Targeting sensitivity labels with New-DlpComplianceRule -ContentContainsSensitiveInformation via JSON file - json

Trying to import a DLP rule via a JSON file - current contents below:
{
"DlpRules":
[
{
"Name": "Example",
"Comment": "THis is an Example",
"Policy": "[TEST] EXAMPLE POLICY",
"Disabled": "false",
"Priority": "0",
"BlockAccess": "true",
"BlockAccessScope": "All",
"AlertProperties": {
"AggregationType": "None"
},
"GenerateAlert": "true",
"NotifyUser": [
"example#example.com"
],
"NotifyEmailCustomText": "Test",
"ReportSeverityLevel": "Medium",
"ContentContainsSensitiveInformation": [{
"Groups": [{
"operator": "Or",
"labels": [
{
"name": "EXAMPLE - LABEL",
"id": "[PRETEND GUID IS HERE]",
"type": "Sensitivity"
}
],
"name": "Default"
}]
}]
}
]
}
When running I get the below the error:
The value specified in sensitive information is invalid.
+ CategoryInfo : NotSpecified: (:) [Set-DlpComplianceRule], CompliancePolicyValidationException
+ FullyQualifiedErrorId : Microsoft.Office.CompliancePolicy.PolicyEvaluation.CompliancePolicyValidationException,Microsoft.Office.Compli
ancePolicy.Tasks.SetDlpComplianceRule
+ PSComputerName : aus01b.ps.compliance.protection.outlook.com
Replacing the Labels block with 'sensitivetypes' targeting a Sensitive information type is successful.
Current file is based on manually creating it in the compliance portal exporting it and expanding the 'System.Collections.Hashtable' values with the below - is possible I'm doing something daft when it comes to combining these imputs:
(get-dlpcompliancerule "Example").ContentContainsSensitiveInformation | ConvertTo-Json
(get-dlpcompliancerule "Example").ContentContainsSensitiveInformation.groups | ConvertTo-Json
(get-dlpcompliancerule "Example").ContentContainsSensitiveInformation.groups.labels | ConvertTo-Json

Related

Regex for string starting with doueble quote and ending with [

I have to update dictionary with new value for existing key in a JSON file.
I need no write new line after existing string using regex
Current file:
{
"id": "aaaa",
"desc": "Service aaa",
"boss":"user#company.de",
"email": [
"user#company.de"
],
desired file:
{
"id": "aaaa",
"desc": "Service aaa",
"boss":"user#company.de",
"email": [
"user#company.de"
"another_user#company.de"
]
I have this ansible lineinfile module playbook, but I struggle with decent regex. Everything I try just adds new line in the very end of file.
---
- hosts: localhost
gather_facts: no
tasks:
- name: insert line
lineinfile:
path: /home/file.json
state: present
insertafter: " ^ "email": [ "
line: 'another_user#company.de'
How should I write correct regex in this case to write line after the string "email": [ ?
quick comment :
JSON spec mandates an ASCII comma (",") between values of arrays (plus your choice of whitespace(s)), so to make the proposed solutions compliant, they would have to resemble this instead
—— (snippet directly from jq):
{
"id": "aaaa",
"desc": "Service aaa",
"boss": "user#company.de",
"email": [
"user#company.de",
"newline"
]
}
Let's say current file is aa.txt as follows
{
"id": "aaaa",
"desc": "Service aaa",
"boss":"user#company.de",
"email": [
"user#company.de"
],
Use sed command
sed '/"email.*\[/!{p;d;};n;a new line' aa.txt
Output
{
"id": "aaaa",
"desc": "Service aaa",
"boss":"user#company.de",
"email": [
"user#company.de"
new line
],
Alternatively use AWK
awk '1;/"email.*\[/{c=2}c&&!--c{print "new text"}' aa.txt
Output
{
"id": "aaaa",
"desc": "Service aaa",
"boss":"user#company.de",
"email": [
"user#company.de"
new line
],

