status.ps1
# Status and Progress APIs # Get Infocyte HUNT Jobs (Active jobs or all jobs) function Get-ICJob { [cmdletbinding()] param( [parameter(ValueFromPipelineByPropertyName)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [alias('jobId')] [String]$Id, [Switch]$All, [parameter(HelpMessage="This will convert a hashtable into a JSON-encoded Loopback Where-filter: https://loopback.io/doc/en/lb2/Where-filter ")] [HashTable]$where=@{}, [Switch]$NoLimit, [Switch]$CountOnly ) PROCESS { $endpoint = 'jobs' if ($Id) { $CountOnly = $false $endpoint += "/$Id" $where = $null $NoLimit = $false } else { if ($All) { Write-Verbose "Getting All Jobs." } else { Write-Verbose "Getting Active Jobs." if (-NOT $where['state']) { $where['state'] = "active" } } } Get-ICAPI -Endpoint $Endpoint -where $where -NoLimit:$NoLimit -CountOnly:$CountOnly } } # Get Infocyte HUNT User Audit Logs function Get-ICAuditLog { [cmdletbinding()] param( [parameter(ValueFromPipeline)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [String]$Id, [parameter(HelpMessage="This will convert a hashtable into a JSON-encoded Loopback Where-filter: https://loopback.io/doc/en/lb2/Where-filter ")] [HashTable]$where=@{}, [Switch]$NoLimit, [Switch]$CountOnly ) PROCESS { $endpoint = 'useractivities' if ($Id) { $CountOnly = $false $endpoint += "/$Id" } Write-Verbose "Getting User Activity Logs" Get-ICAPI -Endpoint $Endpoint -where $where -NoLimit:$NoLimit -CountOnly:$CountOnly } } # Get Infocyte HUNT User Tasks. These are the items in the task dropdown in the UI. function Get-ICTask { [cmdletbinding()] param( [parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [alias('id')] [alias('taskId')] [String]$userTaskId, [Switch]$All, [parameter(HelpMessage="This will convert a hashtable into a JSON-encoded Loopback Where-filter: https://loopback.io/doc/en/lb2/Where-filter ")] [HashTable]$where=@{}, [Switch]$NoLimit, [Switch]$CountOnly ) PROCESS { $endpoint = "usertasks" if ($userTaskId) { $CountOnly = $false $endpoint += "/$userTaskId" } else { if (-NOT $All -AND $where.keys.count -eq 0) { Write-Verbose "Filtering for running and recently ended tasks (Default)." $where = @{ and = @() } $where['and'] += @{ type = @{ neq = "RTS"} } $where['and'] += @{ or = @( @{ status = "Active" }, @{ endedOn = @{ gte = (Get-Date).ToUniversalTime().AddDays(-1).ToString() } } )} $where['and'] += @{ archived = $false } Write-Verbose "Using filter: $($Where | convertto-json)" } } $Tasks = Get-ICAPI -Endpoint $Endpoint -where $where -NoLimit:$NoLimit -CountOnly:$CountOnly $Tasks | ForEach-Object { $_ | Add-Member -Type NoteProperty -Name totalSeconds -Value $null if ($_.endedOn) { $_.totalSeconds = [math]::round(([datetime]$_.endedOn - [DateTime]$_.createdOn).TotalSeconds) } } Write-Output $Tasks } } function Get-ICTaskItems { [cmdletbinding()] param( [parameter( Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [alias('id')] [alias('TaskId')] [String]$userTaskId, [parameter()] [Switch]$IncludeProgress, [parameter(HelpMessage="This will convert a hashtable into a JSON-encoded Loopback Where-filter: https://loopback.io/doc/en/lb2/Where-filter ")] [HashTable]$Where=@{}, [String[]]$Fields, [Switch]$NoLimit, [Switch]$CountOnly ) PROCESS { $Endpoint = "userTaskItems" $where['userTaskId'] = $userTaskId if ($CountOnly) { return (Get-ICAPI -Endpoint $Endpoint -where $where -fields $fields -NoLimit:$NoLimit -CountOnly:$CountOnly) } Write-Verbose "Getting All TaskItems with TaskId $userTaskId." $Items = Get-ICAPI -Endpoint $Endpoint -where $where -fields $fields -NoLimit:$NoLimit -CountOnly:$CountOnly ForEach ($item in $items) { $item | Add-Member -Type NoteProperty -Name totalSeconds -Value $null if ($item.endedOn) { $item.totalSeconds = [math]::round(([datetime]$item.endedOn - [DateTime]$item.createdOn).TotalSeconds) } if ($item.type -eq "host-access" -OR $item.type -eq "enumeration") { $type = $item.type $item | Add-Member -Type NoteProperty -Name queryId -Value $null $item | Add-Member -Type NoteProperty -Name queryName -Value $null if ($type -eq "enumeration") { $item.queryId = $item.result.queryId } elseif ($type -eq "host-access") { Write-Verbose "Getting QueryId from job" try { $j = Get-ICJob -Id $item.jobId } catch { } $item.queryId = $j.data.queryId } if ($item.queryId) { Write-Verbose "Getting QueryName" $q = Get-ICQuery -Id $item.queryId $item.queryName = $q.Name } } } if (-NOT $IncludeProgress) { Write-Output $Items } else { $n = 0 if ($Id) { $cnt = 1 } else { $cnt = Get-ICAPI -Endpoint $Endpoint -where $where -CountOnly } Write-Verbose "Found $cnt TaskItems. Getting progress for each." ForEach ($item in $items) { $item | Add-Member -Type NoteProperty -Name lastMessage -Value $null if ($item.type -eq "host-access") { $item | Add-Member -Type NoteProperty -Name accessible -Value $null } $n += 1 try { $pc = [math]::floor($n*100/$cnt); if ($pc -gt 100) { $pc = 100 } } catch { $pc = -1 } if ($item.id) { Write-Progress -Id 101 -Activity "Enriching with Task Progress Information" -status "Getting progress on $($item.name) [$n of $cnt]" -PercentComplete $pc $progresstext = @() _Get-ICTaskItemProgress -taskItemId $item.id | ForEach-Object { $p = $_ $p | foreach-object { $progresstext += "$($_.createdOn) - $($_.text)" if (-NOT $LastProgressMsg) { $LastProgressMsg = "$($_.createdOn) - $($_.text)" } if ($type -eq "host-access" -AND $_.text -match "^ACCESSIBLE:") { $item.accessible = $true $item.lastMessage = $_.text } elseif ($type -eq "host-access" -AND $_.text -match "^INACCESSIBLE:") { $item.accessible = $false $item.lastMessage = $_.text } } } if ($item.status -ne "complete" -AND -NOT $item.message) { $item.lastMessage = $LastProgressMsg } $item | Add-Member -MemberType "NoteProperty" -name "progress" -value ([string[]]$progresstext) } } Write-Output $items } } } function _Get-ICTaskItemProgress { [cmdletbinding()] param( [parameter( Mandatory=$true, ValueFromPipeline, ValueFromPipelineByPropertyName)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [alias('userTaskItemId')] [alias('id')] [String]$taskItemId, [parameter(HelpMessage="This will convert a hashtable into a JSON-encoded Loopback Where-filter: https://loopback.io/doc/en/lb2/Where-filter ")] [HashTable]$where=@{}, [Switch]$NoLimit ) PROCESS { $Endpoint = "userTaskItemProgresses" if ($_.id -AND $_.taskItemId) { # disambuguation $where['taskItemId'] = $_.taskItemId } else { $where['taskItemId'] = $taskItemId } Get-ICAPI -Endpoint $Endpoint -where $where -fields @("createdOn", "text") -NoLimit:$NoLimit | Sort-Object createdOn -Descending } } function Wait-ICTask { [cmdletbinding()] param( [parameter( Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)] [ValidateScript( { if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid." } })] [alias('id')] [alias('userTaskId')] [String]$TaskId ) BEGIN {} PROCESS { $Task = Get-ICTaskItems -userTaskId $TaskId -IncludeProgress while (-NOT $Task.complete) { Start-Sleep 20 $Task = Get-ICTaskItems -userTaskId $TaskId -IncludeProgress } return $true } END{} } function Get-ICLastScanTask { [cmdletbinding()] param( [parameter(Mandatory, Position=0)] [ValidateSet("Scan", "Enumerate")] [String]$Type, [parameter(Position=1)] [ValidateScript({ if ($_ -match $GUID_REGEX) { $true } else { throw "Incorrect input: $_. Should be a guid."