Skip to content

Commit 96d36ab

Browse files
pull[bot]pull[bot]
authored
Merge pull request #545 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 73f808a + 0a9eb74 commit 96d36ab

File tree

9 files changed

+128
-141
lines changed

9 files changed

+128
-141
lines changed

‎CIPPHttpTrigger/function.json‎

Lines changed: 9 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -7,50 +7,21 @@
77
"type": "httpTrigger",
88
"direction": "in",
99
"name": "Request",
10-
"methods": ["get", "post"],
11-
"route": "{CIPPEndpoint}"
10+
"methods": [
11+
"get",
12+
"post",
13+
"patch",
14+
"put",
15+
"delete",
16+
"options"
17+
],
18+
"route": "{*CIPPEndpoint}"
1219
},
1320
{
1421
"type": "http",
1522
"direction": "out",
1623
"name": "Response"
1724
},
18-
{
19-
"type": "queue",
20-
"direction": "out",
21-
"name": "QueueItem",
22-
"queueName": "CIPPGenericQueue"
23-
},
24-
{
25-
"type": "queue",
26-
"direction": "out",
27-
"name": "Subscription",
28-
"queueName": "AlertSubscriptions"
29-
},
30-
{
31-
"type": "queue",
32-
"direction": "out",
33-
"name": "gradientqueue",
34-
"queueName": "billqueue"
35-
},
36-
{
37-
"type": "queue",
38-
"direction": "out",
39-
"name": "alertqueue",
40-
"queueName": "alertqueue"
41-
},
42-
{
43-
"type": "queue",
44-
"direction": "out",
45-
"name": "incidentqueue",
46-
"queueName": "incidentqueue"
47-
},
48-
{
49-
"type": "queue",
50-
"direction": "out",
51-
"name": "offboardingmailbox",
52-
"queueName": "offboardingmailbox"
53-
},
5425
{
5526
"name": "starter",
5627
"type": "durableClient",

‎Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ function Add-CIPPAzDataTableEntity {
229229
throw "Error processing entity: $ErrorMessage Linenumber: $($_.InvocationInfo.ScriptLineNumber)"
230230
}
231231
} else {
232-
Write-Information ($_.Exception | ConvertTo-Json)
232+
try { Write-Information ($_.Exception | ConvertTo-Json) } catch { Write-Information $_.Exception }
233233
Write-Information "THE ERROR IS $($_.Exception.message). The size of the entity is $entitySize."
234234
Write-Information "Parameters are: $($Parameters | ConvertTo-Json -Compress)"
235235
Write-Information $_.InvocationInfo.PositionMessage

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogBundleProcessing.ps1‎

Lines changed: 0 additions & 42 deletions
This file was deleted.