Azure ARM template deployment. The value for template parameter not provided

I am extending one of the Azure quick start template to deploy Azure Web App with VNET integration. The RG, network components and App Service plan are already created (using powershell). I am using the ARM template to deploy the Web App. But I am getting the below error while performing the deployment.
I used JSON Lint, to validate the JSON and looks like it is fine. The error code tells me that there is an issue with the parameter file's syntax, but I am not able to pinpoint it. I tried many things to debug this but not able to fix it.
Error:
PS C:\Users\manjug\Desktop> New-AzResourceGroupDeployment `
-Name 'test01' `
-ResourceGroupName ITQIG-eu-manjug-windows-app `
-TemplateParameterUri C:\Users\manjug\Desktop\azuredeploy_webapp.parameters.json `
-TemplateUri C:\Users\manjug\Desktop\azuredeploy_webapp.json `
-Verbose
VERBOSE: Performing the operation "Creating Deployment" on target "ITQIG-eu-manjug-windows-app".
New-AzResourceGroupDeployment : 2:22:59 PM - Error: Code=InvalidTemplate; Message=Deployment template validation failed: 'The value for the template parameter 'appName' at line '7' and
column '20' is not provided. Please see https://aka.ms/resource-manager-parameter-files for usage details.'.
At line:1 char:1
+ New-AzResourceGroupDeployment `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzResourceGroupDeployment], Exception
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet
New-AzResourceGroupDeployment : The deployment validation failed
At line:1 char:1
+ New-AzResourceGroupDeployment `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzResourceGroupDeployment], InvalidOperationException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet
azuredeploy_webapp.parameter.json:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"appName": {
"value": "ITQIG-eu-web-manju123"
},
"kind": {
"value": "app"
},
"location": {
"value": "west europe"
},
"subnetResourceID": {
"value": "/subscriptions/7e7f55d3-4bfd-a6be-1c59594b8592/resourceGroups/ITQIG-eu-network-dev/providers/Microsoft.Network/virtualNetworks/ITQIG-eu-vnet-dev/subnets/subnet7-AWmanjug"
},
"appServicePlanResourceID": {
"value": "/subscriptions/7e7f55d3-4bfd-a6be-1c59594b8592/resourceGroups/ITQIG-eu-manjug-windows-app/providers/microsoft.web/serverFarms/eu-manjug-windows-plan"
}
}
}
azuredeploy_webapp.json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"appName": {
"type": "string",
"metadata": {
"description": "The name of the app to create."
}
},
"kind": {
"type": "string",
"metadata": {
"description": "Web app kind. OS type -> Windows / Linux."
}
},
"appServicePlanResourceID": {
"metadata": {
"description": "The resource ID of the app service plan."
},
"type": "string"
},
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "The location in which all resources should be deployed."
}
},
"subnetResourceID": {
"type": "string",
"metadata": {
"description": "The subnet resource ID created for app service plan which contains this web app."
}
}
},
"resources": [
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "[parameters('appName')]",
"location": "[parameters('location')]",
"kind": "[parameters('kind')]",
"properties": {
"serverFarmId": "[parameters('appServicePlanResourceID')]"
},
"resources": [
{
"name": "virtualNetwork",
"type": "networkConfig",
"apiVersion": "2019-08-01",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('appName'))]"
],
"properties": {
"subnetResourceId": "[parameters('subnetResourceId')]",
"swiftSupported": true
}
}
]
}
]
}
I deleted the old file and re-created a new JSON file with the same contents. It is working now. I do not know what caused the issue with the old file though..
It looks like the issue is a result of the powershell cmdlet parameters you were using and not your templates/parameters. Try the following:
Use TemplateParameterFile instead of TemplateParameterUri
Use TemplateFile instead of TemplateUri
Use the file parameters for non uri based arm deployments and this should fix your issue. https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?view=azps-4.5.0
Your problem I think is because you are providing dependencies on an existing resource. Remove the "serverFarmId": "[parameters('appServicePlanResourceID')]".
Also another to fix is the hardcoding values of the resourceId you have in parameters file.

Concatenate nested fields

I'm trying to concatenate two properties for a list of objects.
Input
{
"image": "golang:1.3",
"unapproved": [
"CVE-2016-5421",
"CVE-2019-5010"
],
"vulnerabilities": [
{
"featurename": "curl",
"featureversion": "7.38.0-4+deb8u2",
"vulnerability": "CVE-2016-5421",
"namespace": "debian:8",
"description": "Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.",
"link": "https://security-tracker.debian.org/tracker/CVE-2016-5421",
"severity": "High",
"fixedby": "7.38.0-4+deb8u4"
},
{
"featurename": "python2.7",
"featureversion": "2.7.9-2",
"vulnerability": "CVE-2019-5010",
"namespace": "debian:8",
"description": "Test description",
"link": "https://security-tracker.debian.org/tracker/CVE-2019-5010",
"severity": "Unknown",
"fixedby": ""
}
]
}
Desired output
The top-level image property should be used as a prefix for the
description of every object in the vulnerabilities list.
{
"image": "golang:1.3",
"unapproved": [
"CVE-2016-5421",
"CVE-2019-5010"
],
"vulnerabilities": [
{
"featurename": "curl",
"featureversion": "7.38.0-4+deb8u2",
"vulnerability": "CVE-2016-5421",
"namespace": "debian:8",
"description": "golang:1.3 - Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.",
"link": "https://security-tracker.debian.org/tracker/CVE-2016-5421",
"severity": "High",
"fixedby": "7.38.0-4+deb8u4"
},
{
"featurename": "python2.7",
"featureversion": "2.7.9-2",
"vulnerability": "CVE-2019-5010",
"namespace": "debian:8",
"description": "golang:1.3 - Test description",
"link": "https://security-tracker.debian.org/tracker/CVE-2019-5010",
"severity": "Unknown",
"fixedby": ""
}
]
}
Current attempt
My current filter:
{image, unapproved, vulnerabilities: [{description: (.image + " - " + .vulnerabilities[].description)}] }
Output
{
"image": "golang:1.3",
"unapproved": [
"CVE-2016-5421",
"CVE-2019-5010"
],
"vulnerabilities": [
{
"description": "golang:1.3 - Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."
},
{
"description": "golang:1.3 - Test description"
}
]
}
Unfortunately, I only get the description field back with my current filter. I want the full vulnerability object with the modified description field.
Question
How can I concatenate the nested field and keep the other properties of the object too?
jqPlay
The simplest solution would probably be:
.image as $prefix
| .vulnerabilities[].description |= $prefix + " - " + .
In words: update all the .description values using .image as shown.
Equivalently, and perhaps less esoterically:
.image as $prefix
| .vulnerabilities |= map(.description |= $prefix + " - " + .)