} })] [String]$targetGroupId ) if ($targetGroupId) { $Task = Get-ICTask -where @{ targetGroupId = $targetGroupId; type = $Type } | Select-Object -Last 1 if (-NOT $Task) { Write-Error "No $Type task was found within target group with Id: $targetGroupId" return } } else { $where = @{ and = @()} #$where['and'] += @{ endedOn = @{ gte = (Get-Date).ToUniversalTime().AddDays(-1).ToString() } } $where['and'] += @{ type = $Type; } $where['and'] += @{ archived = $false } $Task = Get-ICTask -where $where | Select-Object -Last 1 if (-NOT $Task) { Write-Error "No task was found with type: $Type" return } } $Progress = Get-ICTaskItems -userTaskId $Task.id -IncludeProgress -NoLimit $result = @{ userTaskId = $Task.Id name = $Task.name createdOn = $Task.createdOn endedOn = $Task.endedOn totalSeconds = $task.totalSeconds status = $Task.status type = $Task.type accessibleCount = ([Array]($Progress | Where-Object { $_.Accessible })).count inaccessibleCount = ([Array]($Progress | Where-Object { -NOT $_.Accessible })).count totalItems = ([Array]$Progress).count items = $Progress } $result['coverage'] = try { [math]::Round(($($result.accessibleCount)/$($result.totalItems)), 2) } catch { $null } return [PSCustomObject]$result } # SIG # Begin signature block # MIINOAYJKoZIhvcNAQcCoIINKTCCDSUCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB # gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR # AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUf/oJO5GF5yspmM5d5R88hOQZ # xAagggp2MIIFHzCCBAegAwIBAgIQA7ShIT20JORyIag/jWOSyzANBgkqhkiG9w0B # AQsFADB2MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYD # VQQLExB3d3cuZGlnaWNlcnQuY29tMTUwMwYDVQQDEyxEaWdpQ2VydCBTSEEyIEhp # Z2ggQXNzdXJhbmNlIENvZGUgU2lnbmluZyBDQTAeFw0xODA5MTIwMDAwMDBaFw0y # MDExMTgxMjAwMDBaMF4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczEPMA0G # A1UEBxMGQXVzdGluMRYwFAYDVQQKEw1JbmZvY3l0ZSwgSW5jMRYwFAYDVQQDEw1J # bmZvY3l0ZSwgSW5jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApzcR # GuszlupWLdmtti4glKsr6SS2sp370yioc2XyIwPzU/etsBQa41x6VO7HXjtSXSry # p3SYaoLPQmBiAzKjDP6dzu0l7cQFbwPMky3SGqrC3Wr+Kw/qoMgn3wKBxzPJ53Gj # s1oxNwyz2N7FwN977vErW9C/FgM/XuE7Zde/HGl3oxTJNtY++BG2Ri3rwi5hNbzV # 5+avrJFW1DzHVBXYxbrE9vNy4V6s7dlZT2xZoJ3AtHoBCUMgHRKii3wHgFRaxiuz # 6XzlvHzmnh02KUfoV6cX++bP4bRtsJjmvrfJV+Mhlh/MhUidhhQQx0spLIfxv+vZ # OACP5jLm0g2fj4G4VQIDAQABo4IBvzCCAbswHwYDVR0jBBgwFoAUZ50PIAkMzIo6 # 5YJGcmL88cyQ5UAwHQYDVR0OBBYEFBqi6MjBKip4kQYxVCjC7yOrUHWFMA4GA1Ud # DwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzBtBgNVHR8EZjBkMDCgLqAs # hipodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vc2hhMi1oYS1jcy1nMS5jcmwwMKAu # oCyGKmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWhhLWNzLWcxLmNybDBM # BgNVHSAERTBDMDcGCWCGSAGG/WwDATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3 # dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAEEATCBiAYIKwYBBQUHAQEEfDB6MCQG # CCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wUgYIKwYBBQUHMAKG # Rmh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJIaWdoQXNz # dXJhbmNlQ29kZVNpZ25pbmdDQS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0B # AQsFAAOCAQEABnQP0mJYXNzfz4pMCc4FbQ9qe8NjloGuIlUgXaxlFAoMKZWMueXq # mciPWULaE+Wd5ChTuNsrWKG7bWYYWmmo7C1RWhdZhQT/C+k3lFcsSr6gdXAXiOmv # 3xv3d3oqfNe19G6jt6akQ6LjEauRw4xKinoK/S61Pw9c1KtEAGT8djgX74h433fy # FPiQd//ePnihKN+GXRCeLvSaDGuVrhHuI6UUhe3MK2/Nb8MzFddwkOOdpky1HBn4 # 8oFEAOzbrTVTTv4BWLNRvAiY8UO3D2Kt322UuAdXIKNxWB94UaFt2jg2QsRkTHGQ # MmbQ8OgMIWWNcE9RcVKuobYbzUAGPoMimTCCBU8wggQ3oAMCAQICEAt+EJA8OEkP # +i9nmoehp7kwDQYJKoZIhvcNAQELBQAwbDELMAkGA1UEBhMCVVMxFTATBgNVBAoT # DERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UE # AxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2UgRVYgUm9vdCBDQTAeFw0xMzEwMjIx # MjAwMDBaFw0yODEwMjIxMjAwMDBaMHYxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxE # aWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xNTAzBgNVBAMT # LERpZ2lDZXJ0IFNIQTIgSGlnaCBBc3N1cmFuY2UgQ29kZSBTaWduaW5nIENBMIIB # IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtEpefQcPQd7E9XYWNr1x/88/ # T3NLnNEN/krLV1hehRbdAhVUmfCPPC9NAngQaMjYNUs/wfdnzpgcrjO5LR2kClST # xIWi3zWx9fE8p7M0+11IyUbJYkS8SJnrKElTwz2PwA7eNZjpYlHfPWtAYe4EQdrP # p1xWltH5TLdEhIeYaeWCuRPmVb/IknCSCjFvf4syq89rWp9ixD7uvu1ZpFN/C/FS # iIp7Cmcky5DN7NJNNEyw4bWfnMb2byzN5spTdAGfZzXeOEktzu05RIIZeU4asrX7 # u3jwSWanz/pclnWSixpy2f9QklPMPsJDMgkahhNpPPuBMjMyZHVzKCYdCDA7BwID # AQABo4IB4TCCAd0wEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYw # EwYDVR0lBAwwCgYIKwYBBQUHAwMwfwYIKwYBBQUHAQEEczBxMCQGCCsGAQUFBzAB # hhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wSQYIKwYBBQUHMAKGPWh0dHA6Ly9j # YWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RD # QS5jcnQwgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQu # Y29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0 # cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9v # dENBLmNybDBPBgNVHSAESDBGMDgGCmCGSAGG/WwAAgQwKjAoBggrBgEFBQcCARYc # aHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAKBghghkgBhv1sAzAdBgNVHQ4E # FgQUZ50PIAkMzIo65YJGcmL88cyQ5UAwHwYDVR0jBBgwFoAUsT7DaQP4v0cB1Jgm # GggC72NkK8MwDQYJKoZIhvcNAQELBQADggEBAGoO/34TfAalS8AujPlTZAniuliR # MFDszJ/h06gvSEY2GCnQeChfmFZADx66vbE7h1zcW9ggDe0aFk3VESQhS/EnaZAT # 6xGhAdr9tU55WXW9OCpqw/aOQSuKoovXLFFR2ZygyONOumyoR9JO0WgfjAJXO7Mp # ao5qICq58gBiZLrI6QD5zKTUupo12K8sZWwWfFgh3kow0PrrJF0GyZ0Wt61KRdMl # 4gzwQKpcTax+zQaCuXZGaQjYMraC/uOpWDRDG45nZ5c/aDEWNjiVPof3x8OvnXp3 # Gdnek7X9biv8lPk9t0wSNSwwvuiNngVwmkgT9IzW5x6sOOeo860Mt3rsZ+0xggIs # MIICKAIBATCBijB2MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5j # MRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMTUwMwYDVQQDEyxEaWdpQ2VydCBT # SEEyIEhpZ2ggQXNzdXJhbmNlIENvZGUgU2lnbmluZyBDQQIQA7ShIT20JORyIag/ # jWOSyzAJBgUrDgMCGgUAoHgwGAYKKwYBBAGCNwIBDDEKMAigAoAAoQKAADAZBgkq # hkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGC # NwIBFTAjBgkqhkiG9w0BCQQxFgQUqcrDaJUWXLvp0CGNZKKzTgHs6a8wDQYJKoZI # hvcNAQEBBQAEggEAZEfbl+ixgI8worHdaQl5H0xtmD0E6QEw2ReGMUSfacxZuML4 # cNjYsq/GEoB/wS5Sz+78VZRFf/Wbcf08YqLpVLXVKicIgPmNHs/qOFAlkEPTonW3 # OTYIPNweOiVEDyJ7Pcg3cXgt3Cf0FpDDcWKvVsOB/7WAO+PJIIYu4prkS+t/SSjz # 9J6+BTpNqt2+jJHdpeOfdDJmeWfjR50410TK+yMEL/rDmNcoDfU2vqEtFVarBXmX # q3VItzLadcypQZXrdlwk1uhMvaNpME6OXkln+KqOCTWTSGGanCEDK+jupBUdsLe2 # pwYon9n9l3m0iEQaKDTcCI+S1T6FIZeE3+02CA== # SIG # End signature block |