en-us/PowerGRR-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems schema="maml"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>ConvertFrom-Base64</command:name> <command:verb>ConvertFrom</command:verb> <command:noun>Base64</command:noun> <maml:description><maml:para>Decode a base64 encoded string. </maml:para> </maml:description> </command:details> <maml:description><maml:para>Some flows return an base64 encoded string in the payload. Use this function to convert it. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>ConvertFrom-Base64</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>String</maml:name> <maml:Description><maml:para>Base64 encoded string to decode. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>String</maml:name> <maml:Description><maml:para>Base64 encoded string to decode. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> {{ Add example code here }}</dev:code> <dev:remarks><maml:para>{{ Add example description here }} </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Find-GRRClient</command:name> <command:verb>Find</command:verb> <command:noun>GRRClient</command:noun> <maml:description><maml:para>Use the GRR search function to search for clients. The function returns only the computername or the whole GRR object. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Find-GRRClient</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>SearchString</maml:name> <maml:Description><maml:para>Search string with the needed prefix, e.g. label: or host:... </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyComputerName</maml:name> <maml:Description><maml:para>Show only the computername. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyComputerName</maml:name> <maml:Description><maml:para>Show only the computername. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>SearchString</maml:name> <maml:Description><maml:para>Search string with the needed prefix, e.g. label: or host:... </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Find-GRRClient -SearchString keyword -Credential $cred</dev:code> <dev:remarks><maml:para>Find GRR clients based on keywords. Use the available prefixes, e.g. "label:" or "host:" to limit the search results. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Find-GRRClient -SearchString keyword -Credential $cred -OnlyNode</dev:code> <dev:remarks><maml:para>Find GRR clients based on keywords. Use the available prefixes, e.g. "label:" or "host:" to limit the search results. Use `OnlyNode` to only display the host names. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Find-GRRClientByLabel</command:name> <command:verb>Find</command:verb> <command:noun>GRRClientByLabel</command:noun> <maml:description><maml:para>Search for clients with a given label. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Find-GRRClientByLabel</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>SearchString</maml:name> <maml:Description><maml:para>Label to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyComputerName</maml:name> <maml:Description><maml:para>Show only the computername. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyComputerName</maml:name> <maml:Description><maml:para>Show only the computername. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>SearchString</maml:name> <maml:Description><maml:para>Label to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Find-GRRClientByLabel -Credential $creds -SearchString keyword</dev:code> <dev:remarks><maml:para>Search for clients with a specific label. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Find-GRRClientByLabel -Credential $creds -SearchString keyword -OnlyNode</dev:code> <dev:remarks><maml:para>Search for clients with a specific label and show only the host names. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRArtifact</command:name> <command:verb>Get</command:verb> <command:noun>GRRArtifact</command:noun> <maml:description><maml:para>Get a list of all GRR artifacts. </maml:para> </maml:description> </command:details> <maml:description><maml:para>Get the list of available artifacts. The return object is a PowerShell object which is easily to filter with common PowerShell cmdlets. See example. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRArtifact</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRArtifact -Credential $cred</dev:code> <dev:remarks><maml:para>List all artifacts. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> $osx = Get-GRRArtifact -Credential $cred | ? {$_.name -match "osx"} | select name, description, iscustom PS C:\> $osx Name Description IsCustom ---- ----------- -------- OSXSPHardwareDataType Mac OS X system profiler. False OSXServices Running services from the Max OS X service management framework. False OSXUsers Users directories in /Users False</dev:code> <dev:remarks><maml:para> </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 3</maml:title> <dev:code>PS C:\> Get-GRRArtifact -Credential $cred | ?{ $_.SupportedOS -match "windows" -and $_.name -match "dns" } Name : WindowsDNSNameServer Description : Windows DNS and DHCP Server Registry Keys. Typical location for hijacking the DNS or DHCP servers of a client. Used by banking trojans for persistence. IsCustom : True URLs : https://technet.microsoft.com/en-us/library/dd197418(v=ws.10).aspx Labels : {System, Network} SupportedOS : {Windows} Type : REGISTRY_VALUE Attributes : @{key_value_pairs=System.Object[]}</dev:code> <dev:remarks><maml:para>List all Windows artifacts which have "dns" in the name. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/swisscom/powergrr/docs/Get-GRRArtifact.md</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRClientIdFromComputerName</command:name> <command:verb>Get</command:verb> <command:noun>GRRClientIdFromComputerName</command:noun> <maml:description><maml:para>Convert a computername into the corresponding GRR client id. