M365SL.AppExpirationMon.PB.PA

M365SL.AppExpirationMon.PB.PA (ProbeActionModuleType)

Designed to leverage a Posh script PA for retrieving properties/metrics.

Element properties:

Member Modules:

Overrideable Parameters:

Source Code:

<ProbeActionModuleType ID="M365SL.AppExpirationMon.PB.PA" Accessibility="Internal" Batching="false" PassThrough="false" RunAs="M365SL.RunAs.Profile">

  <Configuration>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="ApiTokenScopeURL" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="ApiTokenURL" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="ApiURL" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="M365_AccountName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="M365_AccountPassword" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="M365_ClientID" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="M365_ClientSecret" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="EventIDFilter" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="PoshLibraryPath" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="ProbeActionTimeoutSeconds" type="xsd:integer"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="TenantName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="TLSVersion" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="WorkflowName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="WriteToEventLog" type="xsd:boolean"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="EventIDFilter" Selector="$Config/EventIDFilter$" ParameterType="string"/>

    <OverrideableParameter ID="PoshLibraryPath" Selector="$Config/PoshLibraryPath$" ParameterType="string"/>

    <OverrideableParameter ID="ProbeActionTimeoutSeconds" Selector="$Config/ProbeActionTimeoutSeconds$" ParameterType="int"/>

    <OverrideableParameter ID="WorkflowName" Selector="$Config/WorkflowName$" ParameterType="string"/>

    <OverrideableParameter ID="WriteToEventLog" Selector="$Config/WriteToEventLog$" ParameterType="bool"/>

  </OverrideableParameters>

  <ModuleImplementation Isolation="Any">

    <Composite>

      <MemberModules>

        <ProbeAction ID="POSH" TypeID="Windows!Microsoft.Windows.PowerShellPropertyBagProbe">

          <ScriptName>M365SL.ApplicationExpirationMon.ps1</ScriptName>

          <ScriptBody><Script>&lt;#

    #===============================================================================================================================================================

    Created by:       Tyson Paul, Taylour Blackwell

    Filename:         M365SL.ApplicationExpirationMon.ps1

    Description:      This will calculate days until expiration for application secrets.



    Version History:

    2020.11.17.2051 - Added API Url params

    2020.11.04.1938 - v1



    Requirements:     Must have an Azure application registered and have the following:

    ClientID &amp; Application Secret



    ===============================================================================================================================================================

#&gt;



Param(

  [string]$ApiTokenScopeURL,

  [string]$ApiTokenURL,

  [string]$ApiURL,



  [string]$M365_AccountName,

  [string]$M365_AccountPassword,



  # Azure Application auth

  [string]$M365_ClientID,

  [string]$M365_ClientSecret,



  # Comma-separated list of event IDs, script will only write to log for these EventIDs. This is a way to only write specific events. Only valid if $WriteToEventLog parameter is 'true'.

  [string]$EventIDFilter,



  # Comma-separated list of .ps1 files to load

  [string]$PoshLibraryPath, 

  

  # This is a clever way to utilize the exact same script for both rule/mon and agent tasks.

  [Parameter(Mandatory=$false, 

      ValueFromPipeline=$false,

      ValueFromPipelineByPropertyName=$false, 

  ValueFromRemainingArguments=$false)]

  [ValidateSet('PropertyBag', 'Serialized')]

  [string]$ScriptOutputType = 'PropertyBag',

  

  # Azure tenant

  [string]$TenantName,



  [string]$TLSVersion,

    

  # Typically this is the name of the workflow calling this script. Should be set to the name of the probe/WA if being used by both rules/mons so as not to break cookdown. 

  # Keep in mind that datasource params need to be identical for cookdown to work.

  [string]$WorkflowName,

  

  # type:string. SCOM bool params are different than Posh bool. Will get converted to Posh bool below.

  [string]$WriteToEventLog = 'false'

)



# Set defaults for event filters. Apparently setting this in the Params declaration did not work.

If (-NOT $EventIDFilter) {

  $EventIDFilter = "9990,9991,9992,9995,9996,9997,9998,9999"

}



$ScriptName = 'M365SL.ApplicationExpirationMon.ps1'

$NameSpace = 'Library'

[bool]$WriteToEventLog = [System.Convert]::ToBoolean($WriteToEventLog)

$Testing = $false



######################### FUNCTIONS ############################

################################################################

Function Load-Library {

  Param (

    [string]$PoshLibraryPath

  )

