Distributed Application Discovery Data Source

Microsoft.AdvancedThreatAnalytics.1_7.DistributedApplication.Discovery.DataSource (DataSourceModuleType)

Data Source for Microsoft ATA 1.7 Distributed Application Discovery

Element properties:

Member Modules:

Overrideable Parameters:

Source Code:

<DataSourceModuleType ID="Microsoft.AdvancedThreatAnalytics.1_7.DistributedApplication.Discovery.DataSource" Accessibility="Internal" Batching="false">

  <Configuration>

    <IncludeSchemaTypes>

      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>

    </IncludeSchemaTypes>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="IntervalSeconds" type="xsd:integer"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="IntervalSeconds" ParameterType="int" Selector="$Config/IntervalSeconds$"/>

  </OverrideableParameters>

  <ModuleImplementation Isolation="Any">

    <Composite>

      <MemberModules>

        <DataSource ID="Scheduler" TypeID="System!System.Discovery.Scheduler">

          <Scheduler>

            <SimpleReccuringSchedule>

              <Interval Unit="Seconds">$Config/IntervalSeconds$</Interval>

            </SimpleReccuringSchedule>

            <ExcludeDates/>

          </Scheduler>

        </DataSource>

        <ProbeAction ID="PowerShell" TypeID="Windows!Microsoft.Windows.PowerShellDiscoveryProbe">

          <ScriptName>ATADistributedApplicationDiscovery.ps1</ScriptName>

          <ScriptBody><Script>param($sourceId,$managedEntityId)





$regkey = ((gci 'HKLM:\SOFTWARE\Microsoft\System Center Operations Manager\' -Recurse) | where {$_.Name -like "*PowerShell"}).Name

$regkey = (gci hklm:\$regkey).Name

$poshpath = ((get-itemProperty HKLM:$regkey).InstallDirectory).TrimEnd("\")

Import-Module $poshpath\OperationsManager



$api = New-Object -comObject 'MOM.ScriptAPI'



#Set variables to be used in logging events

$whoami = whoami

$StartTime = Get-Date



#Log an event that our script is starting

$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3280,0,"v1.7-ATA Distributed Application Discovery Script is starting.  Running as $whoami.")

#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3283,0,"v1.7-ATA Distributed Application Discovery Script.  sourceId is $sourceId.")

#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3283,0,"v1.7-ATA Distributed Application Discovery Script.  managedEntityId as $managedEntityId.")



$DiscoveryData = $api.CreateDiscoveryData(0, $sourceId, $managedEntityId)



$CenterClass = Get-SCOMClass -Name Microsoft.AdvancedThreatAnalytics.1_7.Center

$CenterClassInstances = Get-SCOMClassInstance -Class $CenterClass

$StandaloneGatewayClass = Get-SCOMClass -Name Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone

$StandaloneGatewayClassInstances = Get-SCOMClassInstance -Class $StandaloneGatewayClass

$LightWeightGatewayClass = Get-SCOMClass -Name Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight

$LightWeightGatewayClassInstances = Get-SCOMClassInstance -Class $LightWeightGatewayClass



$ContainerInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='ATAL!Microsoft.AdvancedThreatAnalytics.Container']$")

#$DiscoveryData.AddInstance($ContainerInstance)

#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Container Instance is $ContainerInstance")

IF ($ERROR) {$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3284,2,"v1.7-Error is $ERROR")}



IF ($CenterClassInstances) {

    ForEach ($CenterClassInstance in $CenterClassInstances) {

	

	$ADForest = $CenterClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Center].ADForest'.Value

    $ServiceInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Service']$")

	$ServiceInstance.AddProperty("$MPElement[Name='System!System.Entity']/DisplayName$", "ATA 1.7 - $ADForest")

    $ServiceInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Service']/ADForest$", $ADForest)

    $DiscoveryData.AddInstance($ServiceInstance)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3283,0,"v1.7-ATA Distributed Application Discovery Script.  Service Instance Displayname is ATA 1.7 - $ADForest")

   

	$ContainerRelationshipInstance = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service']$")       

    $ContainerRelationshipInstance.Source = $ContainerInstance  

    $ContainerRelationshipInstance.Target = $ServiceInstance            

    $DiscoveryData.AddInstance($ContainerRelationshipInstance)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Container Relationship is $ContainerRelationshipInstance")

	

	$ContainerGWInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway']$")

	$ContainerGWInstance.AddProperty("$MPElement[Name='System!System.Entity']/DisplayName$", "ATA Gateways 1.7 - $ADForest")

    $ContainerGWInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway']/ADForest$", $ADForest)

    $DiscoveryData.AddInstance($ContainerGWInstance)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3283,0,"v1.7-ATA Distributed Application Discovery Script.  Container GW Instance Displayname is ATA Gateways 1.7 - $ADForest")



	$ContainerGWRelationshipInstance = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway']$")       

    $ContainerGWRelationshipInstance.Source = $ServiceInstance  

    $ContainerGWRelationshipInstance.Target = $ContainerGWInstance            

    $DiscoveryData.AddInstance($ContainerGWRelationshipInstance)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Container GW Relationship is $ContainerGWRelationshipInstance")



