Skip to content

Commit 9113bf1

Browse files
pull[bot]pull[bot]
authored
Merge pull request #382 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 8d3f364 + 35f4170 commit 9113bf1

File tree

6 files changed

+287
-107
lines changed

6 files changed

+287
-107
lines changed

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenantDownload.ps1‎

Lines changed: 30 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
function Push-AuditLogTenantDownload {
2-
Param($Item)
3-
$ConfigTable = Get-CippTable -TableName 'WebhookRules'
2+
param($Item)
43
$TenantFilter = $Item.TenantFilter
54

65
try {
@@ -37,47 +36,43 @@ function Push-AuditLogTenantDownload {
3736
} else { $CIPPURL = 'https://{0}' -f $CippConfig.Value }
3837
}
3938

40-
# Get webhook rules
41-
$ConfigEntries = Get-CIPPAzDataTableEntity @ConfigTable
4239
$LogSearchesTable = Get-CippTable -TableName 'AuditLogSearches'
4340

44-
$Configuration = $ConfigEntries | Where-Object { ($_.Tenants -match $TenantFilter -or $_.Tenants -match 'AllTenants') }
45-
if ($Configuration) {
46-
try {
47-
$LogSearches = Get-CippAuditLogSearches -TenantFilter $TenantFilter -ReadyToProcess | Select-Object -First 10
48-
Write-Information ('Audit Logs: Found {0} searches, begin downloading' -f $LogSearches.Count)
49-
foreach ($Search in $LogSearches) {
50-
$SearchEntity = Get-CIPPAzDataTableEntity @LogSearchesTable -Filter "Tenant eq '$($TenantFilter)' and RowKey eq '$($Search.id)'"
51-
$SearchEntity.CippStatus = 'Processing'
52-
Add-CIPPAzDataTableEntity @LogSearchesTable -Entity $SearchEntity -Force
53-
try {
54-
Write-Information "Audit Log search: Processing search ID: $($Search.id) for tenant: $TenantFilter"
55-
$Downloads = New-CIPPAuditLogSearchResultsCache -TenantFilter $TenantFilter -searchId $Search.id
56-
$SearchEntity.CippStatus = 'Downloaded'
57-
} catch {
58-
if ($_.Exception.Message -match 'Request rate is large. More Request Units may be needed, so no changes were made. Please retry this request later.') {
59-
$SearchEntity.CippStatus = 'Pending'
60-
Write-Information "Audit Log search: Rate limit hit for $($SearchEntity.RowKey)."
61-
if ($SearchEntity.PSObject.Properties.Name -contains 'RetryCount') {
62-
$SearchEntity.RetryCount++
63-
} else {
64-
$SearchEntity | Add-Member -MemberType NoteProperty -Name RetryCount -Value 1
65-
}
41+
try {
42+
$LogSearches = Get-CippAuditLogSearches -TenantFilter $TenantFilter -ReadyToProcess | Select-Object -First 10
43+
Write-Information ('Audit Logs: Found {0} searches, begin downloading' -f $LogSearches.Count)
44+
foreach ($Search in $LogSearches) {
45+
$SearchEntity = Get-CIPPAzDataTableEntity @LogSearchesTable -Filter "Tenant eq '$($TenantFilter)' and RowKey eq '$($Search.id)'"
46+
$SearchEntity.CippStatus = 'Processing'
47+
Add-CIPPAzDataTableEntity @LogSearchesTable -Entity $SearchEntity -Force
48+
try {
49+
Write-Information "Audit Log search: Processing search ID: $($Search.id) for tenant: $TenantFilter"
50+
$Downloads = New-CIPPAuditLogSearchResultsCache -TenantFilter $TenantFilter -searchId $Search.id
51+
$SearchEntity.CippStatus = 'Downloaded'
52+
} catch {
53+
if ($_.Exception.Message -match 'Request rate is large. More Request Units may be needed, so no changes were made. Please retry this request later.') {
54+
$SearchEntity.CippStatus = 'Pending'
55+
Write-Information "Audit Log search: Rate limit hit for $($SearchEntity.RowKey)."
56+
if ($SearchEntity.PSObject.Properties.Name -contains 'RetryCount') {
57+
$SearchEntity.RetryCount++
6658
} else {
67-
$Exception = [string](ConvertTo-Json -Compress -InputObject (Get-CippException -Exception $_))
68-
$SearchEntity | Add-Member -MemberType NoteProperty -Name Error -Value $Exception
69-
$SearchEntity.CippStatus = 'Failed'
70-
Write-Information "Error processing audit log rules: $($_.Exception.Message)"
59+
$SearchEntity | Add-Member -MemberType NoteProperty -Name RetryCount -Value 1
7160
}
72-
61+
} else {
62+
$Exception = [string](ConvertTo-Json -Compress -InputObject (Get-CippException -Exception $_))
63+
$SearchEntity | Add-Member -MemberType NoteProperty -Name Error -Value $Exception
64+
$SearchEntity.CippStatus = 'Failed'
65+
Write-Information "Error processing audit log rules: $($_.Exception.Message)"
7366
}
74-
Add-CIPPAzDataTableEntity @LogSearchesTable -Entity $SearchEntity -Force
67+
7568
}
76-
} catch {
77-
Write-Information ('Audit Log search: Error {0} line {1} - {2}' -f $_.InvocationInfo.ScriptName, $_.InvocationInfo.ScriptLineNumber, $_.Exception.Message)
78-
exit 0
69+
Add-CIPPAzDataTableEntity @LogSearchesTable -Entity $SearchEntity -Force
7970
}
71+
} catch {
72+
Write-Information ('Audit Log search: Error {0} line {1} - {2}' -f $_.InvocationInfo.ScriptName, $_.InvocationInfo.ScriptLineNumber, $_.Exception.Message)
73+
exit 0
8074
}
75+
8176
} catch {
8277
Write-Information ('Push-AuditLogTenant: Error {0} line {1} - {2}' -f $_.InvocationInfo.ScriptName, $_.InvocationInfo.ScriptLineNumber, $_.Exception.Message)
8378
exit 0