  $ErrorActionPreference = 'STOP'

  If ($PoshLibraryPath ){

    ForEach ($Path in $PoshLibraryPath.Split(',') ){

      Try {

        If (($Path.Length) -AND ($Path -notmatch '^-1$')) {

          . $Path

        }

      } Catch {

        Write-Host "Line [$($MyInvocation.ScriptLineNumber )]: Error loading PoshLibrary at path:[$($Path)]. This is likely to cause many other dependent functions to fail. `n`nError data: $($_)`n`n" 

      }

    }

  }

  $ErrorActionPreference = 'CONTINUE'

}

################################################################



############## TESTING ##############

  &lt;# #Run this as needed when testing



    Function Testing {

    $Testing = $true

    Get-Item Alias:\_LINE_  -ErrorAction Ignore | Remove-Item -ErrorAction Ignore

    $testParamsFile = (Join-path $TestFolder ("PARAMS_$($ScriptName)"))

    #Write-Host "$(Test-Path $testParamsFile):$($testParamsFile)" -F Yellow -B Green

    . $testParamsFile

    . Load-Library -PoshLibraryPath $PoshLibraryPath



    # Encode user data/passwords in current test user context

    $M365_ClientSecret = Encode-UserData $M365_ClientSecret_PLAINTEXT

    $M365_AccountPassword = Encode-UserData $M365_AccountPassword_PLAINTEXT

    $error.Clear()

    }

  

    $TestFolder = "C:\Test\M365SMP_Dev\$($NameSpace)\TestSetup"

    If (Test-Path -Path $TestFolder) {

    . Testing

    }



#&gt;

############## TESTING ##############





. Load-Library -PoshLibraryPath $PoshLibraryPath

LogIt -EventID 9990 -Type $info -Msg "Begin script..." -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()



# Set up BasicBag with defaults

$bag = New-Object -TypeName BasicBag

$bag.AddValue('Category',"AppExpiration")

$bag.AddValue('Message',"")

$bag.AddValue('Result',"FAILURE") #default, unless the tests succeed



$bag.AddValue('ThisScriptInstanceGUID',"$ThisScriptInstanceGUID")

$bag.AddValue('Whoami',"$whoami")

$bag.AddValue('M365_ClientID',"$M365_ClientID")

$bag.AddValue('M365_AccountName',"$M365_AccountName")

$bag.AddValue('TenantName',"$TenantName")

$bag.AddValue('Expirations',"")

$bag.AddValue('NearestExpirationDays',[double]0)



LogIt -EventID 9992 -Type $info -msg "Setting TLS for session, Version: [$($TLSVersion)]." -Proceed $WriteToEventLog -Line $(_LINE_); $Error.Clear();

#Set Default TLS

. Set-TLS -TLSVersion $TLSVersion





# Decode Account Password

LogIt -EventID 9992 -Type $info -Msg "Decode password..." -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()

Try {

  $M365_AccountPassword_DECRYPTED = Decode-UserData -Data $M365_AccountPassword

} Catch {

  $Message = " Unable to decode password.  Error: $($Error[0] | Out-String -Stream)"

  LogIt -EventID 9995 -Type $warn -Msg $Message -Proceed $true -LINE $(_LINE_); $Error.Clear()

  $bag.Message += " $Message"

}



# Decode Client Secret

LogIt -EventID 9992 -Type $info -Msg "Decode ClientSecret..." -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()

Try {

  $M365_ClientSecret_DECRYPTED = Decode-UserData -Data $M365_ClientSecret

} Catch {

  $Message = " Unable to decode ClientSecret.  Error: $($Error[0] | Out-String -Stream)"

  LogIt -EventID 9995 -Type $warn -Msg $Message -Proceed $true -LINE $(_LINE_); $Error.Clear()

  $bag.Message += " $Message"

}



# Get Access Token

Try {

  $TokenResponse = Get-AccessToken -Delegated -User $M365_AccountName -Pass $M365_AccountPassword_DECRYPTED -ClientID $M365_ClientID -ClientSecret $M365_ClientSecret_DECRYPTED -TenantName $TenantName -ApiTokenUrl $ApiTokenURL -ApiTokenScopeURL $ApiTokenScopeURL

} Catch {

  $Message = " Unable to retrieve Access Token. Error: $($Error[0] | Out-String -Stream)"

  LogIt -EventID 9997 -Type $warn -Msg $Message -Proceed $true -LINE $(_LINE_); $Error.Clear()

  $bag.Message += " $Message"

  #Output $bag -Tag 'TokenFailure'

  Exit  

}





$Activity = "attempt to get applications from tenant [$($TenantName)]."

