Functions/New-MCASSiemAgentToken.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
<#
.Synopsis
    New-MCASSiemAgentToken
.DESCRIPTION
     
.EXAMPLE
 
#>

function New-MCASSiemAgentToken {
    [CmdletBinding()]
    param
    (
        # Specifies the credential object containing tenant as username (e.g. 'contoso.us.portal.cloudappsecurity.com') and the 64-character hexadecimal Oauth token as the password.
        [Parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]$Credential = $CASCredential,

        # Fetches an alert object by its unique identifier.
        [Parameter(Mandatory=$true, Position=0)]
        [ValidateNotNullOrEmpty()]
        [ValidatePattern({^[A-Fa-f0-9]{24}$})]
        [Alias("_id")]
        [string]$Identity
    )
    
    try {
        $response = Invoke-MCASRestMethod -Credential $Credential -Path "/cas/api/v1/agents/siem/$Identity/generate/" -Method Post
    }
    catch {
        throw "Error calling MCAS API. The exception was: $_"
    }

    $response = $response.token
        
    $response
}