Public/Get-MerakiOrganizationApplianceSecurityEvents.ps1

function Get-MerakiOrganizationApplianceSecurityEvents {
    <#
    .SYNOPSIS
    Retrieves a list of security events from the security appliance of a specified Meraki organization.
 
    .DESCRIPTION
    This function retrieves a list of security events from the security appliance of a specified Meraki organization using the Meraki Dashboard API. It requires an authentication token with the necessary permissions to access the API.
 
    .PARAMETER AuthToken
    The authentication token required to access the Meraki Dashboard API. You can obtain this token from your Meraki Dashboard account.
 
    .PARAMETER OrgId
    The ID of the Meraki organization for which to retrieve the security events. If not specified, the function will retrieve the ID of the first organization associated with the authentication token.
 
    .PARAMETER t0
    The beginning of the timespan for which to retrieve the security events. This parameter is ignored if the 'timespan' parameter is specified.
 
    .PARAMETER t1
    The end of the timespan for which to retrieve the security events. This parameter is ignored if the 'timespan' parameter is specified.
 
    .PARAMETER timespan
    The timespan for which to retrieve the security events, in seconds. If specified, the 't0' and 't1' parameters are ignored.
 
    .PARAMETER perPage
    The number of security events to retrieve per page.
 
    .PARAMETER startingAfter
    The ID of the last security event from the previous page to use as the starting point for the current page.
 
    .PARAMETER endingBefore
    The ID of the first security event from the next page to use as the ending point for the current page.
 
    .PARAMETER sortOrder
    The order in which to sort the security events ('ascending' or 'descending').
 
    .EXAMPLE
    PS C:\> Get-MerakiOrganizationApplianceSecurityEvents -AuthToken "12345" -OrgId "56789" -timespan 86400 -perPage 50 -sortOrder "descending"
    Retrieves the last 50 security events from the security appliance of the Meraki organization with ID "56789" in the last 24 hours, sorted in descending order.
 
    .NOTES
    This function requires the Invoke-RestMethod cmdlet to be available in the PowerShell session.
    #>

    [CmdletBinding()]
    param (
        [parameter(Mandatory=$true)]
        [string]$AuthToken,
        [parameter(Mandatory=$false)]
        [string]$OrganizationID = (Get-OrgID -AuthToken $AuthToken),
        [parameter(Mandatory=$false)]
        [string]$t0 = $null,
        [parameter(Mandatory=$false)]
        [string]$t1 = $null,
        [parameter(Mandatory=$false)]
        [int]$timespan = $null,
        [parameter(Mandatory=$false)]
        [int]$perPage = $null,
        [parameter(Mandatory=$false)]
        [string]$startingAfter = $null,
        [parameter(Mandatory=$false)]
        [string]$endingBefore = $null,
        [parameter(Mandatory=$false)]
        [string]$sortOrder = $null
    )
    If($OrganizationID -eq "Multiple organizations found. Please specify an organization ID.") {
        Return "Multiple organizations found. Please specify an organization ID."
    } else {
        try {
            $header = @{
                "X-Cisco-Meraki-API-Key" = $AuthToken
                "Content-Type" = "application/json"
            }
            $queryParams = @{}
            if ($timespan) {
                $queryParams['timespan'] = $timespan
            } else {
                if ($t0) {
                    $queryParams['t0'] = $t0
                }
                if ($t1) {
                    $queryParams['t1'] = $t1
                }
            }
            if ($perPage) {
                $queryParams['perPage'] = $perPage
            }
            if ($startingAfter) {
                $queryParams['startingAfter'] = $startingAfter
            }
            if ($endingBefore) {
                $queryParams['endingBefore'] = $endingBefore
            }
            if ($sortOrder) {
                $queryParams['sortOrder'] = $sortOrder
            }
        
            $queryString = New-MerakiQueryString -queryParams $queryParams
        
            $URL = "https://api.meraki.com/api/v1/organizations/$OrganizationID/appliance/security/events?$queryString"
        
            $URI = [uri]::EscapeUriString($URL)
        
            $response = Invoke-RestMethod -Method Get -Uri $URI -Header $header -UserAgent "MerakiPowerShellModule/1.0.2 DocNougat"
            return $response
        } catch {
            Write-Error $_
        }
    }
}