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogTenantProcess.ps1‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
function Push-AuditLogTenantProcess {
2-
Param($Item)
2+
param($Item)
33
$TenantFilter = $Item.TenantFilter
44
$RowIds = $Item.RowIds
55

@@ -20,12 +20,13 @@ function Push-AuditLogTenantProcess {
2020
if ($Rows.Count -gt 0) {
2121
Write-Information "Retrieved $($Rows.Count) rows from cache for processing"
2222
Test-CIPPAuditLogRules -TenantFilter $TenantFilter -Rows $Rows
23-
exit 0
23+
return $true
2424
} else {
2525
Write-Information 'No rows found in cache for the provided row IDs'
26-
exit 0
26+
return $false
2727
}
2828
} catch {
2929
Write-Information ('Push-AuditLogTenant: Error {0} line {1} - {2}' -f $_.InvocationInfo.ScriptName, $_.InvocationInfo.ScriptLineNumber, $_.Exception.Message)
30+
return $false
3031
}
3132
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ExecAuditLogSearch.ps1‎

Lines changed: 106 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -10,78 +10,123 @@ function Invoke-ExecAuditLogSearch {
1010

1111
$APIName = $Request.Params.CIPPEndpoint
1212
$Headers = $Request.Headers
13+
$Action = $Request.Query.Action ?? $Request.Body.Action
14+
1315
Write-LogMessage -headers $Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
1416

15-
$Query = $Request.Body
16-
if (!$Query.TenantFilter) {
17-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
18-
StatusCode = [HttpStatusCode]::BadRequest
19-
Body = 'TenantFilter is required'
20-
})
21-
return
22-
}
23-
if (!$Query.StartTime -or !$Query.EndTime) {
24-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
25-
StatusCode = [HttpStatusCode]::BadRequest
26-
Body = 'StartTime and EndTime are required'
27-
})
28-
return
29-
}
17+
switch ($Action) {
18+
'ProcessLogs' {
19+
$SearchId = $Request.Query.SearchId ?? $Request.Body.SearchId
20+
$TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
21+
if (!$SearchId) {
22+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
23+
StatusCode = [HttpStatusCode]::BadRequest
24+
Body = 'SearchId is required'
25+
})
26+
return
27+
}
3028

31-
# Convert StartTime and EndTime to DateTime from unixtime
32-
if ($Query.StartTime -match '^\d+$') {
33-
$Query.StartTime = [DateTime]::UnixEpoch.AddSeconds([long]$Query.StartTime)
34-
} else {
35-
$Query.StartTime = [DateTime]$Query.StartTime
36-
}
29+
$Search = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/security/auditLog/queries/$SearchId" -AsApp $true -TenantId $TenantFilter
30+
Write-Information ($Search | ConvertTo-Json -Depth 10)
3731

38-
if ($Query.EndTime -match '^\d+$') {
39-
$Query.EndTime = [DateTime]::UnixEpoch.AddSeconds([long]$Query.EndTime)
40-
} else {
41-
$Query.EndTime = [DateTime]$Query.EndTime
42-
}
32+
$Entity = [PSCustomObject]@{
33+
PartitionKey = [string]'Search'
34+
RowKey = [string]$SearchId
35+
Tenant = [string]$TenantFilter
36+
DisplayName = [string]$Search.displayName
37+
StartTime = [datetime]$Search.filterStartDateTime
38+
EndTime = [datetime]$Search.filterEndDateTime
39+
Query = [string]($Search | ConvertTo-Json -Compress)
40+
CippStatus = [string]'Pending'
41+
}
42+
$Table = Get-CIPPTable -TableName 'AuditLogSearches'
43+
Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null
4344