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRClientIdFromComputerName</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computername to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyLastSeen</maml:name> <maml:Description><maml:para>Use the switch to only show the latest seen client id. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computername to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyLastSeen</maml:name> <maml:Description><maml:para>Use the switch to only show the latest seen client id. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRClientIdFromComputerName -ComputerName host1,host2 -Credential $creds Node ClientId LastSeenAt OSVersion ---- -------- ---------- --------- host1 C.1111111111111111 18.05.2017 15:48:17 10.0.10586 host1 C.2222222222222222 03.04.2017 14:55:37 6.1.7601 host2 C.3333333333333333 26.06.2017 09:31:32 6.1.7601</dev:code> <dev:remarks><maml:para>Search for the client ids for the two hosts. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Get-GRRClientIdFromComputerName -ComputerName host1,host2 -Credential $creds -OnlyLastSeen Node ClientId LastSeenAt OSVersion ---- -------- ---------- --------- host1 C.1111111111111111 18.05.2017 15:48:17 10.0.10586 host2 C.3333333333333333 26.06.2017 09:31:32 6.1.7601</dev:code> <dev:remarks><maml:para>Search for the client ids for the two hosts. If multiple client ids are found, the parameter "OnlyLastSeen" reduce the output to last seen one per each host. Compare the output to EXAMPLE 1. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 3</maml:title> <dev:code>PS C:\> (Get-GRRClientIdFromComputerName -ComputerName host1,host2 -Credential $creds -OnlyLastSeen).clientid C.1111111111111111 C.2222222222222222</dev:code> <dev:remarks><maml:para>Search for the client id for the two hosts and return only the client id. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRComputerNameFromClientId</command:name> <command:verb>Get</command:verb> <command:noun>GRRComputerNameFromClientId</command:noun> <maml:description><maml:para>Search for a specific client id and return the computername. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRComputerNameFromClientId</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ClientId</maml:name> <maml:Description><maml:para>Client id to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ClientId</maml:name> <maml:Description><maml:para>Client id to search for. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRComputerNameFromClientId -Credential $creds -ClientId c.1111111111111111 PS C:\> Get-GRRComputerNameFromClientId -Credential $creds -ClientId c.1111111111111111, c.2222222222222222 PS C:\> c.1111111111111111 | Get-GRRComputerNameFromClientId -Credential $cred PS C:\> c.1111111111111111,c.2222222222222222 | Get-GRRComputerNameFromClientId -Credential $cred</dev:code> <dev:remarks><maml:para>Returns the host name for one or multiple client ids. Use the parameter ClientId or the pipeline as input. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRConfig</command:name> <command:verb>Get</command:verb> <command:noun>GRRConfig</command:noun> <maml:description><maml:para>Get the current PowerGRR config. </maml:para> </maml:description> </command:details> <maml:description><maml:para>Get the current PowerGRR config. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRConfig</maml:name> </command:syntaxItem> </command:syntax> <command:parameters></command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS> Get-GRRConfig ConfigFile GRRUrl GRRIgnoreCertificateErrors GRRClientCertIssuer ---------- ------ -------------------------- ------------------- ...\powergrr-config.ps1 https://grrserver.tld false (default) none (default)</dev:code> <dev:remarks><maml:para>Read the current config. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/swisscom/powergrr/docs/Get-GRRConfig.md</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRFlowDescriptor</command:name> <command:verb>Get</command:verb> <command:noun>GRRFlowDescriptor</command:noun> <maml:description><maml:para>Get a list of all available flows. </maml:para> </maml:description> </command:details> <maml:description><maml:para>List all flows and allow filtering based on category, name and doc content. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRFlowDescriptor</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Show plain JSON output. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Show plain JSON output. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRFlowDescriptor -Credential $cred</dev:code> <dev:remarks><maml:para>List all available flows. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> $ret = Get-GRRFlowDescriptor -Credential $cred PS C:\> $ret | select name</dev:code> <dev:remarks><maml:para>List all available flows and display all the flow names. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 3</maml:title> <dev:code>PS C:\> $ret = Get-GRRFlowDescriptor -Credential $cred PS C:\> $ret | where { $_.category -match "memory"}</dev:code> <dev:remarks><maml:para>List all available flows from the memory category. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 4</maml:title> <dev:code>PS C:\> $ret = Get-GRRFlowDescriptor -Credential $cred PS C:\> $ret | where { $_.category -match "file"} | select name</dev:code> <dev:remarks><maml:para>List all available flows from the file category and display only the flow names. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 5</maml:title> <dev:code>PS C:\> Get-GRRFlowDescriptor -Credential $cred | ? { $_.name -match "proc" }</dev:code> <dev:remarks><maml:para>List all available flows where "proc" is in the flow name. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/swisscom/powergrr/docs/Get-GRRFlowDescriptor.md</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRFlowResult</command:name> <command:verb>Get</command:verb> <command:noun>GRRFlowResult</command:noun> <maml:description><maml:para>Get flow results for a specific client and a flow. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRFlowResult</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computername of the client. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>FlowId</maml:name> <maml:Description><maml:para>Flow id for which the results should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyPayload</maml:name> <maml:Description><maml:para>{{Fill OnlyPayload Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computername of the client. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>FlowId</maml:name> <maml:Description><maml:para>Flow id for which the results should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyPayload</maml:name> <maml:Description><maml:para>{{Fill OnlyPayload Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> $res = Get-GRRFlowResult -Credential $cred -ComputerName u261354 -FlowId "F:11111111" PS C:\> $res.items.payload | ConvertFrom-Base64</dev:code> <dev:remarks><maml:para>Get the flow results and decode the base64 encoded payload. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRHunt</command:name> <command:verb>Get</command:verb> <command:noun>GRRHunt</command:noun> <maml:description><maml:para>Get a list of available hunts. Filter the list with the parameter or afterwards with PowerShell. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRHunt</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ActiveWithin</maml:name> <maml:Description><maml:para>{{Fill ActiveWithin Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>CreatedBy</maml:name> <maml:Description><maml:para>Author of a hunt. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Return plain JSON instead of converted JSON. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem><maml:name>Get-GRRHunt</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ActiveWithin</maml:name> <maml:Description><maml:para>{{Fill ActiveWithin Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>DescriptionContains</maml:name> <maml:Description><maml:para>Text which is contains within the hunt description. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Return plain JSON instead of converted JSON. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem><maml:name>Get-GRRHunt</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Count</maml:name> <maml:Description><maml:para>The amount of returned hunts. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type><maml:name>Int32</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Offset</maml:name> <maml:Description><maml:para>Offset for the search. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type><maml:name>Int32</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Return plain JSON instead of converted JSON. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ActiveWithin</maml:name> <maml:Description><maml:para>{{Fill ActiveWithin Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Count</maml:name> <maml:Description><maml:para>The amount of returned hunts. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type><maml:name>Int32</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>CreatedBy</maml:name> <maml:Description><maml:para>Author of a hunt. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>DescriptionContains</maml:name> <maml:Description><maml:para>Text which is contains within the hunt description. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Offset</maml:name> <maml:Description><maml:para>Offset for the search. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Int32</command:parameterValue> <dev:type><maml:name>Int32</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Return plain JSON instead of converted JSON. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRHunts -Credential $cred | select -First 1</dev:code> <dev:remarks><maml:para>Find last hunt id. You can use all the filtering from PowerShell. Each hunt is represented as an own PowerShell object. The disadvantage of this POST-filtering is that the command first returns every hunt. See next example to use a PRE-filtering. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Get-GRRHunts -Credential $cred -Count 5</dev:code> <dev:remarks><maml:para>Find last 5 hunt id. You can use all the filtering from PowerShell. Each hunt is represented as an own PowerShell object. The advantage of this usage is that GRR server filters the hunts on the server before returning the response. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRHuntInfo</command:name> <command:verb>Get</command:verb> <command:noun>GRRHuntInfo</command:noun> <maml:description><maml:para>Get hunt info for a specific hunt. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRHuntInfo</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which the info should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which the info should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRHuntInfo "H:AAAAAAAA" -Credential $cred</dev:code> <dev:remarks><maml:para>Read the hunt infos based on a hunt id. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRHuntResult</command:name> <command:verb>Get</command:verb> <command:noun>GRRHuntResult</command:noun> <maml:description><maml:para>Get hunt results for a specific hunt. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRHuntResult</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which the results should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which the results should be returned. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> $res = Get-GRRHuntResult -HuntId H:AAAAAAAA -Credential $creds PS C:\> ($res.items.payload.stat_entry.aff4path).substring(31) | sort -u PS C:\> $res.items.client_id | sort -u</dev:code> <dev:remarks><maml:para>Get hunt results based on a hunt id. Display all the unique file paths which were found with a file finder hunt. Only display the unique GRR client id's. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRLabel</command:name> <command:verb>Get</command:verb> <command:noun>GRRLabel</command:noun> <maml:description><maml:para>Get all labels. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRLabel</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Get-GRRLabel -Credential $creds</dev:code> <dev:remarks><maml:para>Return every label which is available in GRR. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Get-GRRLabel -Credential $creds | sls osx</dev:code> <dev:remarks><maml:para>Return every available label which contains "osx". </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Get-GRRSession</command:name> <command:verb>Get</command:verb> <command:noun>GRRSession</command:noun> <maml:description><maml:para>Return the headers and the websession for a specific GRR server. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Get-GRRSession</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> {{ Add example code here }}</dev:code> <dev:remarks><maml:para>{{ Add example description here }} </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Invoke-GRRFlow</command:name> <command:verb>Invoke</command:verb> <command:noun>GRRFlow</command:noun> <maml:description><maml:para>Invoke a flow on one or multiple clients. </maml:para> </maml:description> </command:details> <maml:description><maml:para>Invoke a flow on one or multiple clients. The dynamic parameter "Flow" allows using dedicated parameters for each flow type. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Invoke-GRRFlow</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object</command:parameterValue> <dev:type><maml:name>Object</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Flow</maml:name> <maml:Description><maml:para>{{Fill Flow Description}} </maml:para> </maml:Description> <command:parameterValueGroup><command:parameterValue required="false" variableLength="false">Netstat</command:parameterValue> <command:parameterValue required="false" variableLength="false">ListProcesses</command:parameterValue> <command:parameterValue required="false" variableLength="false">FileFinder</command:parameterValue> <command:parameterValue required="false" variableLength="false">RegistryFinder</command:parameterValue> <command:parameterValue required="false" variableLength="false">ExecutePythonHack</command:parameterValue> <command:parameterValue required="false" variableLength="false">ArtifactCollectorFlow</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>EmailAddress</maml:name> <maml:Description><maml:para>{{Fill EmailAddress Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object</command:parameterValue> <dev:type><maml:name>Object</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>EmailAddress</maml:name> <maml:Description><maml:para>{{Fill EmailAddress Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Flow</maml:name> <maml:Description><maml:para>{{Fill Flow Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Invoke-GRRFlow -ComputerName host1 -Credential $cred -Flow FileFinder -path "C:\test.exe" -actiontype hash</dev:code> <dev:remarks><maml:para>Start a new file finder flow. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Invoke-GRRRequest</command:name> <command:verb>Invoke</command:verb> <command:noun>GRRRequest</command:noun> <maml:description><maml:para>Helper function for GRR requests. If a function you need is not available you can use this function to run the needed request. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Invoke-GRRRequest</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Body</maml:name> <maml:Description><maml:para>{{Fill Body Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Headers</maml:name> <maml:Description><maml:para>{{Fill Headers Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Hashtable</command:parameterValue> <dev:type><maml:name>Hashtable</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Url</maml:name> <maml:Description><maml:para>{{Fill Url Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Websession</maml:name> <maml:Description><maml:para>{{Fill Websession Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">WebRequestSession</command:parameterValue> <dev:type><maml:name>WebRequestSession</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Method</maml:name> <maml:Description><maml:para>{{Fill Method Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Body</maml:name> <maml:Description><maml:para>{{Fill Body Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Headers</maml:name> <maml:Description><maml:para>{{Fill Headers Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Hashtable</command:parameterValue> <dev:type><maml:name>Hashtable</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Url</maml:name> <maml:Description><maml:para>{{Fill Url Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>Websession</maml:name> <maml:Description><maml:para>{{Fill Websession Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">WebRequestSession</command:parameterValue> <dev:type><maml:name>WebRequestSession</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>Method</maml:name> <maml:Description><maml:para>{{Fill Method Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> {{ Add example code here }}</dev:code> <dev:remarks><maml:para>{{ Add example description here }} </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>New-GRRClientApproval</command:name> <command:verb>New</command:verb> <command:noun>GRRClientApproval</command:noun> <maml:description><maml:para>Create a new client approval. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>New-GRRClientApproval</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>NotifiedUsers</maml:name> <maml:Description><maml:para>{{Fill NotifiedUsers Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>Reason</maml:name> <maml:Description><maml:para>{{Fill Reason Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyId</maml:name> <maml:Description><maml:para>{{Fill OnlyId Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>NotifiedUsers</maml:name> <maml:Description><maml:para>{{Fill NotifiedUsers Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyId</maml:name> <maml:Description><maml:para>{{Fill OnlyId Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>Reason</maml:name> <maml:Description><maml:para>{{Fill Reason Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> {{ Add example code here }}</dev:code> <dev:remarks><maml:para>{{ Add example description here }} </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>New-GRRHunt</command:name> <command:verb>New</command:verb> <command:noun>GRRHunt</command:noun> <maml:description><maml:para>Create a new hunt. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>New-GRRHunt</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntDescription</maml:name> <maml:Description><maml:para>Hunt description. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Flow</maml:name> <maml:Description><maml:para>Flow type for the hunt. </maml:para> </maml:Description> <command:parameterValueGroup><command:parameterValue required="false" variableLength="false">Netstat</command:parameterValue> <command:parameterValue required="false" variableLength="false">ListProcesses</command:parameterValue> <command:parameterValue required="false" variableLength="false">FileFinder</command:parameterValue> <command:parameterValue required="false" variableLength="false">RegistryFinder</command:parameterValue> <command:parameterValue required="false" variableLength="false">ExecutePythonHack</command:parameterValue> <command:parameterValue required="false" variableLength="false">ArtifactCollectorFlow</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>RuleType</maml:name> <maml:Description><maml:para>Rule type for the hunt. </maml:para> </maml:Description> <command:parameterValueGroup><command:parameterValue required="false" variableLength="false">Label</command:parameterValue> <command:parameterValue required="false" variableLength="false">OS</command:parameterValue> </command:parameterValueGroup> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="6" aliases="none"><maml:name>EmailAddress</maml:name> <maml:Description><maml:para>Email address for the notification after the first result. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="7" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object</command:parameterValue> <dev:type><maml:name>Object</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyUrl</maml:name> <maml:Description><maml:para>Return only the url to the web ui. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="7" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">Object</command:parameterValue> <dev:type><maml:name>Object</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="6" aliases="none"><maml:name>EmailAddress</maml:name> <maml:Description><maml:para>Email address for the notification after the first result. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Flow</maml:name> <maml:Description><maml:para>Flow type for the hunt. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntDescription</maml:name> <maml:Description><maml:para>Hunt description. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyUrl</maml:name> <maml:Description><maml:para>Return only the url to the web ui. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>RuleType</maml:name> <maml:Description><maml:para>Rule type for the hunt. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> New-GRRHunt -Credential $cred -HuntDescription "Hunting for malicious launch agent" -Flow FileFinder -EmailAddress emailadress@for-notifications.tld -MatchMode MATCH_ALL -OnlyUrl -RuleType label -Label label1 -path "/Users/knockknock/Library/LaunchAgents/apple.evil.plist" -actiontype hash</dev:code> <dev:remarks><maml:para>Create a new hunt and show only the URL after creating the hunt. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/swisscom/powergrr/docs/New-GRRHunt.md</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>New-GRRHuntApproval</command:name> <command:verb>New</command:verb> <command:noun>GRRHuntApproval</command:noun> <maml:description><maml:para>Create a new hunt approval. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>New-GRRHuntApproval</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which an approval is created. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>NotifiedUsers</maml:name> <maml:Description><maml:para>The users which have to give the approval. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>Reason</maml:name> <maml:Description><maml:para>Reason for the approval. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyId</maml:name> <maml:Description><maml:para>Display only the approval id after creating the approval. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id for which an approval is created. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>NotifiedUsers</maml:name> <maml:Description><maml:para>The users which have to give the approval. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>OnlyId</maml:name> <maml:Description><maml:para>Display only the approval id after creating the approval. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="3" aliases="none"><maml:name>Reason</maml:name> <maml:Description><maml:para>Reason for the approval. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> New-GRRHuntApproval -Credential $cred -HuntId H:AAAAAAAA -NotifiedUsers username -Reason "Hunt for malicious files" -OnlyId</dev:code> <dev:remarks><maml:para>Create a new hunt approval. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Remove-GRRLabel</command:name> <command:verb>Remove</command:verb> <command:noun>GRRLabel</command:noun> <maml:description><maml:para>Remove a label on a range of clients. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Remove-GRRLabel</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Label</maml:name> <maml:Description><maml:para>{{Fill Label Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>{{Fill ComputerName Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Label</maml:name> <maml:Description><maml:para>{{Fill Label Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Remove-GRRLabel -ComputerName host1, host2 -Label label1 -Credential $creds PS C:\> "host1", "host2" | Remove-GRRLabel -Label label1 -Credential $creds</dev:code> <dev:remarks><maml:para>Remove the label "label1" to both hosts. It's possible to use pipeline to remove the labels. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Remove-GRRLabel -ComputerName (Find-GRRClient -SearchString keyword -Credential $cred -OnlyNode) -Label test5,test3 -Credential $creds</dev:code> <dev:remarks><maml:para>Use the GRR search to find specific clients on which both labels should be removed. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Set-GRRLabel</command:name> <command:verb>Set</command:verb> <command:noun>GRRLabel</command:noun> <maml:description><maml:para>Set a label on one or multiple clients. </maml:para> </maml:description> </command:details> <maml:description><maml:para>Set a label on one or multiple clients. The function has pipeline support. </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Set-GRRLabel</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computernames which should be labeled. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Label</maml:name> <maml:Description><maml:para>Label to set for the clients. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none"><maml:name>ComputerName</maml:name> <maml:Description><maml:para>Computernames which should be labeled. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="2" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Label</maml:name> <maml:Description><maml:para>Label to set for the clients. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type><maml:name>String[]</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>System.String[]</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Set-GRRLabel -ComputerName host1, host2 -Label label1 -Credential $creds PS C:\> "host1", "host2" | Set-GRRLabel -Label label1 -Credential $creds</dev:code> <dev:remarks><maml:para>Add the label "label1" to both hosts. It's possible to use pipeline to set the labels. </maml:para> </dev:remarks> </command:example> <command:example><maml:title>Example 2</maml:title> <dev:code>PS C:\> Set-GRRLabel -ComputerName (Find-GRRClient -SearchString keyword -Credential $cred -OnlyNode) -Label test5,test3 -Credential $creds</dev:code> <dev:remarks><maml:para>Use the GRR search to find specific clients which should be labeled. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Start-GRRHunt</command:name> <command:verb>Start</command:verb> <command:noun>GRRHunt</command:noun> <maml:description><maml:para>Start a GRR hunt based on the hunt id. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Start-GRRHunt</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>HuntId of the hunt which should be started. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Show plain JSON as output instead of the return object. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>GRR credentials. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>HuntId of the hunt which should be started. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>Show plain JSON as output instead of the return object. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Start-GRRHunt -Credential $cred -HuntId H:AAAAAAAA</dev:code> <dev:remarks><maml:para>Start the specific hunt. Approval must be granted before. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks></command:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details><command:name>Stop-GRRHunt</command:name> <command:verb>Stop</command:verb> <command:noun>GRRHunt</command:noun> <maml:description><maml:para>Stop a hunt. </maml:para> </maml:description> </command:details> <maml:description><maml:para>{{Fill in the Description}} </maml:para> </maml:description> <command:syntax><command:syntaxItem><maml:name>Stop-GRRHunt</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id which should be stopped. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="cf"><maml:name>Confirm</maml:name> <maml:Description><maml:para>Prompts you for confirmation before running the cmdlet. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="1" aliases="none"><maml:name>Credential</maml:name> <maml:Description><maml:para>{{Fill Credential Description}} </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">PSCredential</command:parameterValue> <dev:type><maml:name>PSCredential</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="0" aliases="none"><maml:name>HuntId</maml:name> <maml:Description><maml:para>Hunt id which should be stopped. </maml:para> </maml:Description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type><maml:name>String</maml:name> <maml:uri /></dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="none"><maml:name>ShowJSON</maml:name> <maml:Description><maml:para>{{Fill ShowJSON Description}} </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="benannt" aliases="wi"><maml:name>WhatIf</maml:name> <maml:Description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run. </maml:para> </maml:Description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type><maml:name>SwitchParameter</maml:name> <maml:uri /></dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes><command:inputType><dev:type><maml:name>Keine</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues><command:returnValue><dev:type><maml:name>System.Object</maml:name> </dev:type> <maml:description><maml:para> </maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet><maml:alert><maml:para> </maml:para> </maml:alert> </maml:alertSet> <command:examples><command:example><maml:title>Example 1</maml:title> <dev:code>PS C:\> Stop-GRRHunt -Credential $cred -HuntId H:7D5E2318</dev:code> <dev:remarks><maml:para>Stop the specific hunt. </maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/swisscom/powergrr/docs/Stop-GRRHunt.md</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> </helpItems> |