public/New-TNQuery.ps1

function New-TNQuery {
    <#
    .SYNOPSIS
        Creates new queries
 
    .DESCRIPTION
        Creates new queries
 
    .PARAMETER SessionObject
        Optional parameter to force using specific SessionObjects. By default, each command will connect to all connected servers that have been connected to using Connect-TNServer
 
    .PARAMETER Name
        The name of the target query
 
    .PARAMETER Description
        Description for Description
 
    .PARAMETER Type
        The type of query
 
    .PARAMETER AuthType
        Description for AuthType
 
    .PARAMETER Query
        The query object (from Get-Query) used to log into the target server. Specifies a user account that has permission to send the request.
 
    .PARAMETER QueryHash
        Description for QueryHash
 
    .PARAMETER PrivilegeEscalation
        Description for PrivilegeEscalation
 
    .PARAMETER EnableException
        By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
        This avoids overwhelming you with 'sea of red' exceptions, but is inconvenient because it basically disables advanced scripting.
        Using this switch turns this 'nice by default' feature off and enables you to catch exceptions with your own try/catch.
 
    .EXAMPLE
        PS C:\> $params = @{
              Name = "Windows Scanner Account"
              Type = "windows"
              AuthType = "password"
              Query = "ad\nessus"
        }
        PS C:\> New-TNQuery @params -Verbose
 
        Creates a new Windows query for ad\nessus
 
    .EXAMPLE
        PS C:\> $params = @{
              Name = "Linux Scanner Account"
              Type = "ssh"
              AuthType = "password"
              Query = "acasaccount"
              PrivilegeEscalation = "sudo"
        }
 
        PS C:\> New-TNQuery @params -Verbose
 
        Creates a new SSH query for acasaccount and sets the escalation type to sudo
 
 
    .EXAMPLE
        PS C:\> $credhash = @{
                dbType = "SQL Server"
                SQLServerAuthType = "SQL"
            }
 
        PS C:\> $params = @{
              Name = "SQL Server sqladmin"
              Type = "database"
              AuthType = "password"
              Query = "sqladmin"
              QueryHash = $credhash
        }
 
        PS C:\> New-TNQuery @params -Verbose
 
        Creates a new SQL Server query for SQL Login sqladmin
 
    .EXAMPLE
        PS C:\> $credhash = @{
                dbType = "SQL Server"
                SQLServerAuthType = "Windows"
            }
 
        PS C:\> $params = @{
              Name = "SQL Server sqladmin"
              Type = "database"
              AuthType = "password"
              Query = "ad\sqladmin"
              QueryHash = $credhash
        }
 
        PS C:\> New-TNQuery @params -Verbose
 
        Creates a new SQL Server query for Windows ad\sqladmin
 
#>

    [CmdletBinding()]
    param
    (
        [Parameter(ValueFromPipelineByPropertyName)]
        [object[]]$SessionObject = (Get-TNSession),
        [Parameter(ValueFromPipelineByPropertyName, Mandatory)]
        [string]$Name,
        [Parameter(ValueFromPipelineByPropertyName)]
        [string]$Description,
        [Parameter(ValueFromPipelineByPropertyName)]
        [ValidateSet("Vulnerability", "Alert", "All", "Lce", "Mobile", "Ticket", "User")]
        [string]$Type = "Vulnerability",
        [Parameter(ValueFromPipelineByPropertyName)]
        [string]$Tool = "sumid",
        [hashtable]$FilterHash,
        [ValidateSet("acceptRiskStatus", "asset", "assetID", "auditFile", "auditFileID", "baseCVSSScore", "benchmarkName", "cceID", "cpe", "cveID", "cvssV3BaseScore", "cvssV3Vector", "cvssVector", "dataFormat", "daysMitigated", "daysToMitigated", "dnsName", "exploitAvailable", "exploitFrameworks", "family", "familyID", "firstSeen", "iavmID", "ip", "lastMitigated", "lastSeen", "mitigatedStatus", "msbulletinID", "outputAssets", "patchPublished", "pluginID", "pluginModified", "pluginName", "pluginPublished", "pluginText", "pluginType", "policy", "policyID", "port", "protocol", "recastRiskStatus", "repository", "repositoryIDs", "responsibleUser", "responsibleUserIDs", "severity", "stigSeverity", "tcpport", "udpport", "uuid", "vprScore", "vulnPublished", "xref")]
        [string]$FilterName,
        [ValidateSet("=", "!=", "<=", ">=")]
        [string]$Operator,
        [string]$Value,
        [switch]$EnableException
    )
    begin {
        if ($Type -notin "windows", "ssh" -and -not $PSBoundParameters.QueryHash) {
            Stop-PSFFunction -Message "You must specify a QueryHash when Type is $Type"
            return
        }
        if ($AuthType -eq "certificate" -and -not $PSBoundParameters.QueryHash) {
            Stop-PSFFunction -Message "You must specify a QueryHash when AuthType is $AuthType"
            return
        }

        switch ($Type) {
            "Vulnerability" { $querytype = "vuln" }
            default { $querytype = $Type.ToLower() }
        }
    }
    process {
        if (Test-PSFFunctionInterrupt) { return }

        foreach ($session in $SessionObject) {
            if (-not $session.sc) {
                Stop-PSFFunction -EnableException:$EnableException -Message "Only tenable.sc supported" -Continue
            }

            <#
            "=", "!=", "<=", ">="
 
            name : Hello There
            description :
            context :
            status : -1
            createdTime : 0
            modifiedTime : 0
            groups : {}
            type : vuln
            tool : sumid
            sourceType :
            filters : {@{id=asset; filterName=asset; operator==; isPredefined=True; value=}}
            vulnTool : sumid
 
 
            "browseColumns" : <string> DEFAULT "",
            "browseSortColumn" : <string> DEFAULT "",
            "browseSortDirection" : <string> "ASC", "DESC" DEFAULT "ASC",
            #>

            # Note: sourceType will always be null. Current functionality doesn't accept sourceType parameter, and will always set it to default QUERY_NOT_TREND (null)
            if (-not $PSBoundParameters.QueryHash) {
                $body = @{
                    name        = $Name
                    description = $Description
                    type        = $querytype
                    tool        = $tooltype
                    sourceType  = $null
                    filters     = $filters
                    vulnTool    = "sumid"
                }
            } else {
                $body = $PSBoundParameters.QueryHash
                $body.Add("name", $Name)
                $body.Add("description", $Description)
                $body.Add("type", $Type)
                $body.Add("authType", $AuthType)


                if ($PSBoundParameters.Query) {
                    if ($Type -eq "windows" -and $Query.UserName -match "\\") {
                        $domain, $username = $Query.UserName -split "\\"
                        $body.Add("domain", $domain)
                    } else {
                        $username = $Query.UserName
                    }

                    if ($Type -eq "ssh") {
                        $body.Add("privilegeEscalation", $PrivilegeEscalation.ToLower())
                    }

                    if ($Type -notin "database") {
                        $body.Add("username", $username)
                    } else {
                        $body.Add("login", $username)
                    }
                }

                $params = @{
                    SessionObject   = $session
                    Path            = "/query"
                    Method          = "POST"
                    Parameter       = $body
                    EnableException = $EnableException
                }

                Invoke-TNRequest @params | ConvertFrom-TNRestResponse
            }
        }
    }
}