Functions/Get-DiscoveredApps.ps1
|
<#
.SYNOPSIS Retrieves a list of discovered cloud applications. .DESCRIPTION The Get-DiscoveredApps function retrieves a list of cloud applications that have been discovered by Microsoft Defender for Cloud Apps. .PARAMETER streamID The ID of the stream to retrieve discovered apps from. .PARAMETER timeframe The time frame to retrieve discovered apps from. Valid values are "LastHour", "Last24Hours", "Last7Days", and "Last30Days". .PARAMETER expandUsers Specifies whether to expand the "users" property of the discovered apps. If this parameter is specified, the "users" property will be included in the response. .EXAMPLE PS C:\> Get-DiscoveredApps -streamID "12345" -timeframe "Last24Hours" -expandUsers $true Retrieves a list of cloud applications discovered in the last 24 hours, including the "users" property for each app. .NOTES This function requires the Invoke-GraphAPI function to be available in the current PowerShell session. #> function Get-DiscoveredApps { [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [string]$streamID, [Parameter(Mandatory = $true)] [stream_time_frame]$timeframe, [Parameter(Mandatory = $false)] [boolean]$expandUsers ) Begin { $streamTimeFrameObject = [StreamTimeFrame]::new() $streamTimeFrame = $streamTimeFrameObject.$timeframe $ErrorActionPreference = 'Stop' $resourceGraph = "https://graph.microsoft.com" if($expandUsers){ $expandStringLiteral = "`$expand" $discoveredAppsEndpoint = "$resourceGraph/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/$streamID/$streamTimeFrame/collection?$expandStringLiteral=users" } else{ # This is the default endpoint (no expand $discoveredAppsEndpoint = "$resourceGraph/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/$streamID/$streamTimeFrame" } } Process { $response = Invoke-GraphAPI -Uri $discoveredAppsEndpoint -Method Get return $response.value } } |