How to create a calculated item using item.create?

I am familiar with creating a calculated item with the GUI, but now I want to do it with the API. There is a "formula" field for an item object, but its type is int/float as stated in the document. So where do I put the formula needed by a calculated item?enter image description here
As per the Zabbix manual, it's the params field.
The string that you fill in "params" goes to "Formula"
Tested on version 6
"params": "last(//mysql.innodb_buffer_pool_pages_total) -
last(//mysql.innodb_buffer_pool_pages_free)"
Full context:
{
"jsonrpc": "2.0",
"method": "item.create",
"params": {
"name": "MySQL: Buffer pool utilization",
"key_": "mysql.buffer_pool_utilization",
"params": "last(//mysql.innodb_buffer_pool_pages_total) -
last(//mysql.innodb_buffer_pool_pages_free)"
"hostid": "30074",
"type": 15,
"value_type": 3,
"interfaceid": "30084",
"tags": [
{
"tag": "Disc usage"
},
{
"tag": "Equipment",
"value": "Workstation"
}
],
"delay": "30s"
},
"auth": "038e1d7b1735c6a5436ee9eae095879e",
"id": 1
}

AWS Data Pipeline - Set Hive site values during EMR Creation

We are upgrading our Data pipeline version from 3.3.2 to 5.8, so those bootstrap actions on old AMI release have changed to be setup using configuration and specifying them under classification / property definition.
So my Json looks like below
{
"enableDebugging": "true",
"taskInstanceBidPrice": "1",
"terminateAfter": "2 Hours",
"name": "ExportCluster",
"taskInstanceType": "m1.xlarge",
"schedule": {
"ref": "Default"
},
"emrLogUri": "s3://emr-script-logs/",
"coreInstanceType": "m1.xlarge",
"coreInstanceCount": "1",
"taskInstanceCount": "4",
"masterInstanceType": "m3.xlarge",
"keyPair": "XXXX",
"applications": ["hadoop","hive", "tez"],
"subnetId": "XXXXX",
"logUri": "s3://pipelinedata/XXX",
"releaseLabel": "emr-5.8.0",
"type": "EmrCluster",
"id": "EmrClusterWithNewEMRVersion",
"configuration": [
{ "ref": "configureEmrHiveSite" }
]
},
{
"myComment": "This object configures hive-site xml.",
"name": "HiveSite Configuration",
"type": "HiveSiteConfiguration",
"id": "configureEmrHiveSite",
"classification": "hive-site",
"property": [
{"ref": "hive-exec-compress-output" }
]
},
{
"myComment": "This object sets a hive-site configuration
property value.",
"name":"hive-exec-compress-output",
"type": "Property",
"id": "hive-exec-compress-output",
"key": "hive.exec.compress.output",
"value": "true"
}
],
"parameters": []
With the above Json file it gets loaded into Data Pipeline but throws an error saying
Object:HiveSite Configuration
ERROR: 'HiveSiteConfiguration'
Object:ExportCluster
ERROR: 'configuration' values must be of type 'null'. Found values of type 'null'
I am not sure what this really means and could you please let me know if i am specifying this correctly which i think i am according to http://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html
The below block should have the name as "EMR Configuration" only then its recognized correctly by the AWS Data pipeline and the Hive-site.xml is being set accordingly.
{
"myComment": "This object configures hive-site xml.",
"name": "EMR Configuration",
"type": "EmrConfiguration",
"id": "configureEmrHiveSite",
"classification": "hive-site",
"property": [
{"ref": "hive-exec-compress-output" }
]
},