Lib/Default/FileInspectorX.PowerShell.xml
|
<?xml version="1.0"?>
<doc> <assembly> <name>FileInspectorX.PowerShell</name> </assembly> <members> <member name="T:FileInspectorX.PowerShell.CmdletGetFileInsight"> <summary> <para type="synopsis">Analyzes files and returns a full FileAnalysis object by default, with optional compact views.</para> <para type="description">By default (-View Raw), returns the full FileAnalysis with detection, flags, permissions (unless excluded), signatures, installer metadata, references and assessment. Use -View to project compact views (Summary/Detection/Analysis/Permissions/Signature/References/Assessment/Installer/ShellProperties). Each view exposes Raw with the full FileAnalysis for drill-down.</para> <example> <para>Analyze a single file</para> <code>Get-FileInsight -Path C:\\files\\sample.docx</code> </example> <example> <para>Detect only (no analysis)</para> <code>Get-FileInsight -Path .\\payload.bin -DetectOnly</code> </example> <example> <para>Detect only for all EXE files under current directory</para> <code>Get-ChildItem -Filter *.exe -File -Recurse | Get-FileInsight -View Detection</code> </example> <example> <para>Summarize a directory, skipping signature and installer enrichment</para> <code>Get-ChildItem -File -Recurse | Get-FileInsight -View Summary -ExcludeSignature -ExcludeInstaller</code> </example> <example> <para>Include SHA-256 and first 16 bytes header (hex)</para> <code>Get-FileInsight -Path .\\app.exe -ComputeSha256 -MagicHeaderBytes 16</code> </example> <example> <para>Opt in to Magika learned classification while preserving deterministic validators</para> <code>Get-FileInsight -Path .\\source.txt -UseMagika -View Detection</code> </example> <seealso cref="T:FileInspectorX.PowerShell.AsyncPSCmdlet" /> </summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.Path"> <summary> One or more file paths to analyze. Accepts pipeline input of strings and resolves PowerShell provider paths. </summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.View"> <summary>Output shape to emit. Defaults to Raw (full FileAnalysis object). Other values: Summary, Detection, Analysis, Permissions, Signature, References, Assessment, Policy, Installer, ShellProperties.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.DetectOnly"> <summary>Return only detection result (skip analysis). Back-compat shim for -View Detection.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ComputeSha256"> <summary>Compute SHA-256 of the file and include in output.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.MagicHeaderBytes"> <summary>Capture first N bytes of the header as uppercase hex.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludePermissions"> <summary>Exclude permissions/ownership snapshot from the analysis.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeSignature"> <summary>Exclude signature/Authenticode and package signature analysis.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeReferences"> <summary>Exclude references extraction (Task XML, scripts.ini/xml).</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeInstaller"> <summary>Exclude installer/package metadata (MSIX/APPX/VSIX/MSI).</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeContainer"> <summary>Exclude container triage (ZIP/TAR sampling, subtype and inner hints).</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeAssessment"> <summary>Exclude assessment (score/decision/codes).</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.ExcludeShellProperties"> <summary>Exclude Windows shell properties (Explorer Details).</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.UseMagika"> <summary> Opt in to the bundled Magika learned classifier. Deterministic magic and structural validation remain authoritative when evidence conflicts. </summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.MagikaPredictionMode"> <summary>Magika probability policy. Defaults to HighConfidence.</summary> </member> <member name="P:FileInspectorX.PowerShell.CmdletGetFileInsight.LearnedClassificationMode"> <summary> Failure behavior for the optional classifier. Assist records provider failures and continues; Required reports a terminating per-file error. </summary> </member> <member name="M:FileInspectorX.PowerShell.CmdletGetFileInsight.BeginProcessingAsync"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.CmdletGetFileInsight.ProcessRecordAsync"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.CmdletGetFileInsight.EndProcessingAsync"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.CmdletGetFileInsight.Dispose"> <inheritdoc /> </member> <member name="T:FileInspectorX.PowerShell.AsyncPSCmdlet"> <summary> Base class for cmdlets that await asynchronous engine work while routing PowerShell pipeline writes back through the synchronous cmdlet pipeline thread. </summary> <remarks> Invoke asynchronous hooks on the PowerShell pipeline thread until their first incomplete await. The base temporarily replaces the host synchronization context with an internal thread-pool context while invoking each hook. This prevents continuations from capturing either the host context or a custom task scheduler that may be running the PowerShell pipeline thread. Keep hook implementations asynchronous all the way through and pass <see cref="P:FileInspectorX.PowerShell.AsyncPSCmdlet.CancelToken"/> to cancellable engine operations. Do not block with Task.Wait, Task.Result, or Task.WaitAll. </remarks> </member> <member name="T:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams"> <summary> Lifecycle-bound stream writers for callbacks that do not flow the hook execution context. </summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteObject(System.Object,System.Boolean)"> <summary>Queues an output record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteError(System.Management.Automation.ErrorRecord)"> <summary>Queues an error record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteWarning(System.String)"> <summary>Queues a warning record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteVerbose(System.String)"> <summary>Queues a verbose record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteDebug(System.String)"> <summary>Queues a debug record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteInformation(System.Management.Automation.InformationRecord)"> <summary>Queues an information record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteInformation(System.Object,System.String[])"> <summary>Queues tagged information for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteProgress(System.Management.Automation.ProgressRecord)"> <summary>Queues a progress record for the originating hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturedPipelineStreams.WriteCommandDetail(System.String)"> <summary>Queues command-detail text for the originating hook.</summary> </member> <member name="P:FileInspectorX.PowerShell.AsyncPSCmdlet.CancelToken"> <summary>Cancellation token triggered when PowerShell stops the cmdlet.