Skip to content

Commit 113d98a

Browse files
JohnDupreyJohnDuprey
authored
Merge pull request KelvinTegelaar#1545 from kris6673/defender-exclusions
Feat: Add defender exclusions
2 parents 5eb8094 + a8a64f8 commit 113d98a

File tree

1 file changed

+119
-37
lines changed

1 file changed

+119
-37
lines changed

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddDefenderDeployment.ps1‎

Lines changed: 119 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -18,45 +18,48 @@ Function Invoke-AddDefenderDeployment {
1818
if ('AllTenants' -in $Tenants) { $Tenants = (Get-Tenants -IncludeErrors).defaultDomainName }
1919
$Compliance = $Request.Body.Compliance
2020
$PolicySettings = $Request.Body.Policy
21+
$DefenderExclusions = $Request.Body.Exclusion
2122
$ASR = $Request.Body.ASR
2223
$EDR = $Request.Body.EDR
23-
$results = foreach ($tenant in $Tenants) {
24+
$Results = foreach ($tenant in $Tenants) {
2425
try {
25-
$SettingsObject = @{
26-
id = 'fc780465-2017-40d4-a0c5-307022471b92'
27-
androidEnabled = [bool]$Compliance.ConnectAndroid
28-
iosEnabled = [bool]$Compliance.ConnectIos
29-
windowsEnabled = [bool]$Compliance.Connectwindows
30-
macEnabled = [bool]$Compliance.ConnectMac
31-
partnerUnsupportedOsVersionBlocked = [bool]$Compliance.BlockunsupportedOS
32-
partnerUnresponsivenessThresholdInDays = 7
33-
allowPartnerToCollectIOSApplicationMetadata = [bool]$Compliance.ConnectIosCompliance
34-
allowPartnerToCollectIOSPersonalApplicationMetadata = [bool]$Compliance.ConnectIosCompliance
35-
androidMobileApplicationManagementEnabled = [bool]$Compliance.ConnectAndroidCompliance
36-
iosMobileApplicationManagementEnabled = [bool]$Compliance.appSync
37-
microsoftDefenderForEndpointAttachEnabled = [bool]$true
38-
}
39-
$SettingsObj = $SettingsObject | ConvertTo-Json -Compress
40-
try {
41-
$ExistingSettings = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/fc780465-2017-40d4-a0c5-307022471b92' -tenantid $tenant
26+
if ($Compliance) {
27+
$SettingsObject = @{
28+
id = 'fc780465-2017-40d4-a0c5-307022471b92'
29+
androidEnabled = [bool]$Compliance.ConnectAndroid
30+
iosEnabled = [bool]$Compliance.ConnectIos
31+
windowsEnabled = [bool]$Compliance.Connectwindows
32+
macEnabled = [bool]$Compliance.ConnectMac
33+
partnerUnsupportedOsVersionBlocked = [bool]$Compliance.BlockunsupportedOS
34+
partnerUnresponsivenessThresholdInDays = 7
35+
allowPartnerToCollectIOSApplicationMetadata = [bool]$Compliance.ConnectIosCompliance
36+
allowPartnerToCollectIOSPersonalApplicationMetadata = [bool]$Compliance.ConnectIosCompliance
37+
androidMobileApplicationManagementEnabled = [bool]$Compliance.ConnectAndroidCompliance
38+
iosMobileApplicationManagementEnabled = [bool]$Compliance.appSync
39+
microsoftDefenderForEndpointAttachEnabled = [bool]$true
40+
}
41+
$SettingsObj = $SettingsObject | ConvertTo-Json -Compress
42+
try {
43+
$ExistingSettings = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/fc780465-2017-40d4-a0c5-307022471b92' -tenantid $tenant
4244

43-
# Check if any setting doesn't match
44-
foreach ($key in $SettingsObject.Keys) {
45-
if ($ExistingSettings.$key -ne $SettingsObject[$key]) {
46-
$ExistingSettings = $false
47-
break
45+
# Check if any setting doesn't match
46+
foreach ($key in $SettingsObject.Keys) {
47+
if ($ExistingSettings.$key -ne $SettingsObject[$key]) {
48+
$ExistingSettings = $false
49+
break
50+
}
4851
}
52+
} catch {
53+
$ExistingSettings = $false
54+
}
55+
if ($ExistingSettings) {
56+
"Defender Intune Configuration already correct and active for $($tenant). Skipping"
57+
} else {
58+
$null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/' -tenantid $tenant -type POST -body $SettingsObj -AsApp $true
59+
"$($tenant): Successfully set Defender Compliance and Reporting settings. Please remember to enable the Intune Connector in the Defender portal."
4960
}
50-
} catch {
51-
$ExistingSettings = $false
5261
}
5362

