{"id":31045034,"url":"https://github.com/svenaelterman/tenablevmsentinelfunctionappwithsecuredstorage","last_synced_at":"2025-09-14T16:54:20.442Z","repository":{"id":294760006,"uuid":"987145561","full_name":"SvenAelterman/TenableVMSentinelFunctionAppWithSecuredStorage","owner":"SvenAelterman","description":"Deploys Tenable Vulnerability Management's Azure Function app for Sentinel ingest using secured Storage Account to meet common customer compliance requirements.","archived":false,"fork":false,"pushed_at":"2025-05-21T23:33:18.000Z","size":16255,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-09-13T00:07:26.645Z","etag":null,"topics":["azure","azure-functions","bicep","microsoft-sentinel","tenable"],"latest_commit_sha":null,"homepage":"","language":"Bicep","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SvenAelterman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-20T16:35:12.000Z","updated_at":"2025-07-14T05:24:34.000Z","dependencies_parsed_at":"2025-05-21T23:43:49.686Z","dependency_job_id":null,"html_url":"https://github.com/SvenAelterman/TenableVMSentinelFunctionAppWithSecuredStorage","commit_stats":null,"previous_names":["svenaelterman/tenablevmsentinelfunctionappwithsecuredstorage"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SvenAelterman/TenableVMSentinelFunctionAppWithSecuredStorage","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SvenAelterman%2FTenableVMSentinelFunctionAppWithSecuredStorage","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SvenAelterman%2FTenableVMSentinelFunctionAppWithSecuredStorage/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SvenAelterman%2FTenableVMSentinelFunctionAppWithSecuredStorage/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SvenAelterman%2FTenableVMSentinelFunctionAppWithSecuredStorage/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SvenAelterman","download_url":"https://codeload.github.com/SvenAelterman/TenableVMSentinelFunctionAppWithSecuredStorage/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SvenAelterman%2FTenableVMSentinelFunctionAppWithSecuredStorage/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275136748,"owners_count":25411709,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-14T02:00:10.474Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","azure-functions","bicep","microsoft-sentinel","tenable"],"created_at":"2025-09-14T16:54:18.607Z","updated_at":"2025-09-14T16:54:20.422Z","avatar_url":"https://github.com/SvenAelterman.png","language":"Bicep","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Tenable VM Sentinel Function App with Secured Storage\n\nDeploys Tenable Vulnerability Management's Azure Function app for Sentinel ingest using secured Storage Account to meet common customer compliance requirements.\n\nThis repo contains Bicep code based on the ARM JSON template as of 2025-05-20.\n\n## Security and Compliance Enhancements\n\n- Creates a Virtual Network and Private Endpoints for the Storage Account and Function App.\n  - Creates the Function app in a Flex Consumption Plan to enable virtual network integration.\n  - (pending) Creates a NAT Gateway to ensure outbound connectivity even after default outbound access is retired.\n- Sends data to Application Insights via Entra authentication instead of instrumentation key.\n\n## Other Enhancements\n\n- Uses [Azure Verified Modules](https://aka.ms/AVM) where available.\n- Improves resource naming based on the Cloud Adoption Framework suggested naming convention.\n\n## Deployment: PowerShell\n\nA PowerShell 7 script is provided that will orchestrate the complete deployment. To use it, first prepare a Bicep parameter file with the name `./src/parameters.bicepparam`. Sample contents:\n\n```bicep\nusing 'main.bicep'\n\nparam appInsightsWorkspaceResourceID = ''\nparam sentinelWorkspaceKey = 'hmCI...'\nparam sentinelWorkspaceId = '552c...'\nparam tenableAccessKey = 'abcd...'\nparam tenableSecretKey = 'efgh...'\n\nparam existingPrivateLinkDnsZonesResourceGroupResourceId = '\u003cResource ID of the RG where private link DNS zones are created\u003e'\n\nparam sequence = 1\n```\n\nThen, run the `./deploy.ps` PowerShell.\n\n\u003e This command should be run from a system that will have line-of-sight to the Function App's private endpoint and will be able to resolve it's DNS name to the private endpoint IP address.\n\n```PowerShell\n./deploy.ps1\n```\n\n## Future Improvements\n\n### Key Vault for Secrets\n\n[Flex Consumption Plan doesn't support referencing Key Vault secrets](https://learn.microsoft.com/azure/azure-functions/flex-consumption-plan#:~:text=Key%20Vault%20and%20App%20Configuration%20References) in app settings when the Key Vault is network restricted. Because the entire point behind this repo is to enable deployment of the Tenable functions in a network-restricted environment, the secret values are added directly to the app settings. If in the future, Flex Consumption Plan will support Key Vault references for Key Vaults that network restricted, the code is already present (but commented) to enable this.\n\nAlternatively, an Elastic Premium plan could be used instead which will incur a fixed cost.\n\n### Deployment of the Function App Code with Deployment Script\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsvenaelterman%2Ftenablevmsentinelfunctionappwithsecuredstorage","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsvenaelterman%2Ftenablevmsentinelfunctionappwithsecuredstorage","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsvenaelterman%2Ftenablevmsentinelfunctionappwithsecuredstorage/lists"}