Scripts/Get-BPAAuditEvent.ps1
|
function Get-BPAAuditEvent { <# .SYNOPSIS Gets AutoMate BPA audit events. .DESCRIPTION Get-BPAAuditEvent gets audit events for AutoMate BPA objects. .PARAMETER InputObject The object(s) to retrieve audit events for. .PARAMETER StartDate The first date of events to retrieve (Default: 1 day ago). .PARAMETER EndDate The last date of events to retrieve (Default: now). .PARAMETER EventType The type of event(s) to be retrieved. Use auto-complete or see types.ps1 for a full list. .PARAMETER FilterSet The parameters to filter the search on. Supply hashtable(s) with the following properties: Property, Comparator, Value. Valid values for the Comparator are: =, !=, <, >, contains (default - no need to supply Comparator when using 'contains') .PARAMETER FilterSetMode If multiple filter sets are provided, FilterSetMode determines if the filter sets should be evaluated with an AND or an OR .PARAMETER SortProperty The object property to sort results on. Do not use BPAServer or TypeName, since those are custom properties added by this module, and not exposed in the API. .PARAMETER SortDescending If specified, this will sort the output on the specified SortProperty in descending order. Otherwise, ascending order is assumed. .PARAMETER AuditUserActivity If this switch is supplied, then this function returns any audited events that were performed by the piped in user. Otherwise, audit events related to the user object are returned. .PARAMETER BPAServer The AutoMate BPA management server. .INPUTS Audit events for the following objects can be retrieved by this function: Workflow Task Condition Process TaskAgent ProcessAgent AgentGroup User UserGroup Folder .EXAMPLE # Get events for workflow "My Workflow" Get-BPAWorkflow "My Workflow" | Get-BPAAuditEvent .EXAMPLE # Get audit events using filter sets Get-BPAAuditEvent -FilterSet @{Property = 'EventText'; Comparator = 'contains'; Value = 'connection from IP 10.1.1.10'} .NOTES Author(s): : David Seibel Contributor(s) : Date Created : 09/12/2016 Date Modified : 05/01/2018 .LINK https://github.com/davidseibel/PoshBPA #> [CmdletBinding(DefaultParameterSetName = "All")] [OutputType([System.Object[]])] param( [Parameter(Position = 0, ParameterSetName = "ByPipeline", ValueFromPipeline = $true)] [ValidateNotNullOrEmpty()] $InputObject, [ValidateNotNullOrEmpty()] [DateTime]$StartDate = (Get-Date).AddDays(-1), [ValidateNotNullOrEmpty()] [DateTime]$EndDate = (Get-Date), [ValidateNotNullOrEmpty()] [BPAAuditEventType]$EventType = [BPAAuditEventType]::All, [Hashtable[]]$FilterSet, [ValidateSet("And","Or")] [string]$FilterSetMode = "And", [ValidateNotNullOrEmpty()] [string[]]$SortProperty = "EventDateTime", [switch]$SortDescending = $false, [Parameter(ParameterSetName = "ByPipeline")] [ValidateNotNullOrEmpty()] [switch]$AuditUserActivity = $false, [ValidateNotNullOrEmpty()] [string]$BPAServer ) BEGIN { if ($StartDate -gt $EndDate) { throw "StartDate must be before EndDate!" } $splat = @{ RestMethod = "Get" BPAServer = $BPAServer } $result = @() if ($EventType -ne [BPAAuditEventType]::All) { $FilterSet += @{Property = "EventType"; Comparator = "="; Value = $EventType.value__} } } PROCESS { switch($PSCmdlet.ParameterSetName) { "All" { $splat += @{ Resource = Format-BPAUri -Path "audit_events/get" -RangeStart $StartDate -RangeEnd $EndDate -FilterSet $FilterSet -FilterSetMode $FilterSetMode -SortProperty $SortProperty -SortDescending:$SortDescending.ToBool() } $result = Invoke-BPARestMethod @splat } "ByPipeline" { foreach ($obj in $InputObject) { Write-Verbose "Processing object Name: '$($obj.Name)' Type: '$($obj.TypeName)'" $tempSplat = $splat if (-not $tempSplat.ContainsKey("BPAServer")) { $tempSplat += @{ BPAServer = $obj.BPAServer } } else { $tempSplat["BPAServer"] = $obj.BPAServer } switch ($obj.TypeName) { {($_ -in @("Workflow","Task","Process","Condition","Folder","Agent","AgentGroup","User","UserGroup"))} { if ($obj.TypeName -eq "User" -and $AuditUserActivity) { $tempFilterSet = $FilterSet + @{Property = "UserID"; Comparator = "="; Value = $obj.ID} } else { $tempFilterSet = $FilterSet + @{Property = "PrimaryConstructID"; Comparator = "="; Value = $obj.ID} if ($AuditUserActivity) { Write-Warning "The -AuditUserActivity switch is only used when a user is piped in." } } $tempSplat += @{ Resource = Format-BPAUri -Path "audit_events/get" -RangeStart $StartDate -RangeEnd $EndDate -FilterSet $tempFilterSet -FilterSetMode $FilterSetMode -SortProperty $SortProperty -SortDescending:$SortDescending.ToBool() } $result += Invoke-BPARestMethod @tempSplat } default { $unsupportedType = $obj.GetType().FullName if ($_) { $unsupportedType = $_ } elseif (($null -ne $obj.Type) -and ($obj.Type -ne "")) { $unsupportedType = $obj.Type } Write-Error -Message "Unsupported input type '$unsupportedType' encountered!" -TargetObject $obj } } } } } } END { $SortProperty += "BPAServer", "ID" return $result | Sort-Object $SortProperty -Unique -Descending:$SortDescending.ToBool() } } |