functions/Convert-McasExAlert.ps1
|
function Convert-McasExAlert { <# .SYNOPSIS Converts / Processes an alert object for greater convenience. .DESCRIPTION Converts / Processes an alert object for greater convenience. Expects the output of Get-MCASAlert or Get-McasExAlert. Resolves timestamps, flattens out the data structure and resolves files if present. .PARAMETER Alert The alert object to process. .EXAMPLE PS C:\> Get-McasExAlert -Limit '-2d' | Convert-McasExAlert Retrieve the alerts of the last two days and convert them into something readable. #> [CmdletBinding()] param ( [Parameter(ValueFromPipeline = $true)] $Alert ) process { foreach ($alertObject in $Alert) { # $app = ($alertObject.entities | Where-Object type -eq 'service').label $file = ($alertObject.entities | Where-Object type -eq 'file').id $fileDetails = $null if ($file) { $fileDetails = Get-MCASFile -Identity $file } [pscustomobject]@{ PSTypeName = 'Mcas.Alert' ID = $alertObject._id Timestamp = ConvertFrom-MCASTimestamp $alertObject.timestamp Title = $alertObject.title PolicyName = $alertObject.Policy.Label PolicyType = $alertObject.Policy.PolicyType Status = $alertObject.statusValue Severity = $alertObject.severityValue ThreatScore = $alertObject.ThreatScore Url = $alertObject.URL Proxy = ($alertObject.Entities | Where-Object type -eq discovery_stream).Label Service = ($alertObject.Entities | Where-Object type -eq service).Label Accounts = ($alertObject.Entities | Where-Object type -eq account).Label AccountMail = ($alertObject.Entities | Where-Object type -eq account).em IP = ($alertObject.Entities | Where-Object type -eq ip).Label Country = ($alertObject.Entities | Where-Object type -eq country).Label DiscoveryService = ($alertObject.Entities | Where-Object type -eq discovery_service).Label DiscoveryIP = ($alertObject.Entities | Where-Object type -eq discovery_ip).Label DiscoveryUser = ($alertObject.Entities | Where-Object type -eq discovery_user).Label DiscoveryStream = ($alertObject.Entities | Where-Object type -eq discovery_stream).Label FileName = $fileDetails.name FilePath = $fileDetails.alternateLink FileOwner = $fileDetails.ownerAddress FileCreatedDate = $( if ($fileDetails.createdDate) { try { ConvertFrom-MCASTimestamp $fileDetails.createdDate -ErrorAction Stop } catch { $fileDetails.createdDate } } ) FileModifiedDate = $( if ($fileDetails.modifiedDate) { try { ConvertFrom-MCASTimestamp $fileDetails.modifiedDate -ErrorAction Stop } catch { $fileDetails.modifiedDate } } ) FileStatus = $(if ($file) { $fileDetails.fileStatus[1] }) FileAccessLevel = $(if ($file) { $fileDetails.fileAccessLevel[1] }) } } } } |