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Webhooks/Push-AuditLogSearchCreation.ps1‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
function Push-AuditLogSearchCreation {
2+
<#
3+
.FUNCTIONALITY
4+
Entrypoint
5+
#>
6+
[CmdletBinding(SupportsShouldProcess = $true)]
7+
param($Item)
8+
9+
# Get params from batch item
10+
$Tenant = $Item.Tenant
11+
$StartTime = $Item.StartTime
12+
$EndTime = $Item.EndTime
13+
$ServiceFilters = @($Item.ServiceFilters)
14+
15+
try {
16+
$LogSearch = @{
17+
StartTime = $StartTime
18+
EndTime = $EndTime
19+
ServiceFilters = $ServiceFilters
20+
TenantFilter = $Tenant.defaultDomainName
21+
ProcessLogs = $true
22+
RecordTypeFilters = @(
23+
'exchangeAdmin', 'azureActiveDirectory', 'azureActiveDirectoryAccountLogon', 'dataCenterSecurityCmdlet',
24+
'complianceDLPSharePoint', 'complianceDLPExchange', 'azureActiveDirectoryStsLogon', 'skypeForBusinessPSTNUsage',
25+
'skypeForBusinessUsersBlocked', 'securityComplianceCenterEOPCmdlet', 'microsoftFlow', 'aeD', 'microsoftStream',
26+
'threatFinder', 'project', 'dataGovernance', 'securityComplianceAlerts', 'threatIntelligenceUrl',
27+
'securityComplianceInsights', 'mipLabel', 'workplaceAnalytics', 'powerAppsApp', 'powerAppsPlan',
28+
'threatIntelligenceAtpContent', 'labelContentExplorer', 'hygieneEvent',
29+
'dataInsightsRestApiAudit', 'informationBarrierPolicyApplication', 'microsoftTeamsAdmin', 'hrSignal',
30+
'informationWorkerProtection', 'campaign', 'dlpEndpoint', 'airInvestigation', 'quarantine', 'microsoftForms',
31+
'applicationAudit', 'complianceSupervisionExchange', 'customerKeyServiceEncryption', 'officeNative',
32+
'mipAutoLabelSharePointItem', 'mipAutoLabelSharePointPolicyLocation', 'secureScore',
33+
'mipAutoLabelExchangeItem', 'cortanaBriefing', 'search', 'wdatpAlerts', 'powerPlatformAdminDlp',
34+
'powerPlatformAdminEnvironment', 'mdatpAudit', 'sensitivityLabelPolicyMatch', 'sensitivityLabelAction',
35+
'sensitivityLabeledFileAction', 'attackSim', 'airManualInvestigation', 'securityComplianceRBAC', 'userTraining',
36+
'airAdminActionInvestigation', 'mstic', 'physicalBadgingSignal', 'aipDiscover', 'aipSensitivityLabelAction',
37+
'aipProtectionAction', 'aipFileDeleted', 'aipHeartBeat', 'mcasAlerts', 'onPremisesFileShareScannerDlp',
38+
'onPremisesSharePointScannerDlp', 'exchangeSearch', 'privacyDataMinimization', 'labelAnalyticsAggregate',
39+
'myAnalyticsSettings', 'securityComplianceUserChange', 'complianceDLPExchangeClassification',
40+
'complianceDLPEndpoint', 'mipExactDataMatch', 'msdeResponseActions', 'msdeGeneralSettings', 'msdeIndicatorsSettings',
41+
'ms365DCustomDetection', 'msdeRolesSettings', 'mapgAlerts', 'mapgPolicy', 'mapgRemediation',
42+
'privacyRemediationAction', 'privacyDigestEmail', 'mipAutoLabelSimulationProgress', 'mipAutoLabelSimulationCompletion',
43+
'mipAutoLabelProgressFeedback', 'dlpSensitiveInformationType', 'mipAutoLabelSimulationStatistics',
44+
'largeContentMetadata', 'microsoft365Group', 'cdpMlInferencingResult', 'filteringMailMetadata',
45+
'cdpClassificationMailItem', 'cdpClassificationDocument', 'officeScriptsRunAction', 'filteringPostMailDeliveryAction',
46+
'cdpUnifiedFeedback', 'tenantAllowBlockList', 'consumptionResource', 'healthcareSignal', 'dlpImportResult',
47+
'cdpCompliancePolicyExecution', 'multiStageDisposition', 'privacyDataMatch', 'filteringDocMetadata',
48+
'filteringEmailFeatures', 'powerBIDlp', 'filteringUrlInfo', 'filteringAttachmentInfo', 'coreReportingSettings',
49+
'complianceConnector', 'powerPlatformLockboxResourceAccessRequest', 'powerPlatformLockboxResourceCommand',
50+
'cdpPredictiveCodingLabel', 'cdpCompliancePolicyUserFeedback', 'webpageActivityEndpoint', 'omePortal',
51+
'cmImprovementActionChange', 'filteringUrlClick', 'mipLabelAnalyticsAuditRecord', 'filteringEntityEvent',
52+
'filteringRuleHits', 'filteringMailSubmission', 'labelExplorer', 'microsoftManagedServicePlatform',
53+
'powerPlatformServiceActivity', 'scorePlatformGenericAuditRecord', 'filteringTimeTravelDocMetadata', 'alert',
54+
'alertStatus', 'alertIncident', 'incidentStatus', 'case', 'caseInvestigation', 'recordsManagement',
55+
'privacyRemediation', 'dataShareOperation', 'cdpDlpSensitive', 'ehrConnector', 'filteringMailGradingResult',
56+
'microsoftTodoAudit', 'timeTravelFilteringDocMetadata', 'microsoftDefenderForIdentityAudit',
57+
'supervisoryReviewDayXInsight', 'defenderExpertsforXDRAdmin', 'cdpEdgeBlockedMessage', 'hostedRpa',
58+
'cdpContentExplorerAggregateRecord', 'cdpHygieneAttachmentInfo', 'cdpHygieneSummary', 'cdpPostMailDeliveryAction',
59+
'cdpEmailFeatures', 'cdpHygieneUrlInfo', 'cdpUrlClick', 'cdpPackageManagerHygieneEvent', 'filteringDocScan',
60+
'timeTravelFilteringDocScan', 'mapgOnboard'
61+
)
62+
}
63+
if ($PSCmdlet.ShouldProcess('Push-AuditLogSearchCreation', 'Creating Audit Log Search')) {
64+
$NewSearch = New-CippAuditLogSearch @LogSearch
65+
Write-Information "Created audit log search $($Tenant.defaultDomainName) - $($NewSearch.displayName)"
66+
}
67+
} catch {
68+
Write-Information "Error creating audit log search $($Tenant.defaultDomainName) - $($_.Exception.Message)"
69+
Write-Information $_.InvocationInfo.PositionMessage
70+
}
71+
return $true
72+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,22 @@ function New-CippCoreRequest {
1313
param($Request, $TriggerMetadata)
1414

