Waarschuwing: Verwijdering Beveiligingsoplossing

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS Alert Security Solution Delete .DESCRIPTION CIS Azure Foundations Benchmark - Control 5.10 Controleert alert voor security solution delete events. .NOTES Filename: alert-security-solution-delete.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 CIS Control: 5.10 #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.Monitor [CmdletBinding()] param([Parameter()][switch]$Monitoring) $ErrorActionPreference = 'Stop' $PolicyName = "Alert Security Solution Delete" function Connect-RequiredServices { if (-not (Get-AzContext)) { Connect-AzAccount | Out-Null } } function Test-Compliance { $alerts = Get-AzActivityLogAlert -ErrorAction SilentlyContinue $result = @{ TotalAlerts = $alerts.Count; SecurityDeleteAlerts = 0 } foreach ($alert in $alerts) { $securityCondition = $alert.Condition.AllOf | Where-Object { $_.Field -eq 'resourceType' -and ($_.Equals -like '*Microsoft.Security*' -or $_.Equals -like '*Microsoft.OperationsManagement/solutions*') } $deleteCondition = $alert.Condition.AllOf | Where-Object { $_.Field -eq 'operationName' -and $_.Equals -like '*delete*' } if ($securityCondition -and $deleteCondition) { $result.SecurityDeleteAlerts++ } } return $result } try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total Activity Log Alerts: $($r.TotalAlerts)" -ForegroundColor White Write-Host "Security Delete Alerts: $($r.SecurityDeleteAlerts)" -ForegroundColor $(if ($r.SecurityDeleteAlerts -gt 0) { 'Green' } else { 'Yellow' }) if ($r.SecurityDeleteAlerts -eq 0) { Write-Host "`n⚠️ Configureer alert voor security solution verwijderingen" -ForegroundColor Yellow } } else { $r = Test-Compliance Write-Host "`nSecurity Delete Alerts: $($r.SecurityDeleteAlerts) configured" } } catch { Write-Error $_; exit 1 } # ================================================================================ # Standaard Invoke-* Functions (Auto-generated) # ================================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() $Monitoring = $true try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total Activity Log Alerts: $($r.TotalAlerts)" -ForegroundColor White Write-Host "Security Delete Alerts: $($r.SecurityDeleteAlerts)" -ForegroundColor $(if ($r.SecurityDeleteAlerts -gt 0) { 'Green' } else { 'Yellow' }) if ($r.SecurityDeleteAlerts -eq 0) { Write-Host "`n⚠️ Configureer alert voor security solution verwijderingen" -ForegroundColor Yellow } } else { $r = Test-Compliance Write-Host "`nSecurity Delete Alerts: $($r.SecurityDeleteAlerts) configured" } } catch { Write-Error $_; exit 1 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }