functions/ConvertTo-XdrEncodedAdvancedHuntingQuery.ps1

function ConvertTo-XdrEncodedAdvancedHuntingQuery {
    <#
    .SYNOPSIS
        Encodes an Advanced Hunting query for use in Microsoft Defender XDR.

    .DESCRIPTION
        Converts a KQL (Kusto Query Language) query into an encoded format that can be used
        in Microsoft Defender XDR Advanced Hunting. This is useful for generating shareable
        query links or for API operations that require encoded queries.

    .PARAMETER QueryText
        The KQL query text to be encoded. This should be a valid Advanced Hunting query.

    .EXAMPLE
        ConvertTo-XdrEncodedAdvancedHuntingQuery -QueryText "DeviceInfo | take 10"
        Encodes a simple query to retrieve 10 device records.

    .EXAMPLE
        $query = @"
        ExposureGraphNodes
        | where NodeLabel !in ("iam.user" ,"gcp-user", "user")
        | where EntityIds has_any ("AzureResourceId","AwsResourceName","GcpFullResourceName")
        | where isnotnull(NodeProperties.rawData.criticalityLevel)
        "@
        ConvertTo-XdrEncodedAdvancedHuntingQuery -QueryText $query
        Encodes a multi-line query for exposure graph analysis.

    .EXAMPLE
        Get-Content query.kql -Raw | ConvertTo-XdrEncodedAdvancedHuntingQuery
        Encodes a query from a file using pipeline input.

    .OUTPUTS
        String
        Returns the encoded query string that can be used in URLs or API calls.

    .NOTES
        This cmdlet requires an active session established via Connect-Xdr.
    #>

    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [string]$QueryText
    )

    begin {
        Update-XdrConnectionSettings
    }

    process {
        $Uri = "https://security.microsoft.com/apiproxy/mtp/huntingService/queries/encode"
        
        $body = @{
            QueryText = $QueryText
        } | ConvertTo-Json -Compress

        Write-Verbose "Encoding Advanced Hunting query"
        Write-Verbose "Query length: $($QueryText.Length) characters"
        
        try {
            $result = Invoke-RestMethod -Uri $Uri -Method Post -ContentType "application/json" -Body $body -WebSession $script:session -Headers $script:headers
            
            Write-Verbose "Query successfully encoded"
            return $result
        } catch {
            Write-Error "Failed to encode Advanced Hunting query: $_"
            return $null
        }
    }

    end {
    }
}