1515
$FunctionName = 'Invoke-{0}' -f $Request.Params.CIPPEndpoint
16-
Write-Information "API: $($Request.Params.CIPPEndpoint)"
16+
Write-Information "API Endpoint: $($Request.Params.CIPPEndpoint) | Frontend Version: $($Request.Headers.'X-CIPP-Version' ?? 'Not specified')"
17+
18+
if ($Request.Headers.'X-CIPP-Version') {
19+
$Table = Get-CippTable -tablename 'Version'
20+
$FrontendVer = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Version' and RowKey eq 'frontend'"
21+
22+
if (!$FrontendVer -or ([semver]$FrontendVer.Version -lt [semver]$Request.Headers.'X-CIPP-Version')) {
23+
Add-CIPPAzDataTableEntity @Table -Entity ([pscustomobject]@{
24+
PartitionKey = 'Version'
25+
RowKey = 'frontend'
26+
Version = $Request.Headers.'X-CIPP-Version'
27+
}) -Force
28+
} elseif ([semver]$FrontendVer.Version -gt [semver]$Request.Headers.'X-CIPP-Version') {
29+
Write-Warning "Client version $($Request.Headers.'X-CIPP-Version') is older than the current frontend version $($FrontendVer.Version)"
30+
}
31+
}
1732

1833
$HttpTrigger = @{
1934
Request = [pscustomobject]($Request)

‎Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1‎

Lines changed: 19 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ function Start-AuditLogSearchCreation {
2929

3030
Write-Information 'Audit Logs: Creating new searches'
3131

32-
foreach ($Tenant in $TenantList) {
32+
$Batch = foreach ($Tenant in $TenantList) {
3333
Write-Information "Processing tenant $($Tenant.defaultDomainName) - $($Tenant.customerId)"
3434
$TenantInConfig = $false
3535
$MatchingConfigs = [System.Collections.Generic.List[object]]::new()
@@ -50,64 +50,27 @@ function Start-AuditLogSearchCreation {
5050
}
5151