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.BeginProcessing"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.BeginProcessingAsync"> <summary>Asynchronous begin hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ProcessRecord"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ProcessRecordAsync"> <summary>Asynchronous process-record hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.EndProcessing"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.EndProcessingAsync"> <summary>Asynchronous end hook.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.StopProcessing"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldProcess(System.String)"> <summary>Thread-safe ShouldProcess bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldProcess(System.String,System.String)"> <summary>Thread-safe ShouldProcess bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldProcess(System.String,System.String,System.String)"> <summary>Thread-safe ShouldProcess bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldProcess(System.String,System.String,System.String,System.Management.Automation.ShouldProcessReason@)"> <summary>Thread-safe ShouldProcess bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldContinue(System.String,System.String)"> <summary>Thread-safe ShouldContinue bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldContinue(System.String,System.String,System.Boolean@,System.Boolean@)"> <summary>Thread-safe ShouldContinue bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ShouldContinue(System.String,System.String,System.Boolean,System.Boolean@,System.Boolean@)"> <summary>Thread-safe ShouldContinue bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.PromptForCredential(System.String,System.String,System.String,System.String)"> <summary>Thread-safe credential prompt bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.PromptForCredential(System.String,System.String,System.String,System.String,System.Management.Automation.PSCredentialTypes,System.Management.Automation.PSCredentialUIOptions)"> <summary>Thread-safe credential prompt bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteObject(System.Object)"> <summary>Thread-safe output bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteObject(System.Object,System.Boolean)"> <summary>Thread-safe output bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteError(System.Management.Automation.ErrorRecord)"> <summary>Thread-safe error bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ThrowTerminatingError(System.Management.Automation.ErrorRecord)"> <summary>Thread-safe terminating-error bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteWarning(System.String)"> <summary>Thread-safe warning bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteVerbose(System.String)"> <summary>Thread-safe verbose bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteDebug(System.String)"> <summary>Thread-safe debug bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteCommandDetail(System.String)"> <summary>Thread-safe command-detail bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteInformation(System.Management.Automation.InformationRecord)"> <summary>Thread-safe information bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteInformation(System.Object,System.String[])"> <summary>Thread-safe information bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.WriteProgress(System.Management.Automation.ProgressRecord)"> <summary>Thread-safe progress bridge for asynchronous cmdlet code.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.ThrowIfStopped"> <summary>Throws when PowerShell has requested cancellation.</summary> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.Dispose"> <inheritdoc /> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturePipelineWriter(System.Boolean)"> <summary> Captures an output writer for callbacks whose producer does not flow the hook execution context. </summary> <remarks> Capture the writer inside an asynchronous PowerShell hook. Calls made after that hook ends are rejected rather than being rebound to a later record lifecycle. </remarks> </member> <member name="M:FileInspectorX.PowerShell.AsyncPSCmdlet.CapturePipelineStreams"> <summary> Captures lifecycle-bound typed stream writers for callbacks that do not flow execution context. </summary> </member> <member name="T:FileInspectorX.PowerShell.InternalLoggerPowerShell"> <summary> This class allow connecting to the InternalLogger class of ADPlayground and act on events from it in different streams </summary> </member> <member name="M:FileInspectorX.PowerShell.InternalLoggerPowerShell.#ctor(FileInspectorX.InternalLogger,System.Action{System.String},System.Action{System.String},System.Action{System.String},System.Action{System.Management.Automation.ErrorRecord},System.Action{System.Management.Automation.ProgressRecord},System.Action{System.Management.Automation.InformationRecord})"> <summary> Initialize the InternalLoggerPowerShell class </summary> <param name="logger"></param> <param name="writeVerboseAction"></param> <param name="writeWarningAction"></param> <param name="writeDebugAction"></param> <param name="writeErrorAction"></param> <param name="writeProgressAction"></param> <param name="writeInformationAction"></param> </member> <member name="M:FileInspectorX.PowerShell.InternalLoggerPowerShell.Logger_OnVerboseMessage(System.Object,FileInspectorX.LogEventArgs)"> <summary> Message event handler </summary> <param name="sender"></param> <param name="e"></param> </member> <member name="M:FileInspectorX.PowerShell.InternalLoggerPowerShell.WriteVerbose(System.String,System.Object[])"> <summary> Method to write verbose message to PowerShell </summary> <param name="message"></param> <param name="eArgs"></param> </member> <member name="T:OnModuleImportAndRemove"> <summary> OnModuleImportAndRemove is a class that implements the IModuleAssemblyInitializer and IModuleAssemblyCleanup interfaces. This class is used to handle the assembly resolve event when the module is imported and removed. </summary> </member> <member name="M:OnModuleImportAndRemove.OnImport"> <inheritdoc /> </member> <member name="M:OnModuleImportAndRemove.OnRemove(System.Management.Automation.PSModuleInfo)"> <inheritdoc /> </member> <member name="M:OnModuleImportAndRemove.MyResolveEventHandler(System.Object,System.ResolveEventArgs)"> <summary> MyResolveEventHandler is a method that handles the AssemblyResolve event. </summary> <param name="sender"></param> <param name="args"></param> <returns></returns> </member> <member name="M:OnModuleImportAndRemove.IsNetFramework"> <summary> Determine if the current runtime is .NET Framework </summary> <returns></returns> </member> <member name="M:OnModuleImportAndRemove.IsNet5OrHigher"> <summary> Determine if the current runtime is .NET 5 or higher </summary> <returns></returns> </member> </members> </doc> |