LogIt -EventID 9992 -Type $info -Msg $Activity -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()

Try {

  $GetIDApiURL = "$($ApiURL)/v1.0/applications"

  $Results = @(Invoke-RestMethod -Headers @{Authorization = "Bearer $($Tokenresponse.access_token)"} -Uri $GetIDApiURL -Method Get -ContentType 'application/json' -ErrorAction Stop)

  $Message = "Successful $Activity."

  LogIt -EventID 9992 -Type $info -Msg $Message -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()

} Catch {

  $Message = "Failed $Activity. Error: $($Error[0] | Out-String -Stream)"

  LogIt -EventID 9992 -Type $info -Msg $Message -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()

}

$bag.Message = $Message



If ($Results) {

  $Secrets = $Results.value.passwordcredentials

  $arrExpirations = New-Object -TypeName System.Collections.ArrayList

  ForEach ($Secret in $Secrets) {

    $SecretExpiration = $Secret.enddatetime

    $Span = [int]((New-Timespan -Start $(Get-Date) -End $SecretExpiration).Days)

    $NULL = $arrExpirations.Add($Span)

    $bag.Expirations += "$($Secret.displayName):$($Secret.KeyId)($($Span) Days Remain), "

  }



  $bag.Expirations = $bag.Expirations.Trim(', ')

  $bag.NearestExpirationDays = ([double](($arrExpirations | Measure-Object -Minimum).Minimum))

  $bag.Result = 'SUCCESS'

}



Output $bag

LogIt -EventID 9991 -Type $info -Msg "End script." -Proceed $WriteToEventLog -LINE $(_LINE_); $Error.Clear()</Script></ScriptBody>

          <Parameters>

            <Parameter>

              <Name>ApiTokenScopeURL</Name>

              <Value>$Config/ApiTokenScopeURL$</Value>

            </Parameter>

            <Parameter>

              <Name>ApiTokenURL</Name>

              <Value>$Config/ApiTokenURL$</Value>

            </Parameter>

            <Parameter>

              <Name>ApiURL</Name>

              <Value>$Config/ApiURL$</Value>

            </Parameter>

            <Parameter>

              <Name>M365_AccountName</Name>

              <Value>$Config/M365_AccountName$</Value>

            </Parameter>

            <Parameter>

              <Name>M365_AccountPassword</Name>

              <Value>$Config/M365_AccountPassword$</Value>

            </Parameter>

            <Parameter>

              <Name>M365_ClientID</Name>

              <Value>$Config/M365_ClientID$</Value>

            </Parameter>

            <Parameter>

              <Name>M365_ClientSecret</Name>

              <Value>$Config/M365_ClientSecret$</Value>

            </Parameter>

            <Parameter>

              <Name>EventIDFilter</Name>

              <Value>$Config/EventIDFilter$</Value>

            </Parameter>

            <Parameter>

              <Name>PoshLibraryPath</Name>

              <Value>$FileResource[Name='Res.M365SL.M365Library.ps1.Resource']/Path$,$Config/PoshLibraryPath$</Value>

            </Parameter>

            <Parameter>

              <Name>ScriptOutputType</Name>

              <Value>PropertyBag</Value>

            </Parameter>

            <Parameter>

              <Name>TenantName</Name>

              <Value>$Config/TenantName$</Value>

            </Parameter>

            <Parameter>

              <Name>TLSVersion</Name>

              <Value>$Config/TLSVersion$</Value>

            </Parameter>

            <Parameter>

              <Name>WorkflowName</Name>

              <Value>M365SL.AppExpirationMon.PB.PA_($Config/WorkflowName$)</Value>

            </Parameter>

            <Parameter>

              <Name>WriteToEventLog</Name>

              <Value>$Config/WriteToEventLog$</Value>

            </Parameter>

          </Parameters>

          <TimeoutSeconds>$Config/ProbeActionTimeoutSeconds$</TimeoutSeconds>

        </ProbeAction>

      </MemberModules>

      <Composition>

        <Node ID="POSH"/>

      </Composition>

    </Composite>

  </ModuleImplementation>

  <OutputType>System!System.PropertyBagData</OutputType>

  <InputType>System!System.BaseData</InputType>

</ProbeActionModuleType>