        These are the settings in the service providers BLOB storage account.
 
     1. Import existing runbooks