AzureScout

2.9.0

manifests/collectors/Identity/RiskyUsers.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Identity/RiskyUsers.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'entra/riskyusers'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'
$ResUCount = 1
            $data = $1.properties
'@

    AdditionalRowLoops = @()

    TagLoop = $null

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Tenant ID'
            Expression = '$1.tenantId'
        }
        @{
            Name = 'User Principal Name'
            Expression = '$data.userPrincipalName'
        }
        @{
            Name = 'User Display Name'
            Expression = '$data.userDisplayName'
        }
        @{
            Name = 'Risk Level'
            Expression = '$data.riskLevel'
        }
        @{
            Name = 'Risk State'
            Expression = '$data.riskState'
        }
        @{
            Name = 'Risk Detail'
            Expression = '$data.riskDetail'
        }
        @{
            Name = 'Risk Last Updated DateTime'
            Expression = '$data.riskLastUpdatedDateTime'
        }
        @{
            Name = 'Is Deleted'
            Expression = '[string]$data.isDeleted'
        }
        @{
            Name = 'Is Processing'
            Expression = '[string]$data.isProcessing'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
    )

    Export = @{
        WorksheetName = 'Risky Users'
        TableNamePrefix = 'RiskyUsersTable_'
        Columns = @(
            'User Principal Name'
            'User Display Name'
            'Risk Level'
            'Risk State'
            'Risk Detail'
            'Risk Last Updated DateTime'
            'Is Deleted'
            'Is Processing'
            'Resource U'
        )
        TagColumns = @()
        TagColumnsBefore = $null
        NumberFormat = '0'
        ConditionalText = @(
            'New-ConditionalText high -Range E:E'
            'New-ConditionalText medium -Range E:E'
        )
    }

    SourceCollector = 'Modules/Public/InventoryModules/Identity/RiskyUsers.ps1'
}