    $CenterInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Center']$")

    $CenterInstance.AddProperty("$MPElement[Name='Windows!Microsoft.Windows.Computer']/PrincipalName$", $CenterClassInstance.DisplayName)

    $CenterInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Center']/ServerName$", $CenterClassInstance.DisplayName)

	$CenterInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Center']/ServiceIP$", $CenterClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Center].ServiceIP'.Value)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Center Instance is $CenterInstance")



    $ServiceRelationshipInstance = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center']$")       

    $ServiceRelationshipInstance.Source = $ServiceInstance  

    $ServiceRelationshipInstance.Target = $CenterInstance            

    $DiscoveryData.AddInstance($ServiceRelationshipInstance)

	#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Service Relationship is $ServiceRelationshipInstance")



        IF ($StandaloneGatewayClassInstances) {

            ForEach ($StandaloneGatewayClassInstance in $StandaloneGatewayClassInstances) {

                If ($CenterClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Center].ServiceIP'.Value -eq $StandaloneGatewayClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Gateway].ServiceProxyServicePrimaryDnsEndpointAddress'.Value) {



                $StandaloneGatewayInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone']$")

                $StandaloneGatewayInstance.AddProperty("$MPElement[Name='Windows!Microsoft.Windows.Computer']/PrincipalName$", $StandaloneGatewayClassInstance.DisplayName)

                $StandaloneGatewayInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway']/ServerName$", $StandaloneGatewayClassInstance.Name)

				# $StandaloneGatewayInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway']/SystemProfileId$", $StandaloneGatewayClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Gateway].SystemProfileId'.Value)

				#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Standalone Gateway is $StandaloneGatewayInstance.") 



				$GWRelationshipInstance = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone']$")

                $GWRelationshipInstance.Source = $ContainerGWInstance 

                $GWRelationshipInstance.Target = $StandaloneGatewayInstance

                $DiscoveryData.AddInstance($GWRelationshipInstance)

				#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  GW Relationship Instance is $GWRelationshipInstance.") 

                }

            }

        }



		IF ($LightWeightGatewayClassInstances) {

            ForEach ($LightWeightGatewayClassInstance in $LightWeightGatewayClassInstances) {

                If ($CenterClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Center].ServiceIP'.Value -eq $LightWeightGatewayClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Gateway].ServiceProxyServicePrimaryDnsEndpointAddress'.Value) {



                $LightWeightGatewayInstance = $DiscoveryData.CreateClassInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight']$")

                $LightWeightGatewayInstance.AddProperty("$MPElement[Name='Windows!Microsoft.Windows.Computer']/PrincipalName$", $LightWeightGatewayClassInstance.DisplayName)

                $LightWeightGatewayInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway']/ServerName$", $LightWeightGatewayClassInstance.Name)

				# $LightWeightGatewayInstance.AddProperty("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Gateway']/SystemProfileId$", $LightWeightGatewayClassInstance.'[Microsoft.AdvancedThreatAnalytics.1_7.Gateway].SystemProfileId'.Value)

				#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  LightWeight Gateway is $LightWeightGatewayInstance.") 



                $GWRelationshipInstance = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight']$")

                $GWRelationshipInstance.Source = $ContainerGWInstance 

                $GWRelationshipInstance.Target = $LightWeightGatewayInstance

                $DiscoveryData.AddInstance($GWRelationshipInstance)

				#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  GW Relationship Instance is $GWRelationshipInstance.") 

                }

            }

        }



    }

}

IF ($ERROR) {$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3284,2,"v1.7-Error is $ERROR")}



$DiscoveryData

#$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3282,0,"v1.7-ATA Distributed Application Discovery Script.  Discovery Data is $DiscoveryData")



#Log an event for script ending and total execution time.

$EndTime = Get-Date

$ScriptTime = ($EndTime - $StartTime).TotalSeconds

$ScriptTime = ($EndTime - $StartTime).TotalSeconds

$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3281,0,"v1.7-ATA Distributed Application Discovery Script is complete.  Total runtime ($ScriptTime) seconds.")

IF ($ERROR) {$api.LogScriptEvent("ATADistributedApplicationDiscovery.ps1",3284,2,"v1.7-Error is $ERROR")}</Script></ScriptBody>

          <Parameters>

            <Parameter>

              <Name>SourceID</Name>

              <Value>$MPElement$</Value>

            </Parameter>

            <Parameter>

              <Name>ManagedEntityID</Name>

              <Value>$Target/Id$</Value>

            </Parameter>

          </Parameters>

          <TimeoutSeconds>60</TimeoutSeconds>

        </ProbeAction>

      </MemberModules>

      <Composition>

        <Node ID="PowerShell">

          <Node ID="Scheduler"/>

        </Node>

      </Composition>

    </Composite>

  </ModuleImplementation>

  <OutputType>System!System.Discovery.Data</OutputType>

</DataSourceModuleType>