From 912423193d35f021c158bf48afb4ceb8621c80e4 Mon Sep 17 00:00:00 2001 From: Altana Tsedenova <68014620+altanatsedenova@users.noreply.github.com> Date: Wed, 15 Jul 2020 18:49:09 +0300 Subject: [PATCH] Add some examples Add examples for CmdShell, PowerShell, Registry, WMI probe types. --- .../CustomRuleCmdShellProbe.json | 46 +++++++++++++++ .../CustomRulePowerShellProbe.json | 47 +++++++++++++++ .../CustomRuleRegistryProbe.json | 52 ++++++++++++++++ .../CustomRuleWMIprobe.json | 59 +++++++++++++++++++ 4 files changed, 204 insertions(+) create mode 100644 samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleCmdShellProbe.json create mode 100644 samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRulePowerShellProbe.json create mode 100644 samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleRegistryProbe.json create mode 100644 samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleWMIprobe.json diff --git a/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleCmdShellProbe.json b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleCmdShellProbe.json new file mode 100644 index 00000000..1311ebc1 --- /dev/null +++ b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleCmdShellProbe.json @@ -0,0 +1,46 @@ +{ + "schemaVersion": "1.0", + "name": "CmdShell check", + "version": "1.0.0", + "rules": [ + { + "id": "DirectoryCheck", + "itemType": "definition", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "displayName": "CmdShell probe", + "description": "This is an example of cmdshell probe type. ", + "message": "Empty list", + "level": "Warning", + "condition": "@stdout", + "probes": [ + "ListOfDirectoryFilesAndSubdirectories" + ] + }, + { + "id": ["DefaultRuleset"], + "itemType": "override", + "enabled": false + } + ], + "probes": { + "ListOfDirectoryFilesAndSubdirectories": [ + { + "type": "CmdShell", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "implementation": { + "command": "dir" + } + } + ] + } +} \ No newline at end of file diff --git a/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRulePowerShellProbe.json b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRulePowerShellProbe.json new file mode 100644 index 00000000..47a605ed --- /dev/null +++ b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRulePowerShellProbe.json @@ -0,0 +1,47 @@ +{ + "schemaVersion": "1.0", + "name": "NO NAME", + "version": "1.0.0", + "rules": [ + { + "id": "PowerShellVersion", + "itemType": "definition", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "displayName": "PowerShell host information", + "description": "Information about the PowerShell console host ", + "message": "Upgrade ps version to latest one. Current major version is @{Output.Version}, latest is @{latestVersion}.", + "level": "Warning", + "latestVersion": "7.0.2", + "condition": { + "eq": [ + "@Output.Version", + "@latestVersion" + ] + }, + "probes": [ + "PowershellHostInformation" + ] + } + ], + "probes": { + "PowershellHostInformation": [ + { + "type": "PowerShell", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "implementation": { + "command": "Get-Host" + } + } + ] + } +} \ No newline at end of file diff --git a/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleRegistryProbe.json b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleRegistryProbe.json new file mode 100644 index 00000000..ce5301ba --- /dev/null +++ b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleRegistryProbe.json @@ -0,0 +1,52 @@ +{ + "schemaVersion": "1.0", + "name": "Registry check", + "version": "1.0.0", + "rules": [ + { + "id": "ComputerNameRule", + "itemType": "definition", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "displayName": "Computer name", + "description": "Computer name couldn't be empty. ", + "message": "Set the computer name, because it couldn't be empty.", + "level": "Warning", + "condition": "@ComputerName", + "probes": [ + "ComputerName" + ] + }, + { + "id": ["DefaultRuleset"], + "itemType": "override", + "enabled": false + } + ], + "probes": { + "ComputerName": [ + { + "type": "Registry", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "implementation": { + "query": { + "HKEY_LOCAL_MACHINE": { + "SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName": [ + "ComputerName" + ] + } + } + } + } + ] + } +} \ No newline at end of file diff --git a/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleWMIprobe.json b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleWMIprobe.json new file mode 100644 index 00000000..7eb5408f --- /dev/null +++ b/samples/manage/sql-assessment-api/notebooks/CustomizationSamples/CustomRuleWMIprobe.json @@ -0,0 +1,59 @@ +{ + "schemaVersion": "1.0", + "name": "WMI check", + "version": "1.0.0", + "rules": [ + { + "id": "Win32Volume", + "itemType": "definition", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "displayName": "Block size", + "description": "This is an example of using WMI query.", + "message": "Format volume @{Output.Name} to recommended block size of 64KB. Current size is @{Output.BlockSize} bytes", + "level": "Warning", + "BlockSize": 65536, + "condition": { + "or": [ + { + "not": "@Output.Name" + }, + { + "eq": [ + "@Output.BlockSize", + "@BlockSize" + ] + } + ] + }, + "probes": [ + "Win32Volumes" + ] + }, + { + "id": ["DefaultRuleset"], + "itemType": "override", + "enabled": false + } + ], + "probes": { + "Win32Volumes": [ + { + "type": "WMI", + "target": { + "type": "Server", + "platform": "Windows", + "engineEdition": "OnPremises", + "version": "[11.0,)" + }, + "implementation": { + "query": "SELECT Name, BlockSize FROM Win32_Volume WHERE Capacity <> NULL" + } + } + ] + } +} \ No newline at end of file