intel/Get-CsIndicatorId.psm1
|
function Get-CsIndicatorId { <# .SYNOPSIS Get indicators IDs .PARAMETER DELETED If $true, include both published and deleted indicators in the response [default: $false] .PARAMETER FILTER Filter your query by specifying FQL filter parameters .PARAMETER QUERY Perform a generic substring search across all fields .PARAMETER LIMIT The maximum records to return [default: 5000] .PARAMETER OFFSET The offset to start retrieving records from [default: 0] .PARAMETER ALL Repeat request until all results are returned #> [CmdletBinding()] [OutputType([psobject])] param( [boolean] $Deleted = $false, [string] $Filter, [string] $Query, [ValidateRange(1,5000)] [int] $Limit = 5000, [int] $Offset = 0, [switch] $All ) begin{ if ($Filter) { Add-Type -AssemblyName System.Web } } process{ $Param = @{ Uri = '/intel/queries/indicators/v1?limit=' + [string] $Limit + '&offset=' + [string] $Offset + '&include_deleted=' + $Deleted Method = 'get' Header = @{ accept = 'application/json' 'content-type' = 'application/json' } } switch ($PSBoundParameters.Keys) { 'Filter' { $Param.Uri += '&filter=' + [System.Web.HTTPUtility]::UrlEncode($Filter) } 'Query' { $Param.Uri += '&q=' + $Query } 'Verbose' { $Param['Verbose'] = $true } 'Debug' { $Param['Debug'] = $true } } if ($All) { Join-CsResult -Activity $MyInvocation.MyCommand.Name -Param $Param } else { Invoke-CsAPI @Param } } } |