54-
if ($ExistingSettings) {
55-
"Defender Intune Configuration already correct and active for $($tenant). Skipping"
56-
} else {
57-
$null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/mobileThreatDefenseConnectors/' -tenantid $tenant -type POST -body $SettingsObj -AsApp $true
58-
"$($tenant): Successfully set Defender Compliance and Reporting settings. Please remember to enable the Intune Connector in the Defender portal."
59-
}
6063

6164
if ($PolicySettings) {
6265
$Settings = switch ($PolicySettings) {
@@ -117,7 +120,7 @@ Function Invoke-AddDefenderDeployment {
117120
if ($PolicySettings.AssignTo -ne 'None') {
118121
$AssignBody = if ($PolicySettings.AssignTo -ne 'AllDevicesAndUsers') { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.' + $($PolicySettings.AssignTo) + 'AssignmentTarget"}}]}' } else { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.allDevicesAssignmentTarget"}},{"id":"","target":{"@odata.type":"#microsoft.graph.allLicensedUsersAssignmentTarget"}}]}' }
119122
$null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($PolicyRequest.id)')/assign" -tenantid $tenant -type POST -body $AssignBody
120-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($tenant) -message "Assigned policy $($DisplayName) to $($PolicySettings.AssignTo)" -Sev 'Info'
123+
Write-LogMessage -headers $Headers -API $APINAME -tenant $($tenant) -message "Assigned policy $($DisplayName) to $($PolicySettings.AssignTo)" -Sev 'Info'
121124
}
122125
"$($tenant): Successfully set Default AV Policy settings"
123126
}
@@ -175,7 +178,7 @@ Function Invoke-AddDefenderDeployment {
175178
if ($ASR.AssignTo -and $ASR.AssignTo -ne 'none') {
176179
$AssignBody = if ($ASR.AssignTo -ne 'AllDevicesAndUsers') { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.' + $($asr.AssignTo) + 'AssignmentTarget"}}]}' } else { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.allDevicesAssignmentTarget"}},{"id":"","target":{"@odata.type":"#microsoft.graph.allLicensedUsersAssignmentTarget"}}]}' }
177180
$null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($ASRRequest.id)')/assign" -tenantid $tenant -type POST -body $AssignBody
178-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($tenant) -message "Assigned policy $($DisplayName) to $($ASR.AssignTo)" -Sev 'Info'
181+
Write-LogMessage -headers $Headers -API $APINAME -tenant $($tenant) -message "Assigned policy $($DisplayName) to $($ASR.AssignTo)" -Sev 'Info'
179182
}
180183
"$($tenant): Successfully added ASR Settings"
181184
}
@@ -252,26 +255,105 @@ Function Invoke-AddDefenderDeployment {
252255
if ($ASR -and $ASR.AssignTo -ne 'none') {
253256
$AssignBody = if ($ASR.AssignTo -ne 'AllDevicesAndUsers') { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.' + $($asr.AssignTo) + 'AssignmentTarget"}}]}' } else { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.allDevicesAssignmentTarget"}},{"id":"","target":{"@odata.type":"#microsoft.graph.allLicensedUsersAssignmentTarget"}}]}' }
254257
$null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($EDRRequest.id)')/assign" -tenantid $tenant -type POST -body $AssignBody
255-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($tenant) -message "Assigned EDR policy $($DisplayName) to $($ASR.AssignTo)" -Sev 'Info'
258+
Write-LogMessage -headers $Headers -API $APINAME -tenant $($tenant) -message "Assigned EDR policy $($DisplayName) to $($ASR.AssignTo)" -Sev 'Info'
256259
}
257260
"$($tenant): Successfully added EDR Settings"
258261
}
259262
}
260263
}
264+
# Exclusion Policy Section
265+
if ($DefenderExclusions) {
266+
$ExclusionAssignTo = $DefenderExclusions.AssignTo
267+
if ($DefenderExclusions.excludedExtensions) {
268+
$ExcludedExtensions = $DefenderExclusions.excludedExtensions | Where-Object { $_ -and $_.Trim() } | ForEach-Object {
269+
@{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationStringSettingValue'; value = $_ }
270+
}
271+
}
272+
if ($DefenderExclusions.excludedPaths) {
273+
$ExcludedPaths = $DefenderExclusions.excludedPaths | Where-Object { $_ -and $_.Trim() } | ForEach-Object {
274+
@{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationStringSettingValue'; value = $_ }
275+
}
276+
}
277+
if ($DefenderExclusions.excludedProcesses) {
278+
$ExcludedProcesses = $DefenderExclusions.excludedProcesses | Where-Object { $_ -and $_.Trim() } | ForEach-Object {