44-
$Command = Get-Command New-CippAuditLogSearch
45-
$AvailableParameters = $Command.Parameters.Keys
46-
$BadProps = foreach ($Prop in $Query.PSObject.Properties.Name) {
47-
if ($AvailableParameters -notcontains $Prop) {
48-
$Prop
45+
Write-LogMessage -headers $Headers -API $APIName -message "Queued search for processing: $($Search.displayName)" -Sev 'Info' -tenant $TenantFilter
46+
47+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
48+
StatusCode = [HttpStatusCode]::OK
49+
Body = @{
50+
resultText = "Search '$($Search.displayName)' queued for processing."
51+
state = 'success'
52+
} | ConvertTo-Json -Depth 10 -Compress
53+
})
4954
}
50-
}
51-
if ($BadProps) {
52-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
53-
StatusCode = [HttpStatusCode]::BadRequest
54-
Body = "Invalid parameters: $($BadProps -join ', ')"
55-
})
56-
return
57-
}
55+
default {
56+
$Query = $Request.Body
57+
if (!$Query.TenantFilter) {
58+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
59+
StatusCode = [HttpStatusCode]::BadRequest
60+
Body = 'TenantFilter is required'
61+
})
62+
return
63+
}
64+
if (!$Query.StartTime -or !$Query.EndTime) {
65+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
66+
StatusCode = [HttpStatusCode]::BadRequest
67+
Body = 'StartTime and EndTime are required'
68+
})
69+
return
70+
}
5871

59-
try {
60-
Write-Information "Executing audit log search with parameters: $($Query | ConvertTo-Json -Depth 10)"
72+
# Convert StartTime and EndTime to DateTime from unixtime
73+
if ($Query.StartTime -match '^\d+$') {
74+
$Query.StartTime = [DateTime]::UnixEpoch.AddSeconds([long]$Query.StartTime)
75+
} else {
76+
$Query.StartTime = [DateTime]$Query.StartTime
77+
}
6178

62-
$Query = $Query | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable
63-
$NewSearch = New-CippAuditLogSearch @Query
79+
if ($Query.EndTime -match '^\d+$') {
80+
$Query.EndTime = [DateTime]::UnixEpoch.AddSeconds([long]$Query.EndTime)
81+
} else {
82+
$Query.EndTime = [DateTime]$Query.EndTime
83+
}
6484

65-
if ($NewSearch) {
66-
$Results = @{
67-
resultText = "Created audit log search: $($NewSearch.displayName)"
68-
state = 'success'
69-
details = $NewSearch
85+
$Command = Get-Command New-CippAuditLogSearch
86+
$AvailableParameters = $Command.Parameters.Keys
87+
$BadProps = foreach ($Prop in $Query.PSObject.Properties.Name) {
88+
if ($AvailableParameters -notcontains $Prop) {
89+
$Prop
90+
}
7091
}
71-
} else {
72-
$Results = @{
73-
resultText = 'Failed to initiate search'
74-
state = 'error'
92+
if ($BadProps) {
93+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
94+
StatusCode = [HttpStatusCode]::BadRequest
95+
Body = "Invalid parameters: $($BadProps -join ', ')"
96+
})
97+
return
98+
}
99+
100+
try {
101+
Write-Information "Executing audit log search with parameters: $($Query | ConvertTo-Json -Depth 10)"
102+
103+
$Query = $Query | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable
104+
$NewSearch = New-CippAuditLogSearch @Query
105+
106+
if ($NewSearch) {
107+
Write-LogMessage -headers $Headers -API $APIName -message "Created audit log search: $($NewSearch.displayName)" -Sev 'Info' -tenant $TenantFilter
108+
$Results = @{
109+
resultText = "Created audit log search: $($NewSearch.displayName)"
110+
state = 'success'
111+
details = $NewSearch
112+
}
113+
} else {
114+
Write-LogMessage -headers $Headers -API $APIName -message 'Failed to create audit log search' -Sev 'Error' -tenant $TenantFilter
115+
$Results = @{
116+
resultText = 'Failed to initiate search'
117+
state = 'error'
118+
}
119+
}
120+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
121+
StatusCode = [HttpStatusCode]::OK
122+
Body = $Results
123+
})
124+
} catch {
125+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
126+
StatusCode = [HttpStatusCode]::BadRequest
127+
Body = $_.Exception.Message
128+
})
75129
}
76130
}
77-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
78-
StatusCode = [HttpStatusCode]::OK
79-
Body = $Results
80-
})
81-
} catch {
82-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
83-
StatusCode = [HttpStatusCode]::BadRequest
84-
Body = $_.Exception.Message
85-
})
86131
}
87132
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAuditLogSearches.ps1‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ function Invoke-ListAuditLogSearches {
1818
$Days = $Request.Query.Days
1919
$Type = $Request.Query.Type
2020

21-
2221
if ($TenantFilter) {
2322
switch ($Type) {
2423
'Searches' {

‎Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogOrchestrator.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ function Start-AuditLogOrchestrator {
1616

1717
if (($AuditLogSearches | Measure-Object).Count -eq 0) {
1818
Write-Information 'No audit log searches available'
19-
} elseif (($WebhookRules | Measure-Object).Count -eq 0) {
19+
} elseif (($AuditLogSearches | Measure-Object).Count -eq 0 -and ($WebhookRules | Measure-Object).Count -eq 0) {
2020
Write-Information 'No webhook rules defined'
2121
} else {
2222
Write-Information "Audit Logs: Downloading $($AuditLogSearches.Count) searches"

0 commit comments

Comments
 (0)