5252
if ($MatchingConfigs) {
53-
$ServiceFilters = $MatchingConfigs | Select-Object -Property type | Sort-Object -Property type -Unique | ForEach-Object { $_.type.split('.')[1] }
54-
try {
55-
$LogSearch = @{
56-
StartTime = $StartTime
57-
EndTime = $EndTime
58-
ServiceFilters = $ServiceFilters
59-
TenantFilter = $Tenant.defaultDomainName
60-
ProcessLogs = $true
61-
RecordTypeFilters = @(
62-
'exchangeAdmin', 'azureActiveDirectory', 'azureActiveDirectoryAccountLogon', 'dataCenterSecurityCmdlet',
63-
'complianceDLPSharePoint', 'complianceDLPExchange', 'azureActiveDirectoryStsLogon', 'skypeForBusinessPSTNUsage',
64-
'skypeForBusinessUsersBlocked', 'securityComplianceCenterEOPCmdlet', 'microsoftFlow', 'aeD', 'microsoftStream',
65-
'threatFinder', 'project', 'dataGovernance', 'securityComplianceAlerts', 'threatIntelligenceUrl',
66-
'securityComplianceInsights', 'mipLabel', 'workplaceAnalytics', 'powerAppsApp', 'powerAppsPlan',
67-
'threatIntelligenceAtpContent', 'labelContentExplorer', 'hygieneEvent',
68-
'dataInsightsRestApiAudit', 'informationBarrierPolicyApplication', 'microsoftTeamsAdmin', 'hrSignal',
69-
'informationWorkerProtection', 'campaign', 'dlpEndpoint', 'airInvestigation', 'quarantine', 'microsoftForms',
70-
'applicationAudit', 'complianceSupervisionExchange', 'customerKeyServiceEncryption', 'officeNative',
71-
'mipAutoLabelSharePointItem', 'mipAutoLabelSharePointPolicyLocation', 'secureScore',
72-
'mipAutoLabelExchangeItem', 'cortanaBriefing', 'search', 'wdatpAlerts', 'powerPlatformAdminDlp',
73-
'powerPlatformAdminEnvironment', 'mdatpAudit', 'sensitivityLabelPolicyMatch', 'sensitivityLabelAction',
74-
'sensitivityLabeledFileAction', 'attackSim', 'airManualInvestigation', 'securityComplianceRBAC', 'userTraining',
75-
'airAdminActionInvestigation', 'mstic', 'physicalBadgingSignal', 'aipDiscover', 'aipSensitivityLabelAction',
76-
'aipProtectionAction', 'aipFileDeleted', 'aipHeartBeat', 'mcasAlerts', 'onPremisesFileShareScannerDlp',
77-
'onPremisesSharePointScannerDlp', 'exchangeSearch', 'privacyDataMinimization', 'labelAnalyticsAggregate',
78-
'myAnalyticsSettings', 'securityComplianceUserChange', 'complianceDLPExchangeClassification',
79-
'complianceDLPEndpoint', 'mipExactDataMatch', 'msdeResponseActions', 'msdeGeneralSettings', 'msdeIndicatorsSettings',
80-
'ms365DCustomDetection', 'msdeRolesSettings', 'mapgAlerts', 'mapgPolicy', 'mapgRemediation',
81-
'privacyRemediationAction', 'privacyDigestEmail', 'mipAutoLabelSimulationProgress', 'mipAutoLabelSimulationCompletion',
82-
'mipAutoLabelProgressFeedback', 'dlpSensitiveInformationType', 'mipAutoLabelSimulationStatistics',
83-
'largeContentMetadata', 'microsoft365Group', 'cdpMlInferencingResult', 'filteringMailMetadata',
84-
'cdpClassificationMailItem', 'cdpClassificationDocument', 'officeScriptsRunAction', 'filteringPostMailDeliveryAction',
85-
'cdpUnifiedFeedback', 'tenantAllowBlockList', 'consumptionResource', 'healthcareSignal', 'dlpImportResult',
86-
'cdpCompliancePolicyExecution', 'multiStageDisposition', 'privacyDataMatch', 'filteringDocMetadata',
87-
'filteringEmailFeatures', 'powerBIDlp', 'filteringUrlInfo', 'filteringAttachmentInfo', 'coreReportingSettings',
88-
'complianceConnector', 'powerPlatformLockboxResourceAccessRequest', 'powerPlatformLockboxResourceCommand',