279+
@{ '@odata.type' = '#microsoft.graph.deviceManagementConfigurationStringSettingValue'; value = $_ }
280+
}
281+
}
282+
$ExclusionSettings = [System.Collections.Generic.List[System.Object]]::new()
283+
if ($ExcludedExtensions.Count -gt 0) {
284+
$ExclusionSettings.Add(@{
285+
id = '2'
286+
settingInstance = @{
287+
'@odata.type' = '#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance'
288+
settingDefinitionId = 'device_vendor_msft_policy_config_defender_excludedextensions'
289+
settingInstanceTemplateReference = @{ settingInstanceTemplateId = 'c203725b-17dc-427b-9470-673a2ce9cd5e' }
290+
simpleSettingCollectionValue = @($ExcludedExtensions)
291+
}
292+
})
293+
}
294+
if ($ExcludedPaths.Count -gt 0) {
295+
$ExclusionSettings.Add(@{
296+
id = '1'
297+
settingInstance = @{
298+
'@odata.type' = '#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance'
299+
settingDefinitionId = 'device_vendor_msft_policy_config_defender_excludedpaths'
300+
settingInstanceTemplateReference = @{ settingInstanceTemplateId = 'aaf04adc-c639-464f-b4a7-152e784092e8' }
301+
simpleSettingCollectionValue = @($ExcludedPaths)
302+
}
303+
})
304+
}
305+
if ($ExcludedProcesses.Count -gt 0) {
306+
$ExclusionSettings.Add(@{
307+
id = '0'
308+
settingInstance = @{
309+
'@odata.type' = '#microsoft.graph.deviceManagementConfigurationSimpleSettingCollectionInstance'
310+
settingDefinitionId = 'device_vendor_msft_policy_config_defender_excludedprocesses'
311+
settingInstanceTemplateReference = @{ settingInstanceTemplateId = '96b046ed-f138-4250-9ae0-b0772a93d16f' }
312+
simpleSettingCollectionValue = @($ExcludedProcesses)
313+
}
314+
})
315+
}
316+
if ($ExclusionSettings.Count -gt 0) {
317+
$ExclusionBody = ConvertTo-Json -Depth 15 -Compress -InputObject @{
318+
name = 'Default AV Exclusion Policy'
319+
displayName = 'Default AV Exclusion Policy'
320+
settings = @($ExclusionSettings)
321+
platforms = 'windows10'
322+
technologies = 'mdm,microsoftSense'
323+
templateReference = @{
324+
templateId = '45fea5e9-280d-4da1-9792-fb5736da0ca9_1'
325+
templateFamily = 'endpointSecurityAntivirus'
326+
templateDisplayName = 'Microsoft Defender Antivirus exclusions'
327+
templateDisplayVersion = 'Version 1'
328+
}
329+
}
330+
$CheckExistingExclusion = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant
331+
if ('Default AV Exclusion Policy' -in $CheckExistingExclusion.Name) {
332+
"$($tenant): Exclusion Policy already exists. Skipping"
333+
} else {
334+
$ExclusionRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -tenantid $tenant -type POST -body $ExclusionBody
335+
if ($ExclusionAssignTo -and $ExclusionAssignTo -ne 'none') {
336+
$AssignBody = if ($ExclusionAssignTo -ne 'AllDevicesAndUsers') { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.' + $($ExclusionAssignTo) + 'AssignmentTarget"}}]}' } else { '{"assignments":[{"id":"","target":{"@odata.type":"#microsoft.graph.allDevicesAssignmentTarget"}},{"id":"","target":{"@odata.type":"#microsoft.graph.allLicensedUsersAssignmentTarget"}}]}' }
337+
$null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($ExclusionRequest.id)')/assign" -tenantid $tenant -type POST -body $AssignBody
338+
Write-LogMessage -headers $Headers -API $APIName -tenant $tenant -message "Assigned Exclusion policy to $($ExclusionAssignTo)" -Sev 'Info'
339+
}
340+
"$($tenant): Successfully set Default AV Exclusion Policy settings"
341+
}
342+
}
343+
}
261344
} catch {
262345
"Failed to add policy for $($tenant): $($_.Exception.Message)"
263-
Write-LogMessage -headers $Request.Headers -API $APINAME -tenant $($tenant) -message "Failed adding policy $($DisplayName). Error: $($_.Exception.Message)" -Sev 'Error'
346+
Write-LogMessage -headers $Headers -API $APIName -tenant $tenant -message "Failed adding policy $($DisplayName). Error: $($_.Exception.Message)" -Sev 'Error'
264347
continue
265348
}
266349

267350
}
268351

269-
$body = [pscustomobject]@{'Results' = @($results) }
270352

271353
# Associate values to output bindings by calling 'Push-OutputBinding'.
272354
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
273355
StatusCode = [HttpStatusCode]::OK
274-
Body = $body
356+
Body = @{'Results' = @($Results) }
275357
})
276358

277359
}

0 commit comments

Comments
 (0)