-
Notifications
You must be signed in to change notification settings - Fork 2.9k
/
EnrichAuditEvents_Func.ps1
82 lines (60 loc) · 3.01 KB
/
EnrichAuditEvents_Func.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
#Purpose: This is to create a nested parameterized function called EnrichAuditEvents_Func in the Log Analytics workspace.
# This function accepts table records from the SecurityEvent table and will invoke another function (AuditEventDataLookup_Func) to perform enrichment.
#Sample Usage: let AuditEvents = (SecurityEvent | where EventID == 4719); EnrichAuditEvents_Func(AuditEvents)
#Date: 23 Sept 2020
#Setup Variables
$ResourceGroup = "<ResourceGroup>"
$WorkspaceName = "<WorkspaceName>"
$SubscriptionID = "<SubscriptionID>"
#Setup the environment
$workspaceid = "https://management.azure.com/subscriptions/${SubscriptionID}/resourceGroups/${ResourceGroup}/providers/Microsoft.OperationalInsights/workspaces/${WorkspaceName}"
#Connect to your workspace
Clear-AzContext -force
Connect-AzAccount
Get-AzSubscription
Select-AzSubscription -SubscriptionId $SubscriptionID
#Create the Parameter Function
$Query = @"
Tbl
| extend Category = AuditEventDataLookup_Func(CategoryId)
| extend SubCategory = AuditEventDataLookup_Func(SubcategoryId)
| extend AuditPolicyChangesParse = parse_csv(AuditPolicyChanges)
| extend AuditPolicyChange = trim_end(",", strcat(AuditEventDataLookup_Func(AuditPolicyChangesParse[0]) ,",",AuditEventDataLookup_Func(trim(" ",tostring(AuditPolicyChangesParse[1])))))
| project TimeGenerated, Computer, Activity, Category, SubCategory, AuditPolicyChange
"@
[PSCustomObject]$body = @{
"properties" = @{
"Category" = "Function"
"DisplayName" = "EnrichAuditEvents_Func"
"FunctionAlias" = "EnrichAuditEvents_Func"
"FunctionParameters" = "Tbl:(TimeGenerated:datetime, Computer:string,Activity:string,CategoryId:string,SubcategoryId:string,AuditPolicyChanges:string)"
"Query" = $Query
}
}
#Get auth token
#$token = Get-AzCachedAccessToken
$azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile
if (-not $azProfile.Accounts.Count) {
Write-Error "Ensure you have logged in (Connect-AzAccount) before calling this function."
}
$currentAzureContext = Get-AzContext
$profileClient = New-Object Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient($azProfile)
Write-Output ("Getting access token for tenant" + $currentAzureContext.Subscription.TenantId)
$token = $profileClient.AcquireAccessToken($currentAzureContext.Subscription.TenantId)
#Build the API header with the auth token
$authHeader = @{
'Content-Type'='application/json'
'Authorization'='Bearer ' + $token.AccessToken
}
#Invoke WebRequest
try{
$uri = "${workspaceId}/savedSearches/$((New-Guid).Guid)?api-version=2020-08-01"
$result = Invoke-WebRequest -Uri $uri -Method Put -Headers $authHeader -Body($body | ConvertTo-Json -Depth 10)
Write-Output "Successfully created function: $($DisplayName) with status: $($result.StatusDescription)"
Write-Output ($body.properties | Format-Table)
Write-Output $result.Content
}
catch {
Write-Verbose $_
Write-Error "Unable to invoke webrequest with error message: $($_.Exception.Message)" -ErrorAction Stop
}