89-
'cdpPredictiveCodingLabel', 'cdpCompliancePolicyUserFeedback', 'webpageActivityEndpoint', 'omePortal',
90-
'cmImprovementActionChange', 'filteringUrlClick', 'mipLabelAnalyticsAuditRecord', 'filteringEntityEvent',
91-
'filteringRuleHits', 'filteringMailSubmission', 'labelExplorer', 'microsoftManagedServicePlatform',
92-
'powerPlatformServiceActivity', 'scorePlatformGenericAuditRecord', 'filteringTimeTravelDocMetadata', 'alert',
93-
'alertStatus', 'alertIncident', 'incidentStatus', 'case', 'caseInvestigation', 'recordsManagement',
94-
'privacyRemediation', 'dataShareOperation', 'cdpDlpSensitive', 'ehrConnector', 'filteringMailGradingResult',
95-
'microsoftTodoAudit', 'timeTravelFilteringDocMetadata', 'microsoftDefenderForIdentityAudit',
96-
'supervisoryReviewDayXInsight', 'defenderExpertsforXDRAdmin', 'cdpEdgeBlockedMessage', 'hostedRpa',
97-
'cdpContentExplorerAggregateRecord', 'cdpHygieneAttachmentInfo', 'cdpHygieneSummary', 'cdpPostMailDeliveryAction',
98-
'cdpEmailFeatures', 'cdpHygieneUrlInfo', 'cdpUrlClick', 'cdpPackageManagerHygieneEvent', 'filteringDocScan',
99-
'timeTravelFilteringDocScan', 'mapgOnboard'
100-
)
101-
}
102-
if ($PSCmdlet.ShouldProcess('Start-AuditLogSearchCreation', 'Creating Audit Log Search')) {
103-
$NewSearch = New-CippAuditLogSearch @LogSearch
104-
Write-Information "Created audit log search $($Tenant.defaultDomainName) - $($NewSearch.displayName)"
105-
}
106-
} catch {
107-
Write-Information "Error creating audit log search $($Tenant.defaultDomainName) - $($_.Exception.Message)"
53+
[PSCustomObject]@{
54+
FunctionName = 'AuditLogSearchCreation'
55+
Tenant = $Tenant | Select-Object defaultDomainName, customerId, displayName
56+
StartTime = $StartTime
57+
EndTime = $EndTime
58+
ServiceFilters = @($MatchingConfigs | Select-Object -Property type | Sort-Object -Property type -Unique | ForEach-Object { $_.type.split('.')[1] })
10859
}
10960
}
11061
}
62+
63+
if (($Batch | Measure-Object).Count -gt 0) {
64+
$InputObject = [PSCustomObject]@{
65+
Batch = @($Batch)
66+
OrchestratorName = 'AuditLogSearchCreation'
67+
SkipLog = $true
68+
}
69+
Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
70+
Write-Information "Started Audit Log search creation orchestratorwith $($Batch.Count) tenants"
71+
} else {
72+
Write-Information 'No tenants found for Audit Log search creation'
73+
}
11174
} catch {
11275
Write-LogMessage -API 'Audit Logs' -message 'Error creating audit log searches' -sev Error -LogData (Get-CippException -Exception $_)
11376
Write-Information ( 'Audit logs error {0} line {1} - {2}' -f $_.InvocationInfo.ScriptName, $_.InvocationInfo.ScriptLineNumber, $_.Exception.Message)

‎Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ function Get-CIPPTimerFunctions {
1010

1111
# Check running nodes
1212
$VersionTable = Get-CIPPTable -tablename 'Version'
13-
$Nodes = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version' and RowKey ne 'Version'"
13+
$Nodes = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version' and RowKey ne 'Version' and RowKey ne 'frontend'"
1414

1515
$FunctionName = $env:WEBSITE_SITE_NAME
1616
$MainFunctionVersion = ($Nodes | Where-Object { $_.RowKey -eq $FunctionName }).Version

0 commit comments

Comments
 (0)