Public/Get-CIEMScanResult.ps1
|
function Get-CIEMScanResult { <# .SYNOPSIS Retrieves CIEM scan results from persistent storage. .DESCRIPTION Retrieves scan results from PSU cache. Can retrieve the current/latest scan results or historical results by scan ID. .PARAMETER ScanId The ID of a specific scan to retrieve. If not specified, returns the current/latest results. .PARAMETER IncludeMetadata When specified, returns a wrapper object with metadata (ScanId, Timestamp, IncludePassed). Otherwise returns just the array of scan results. .EXAMPLE # Get current scan results $results = Get-CIEMScanResult # Get results with metadata $data = Get-CIEMScanResult -IncludeMetadata $data.Results | Where-Object { $_.Status -eq 'FAIL' } # Get historical scan by ID $historicalResults = Get-CIEMScanResult -ScanId 'abc-123-def' .OUTPUTS Array of scan result objects, or PSCustomObject with metadata if -IncludeMetadata is specified. #> [CmdletBinding()] param( [Parameter()] [string]$ScanId, [Parameter()] [switch]$IncludeMetadata ) # Check if PSU cache is available $psuCacheAvailable = Get-Command -Name 'Get-PSUCache' -ErrorAction SilentlyContinue if (-not $psuCacheAvailable) { Write-Verbose "PSU cache not available" if ($IncludeMetadata) { return $null } return @() } try { if ($ScanId) { # Retrieve specific historical scan $resultsKey = "CIEM:ScanResults:$ScanId" $results = Get-PSUCache -Key $resultsKey -ErrorAction SilentlyContinue if ($IncludeMetadata) { # Get scan metadata from history $history = Get-PSUCache -Key 'CIEM:ScanHistory' -ErrorAction SilentlyContinue $scanMeta = $history | Where-Object { $_.Id -eq $ScanId } | Select-Object -First 1 return [PSCustomObject]@{ ScanId = $ScanId Timestamp = if ($scanMeta) { [datetime]$scanMeta.Date } else { $null } Results = @($results) IncludePassed = if ($scanMeta) { $scanMeta.IncludePassed } else { $false } } } return @($results) } else { # Retrieve current/latest scan results $currentData = Get-PSUCache -Key 'CIEM:CurrentScanResults' -ErrorAction SilentlyContinue if (-not $currentData) { if ($IncludeMetadata) { return $null } return @() } if ($IncludeMetadata) { return [PSCustomObject]@{ ScanId = $currentData.ScanId Timestamp = [datetime]$currentData.Timestamp Results = @($currentData.Results) IncludePassed = $currentData.IncludePassed } } return @($currentData.Results) } } catch { Write-Warning "Failed to retrieve scan results: $($_.Exception.Message)" if ($IncludeMetadata) { return $null } return @() } } |