AzureScout

3.1.0

manifests/collectors/Security/DefenderAlerts.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Security/DefenderAlerts.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'AZSC/Subscription/SecurityPolicySweep'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    RowSource = @{
        Expression = @'
foreach ($sweep in @($Resources | Where-Object { $_.TYPE -eq 'AZSC/Subscription/SecurityPolicySweep' })) {
            foreach ($alert in @($sweep.PROPERTIES.DefenderAlerts)) {
                $alert | Add-Member -NotePropertyName 'SubscriptionId' -NotePropertyValue $sweep.subscriptionId -Force -PassThru
            }
        }
'@
    }

    Preamble = @'
$ResUCount = 1
                $sub1 = $SUB | Where-Object { (Get-AZSCSafeProperty -InputObject $_ -Path 'Id') -eq (Get-AZSCSafeProperty -InputObject $1 -Path 'SubscriptionId') } | Select-Object -First 1
                $data = $1
 
                # Parse alert details
                $alertName = Get-AZSCSafeProperty -InputObject $data -Path 'AlertDisplayName'
                $alertType = Get-AZSCSafeProperty -InputObject $data -Path 'AlertType'
                $severity = Get-AZSCSafeProperty -InputObject $data -Path 'Severity'
                $status = Get-AZSCSafeProperty -InputObject $data -Path 'Status'
 
                # Get affected resources
                $affectedResources = if (Get-AZSCSafeProperty -InputObject $data -Path 'Entities') {
                    (Get-AZSCSafeProperty -InputObject $data -Path 'Entities' -Enumerate | Where-Object { (Get-AZSCSafeProperty -InputObject $_ -Path 'Type') -eq 'azure-resource' } | ForEach-Object {
                        $resourceId = Get-AZSCSafeProperty -InputObject $_ -Path 'ResourceId'
                        if ($resourceId) { ($resourceId -split '/')[-1] }
                    } | Where-Object { $_ }) -join ', '
                } else { 'N/A' }
 
                if ([string]::IsNullOrEmpty($affectedResources)) {
                    $affectedResources = 'Subscription-level'
                }
 
                # Get resource group
                $resourceGroup = if (Get-AZSCSafeProperty -InputObject $data -Path 'ResourceIdentifiers.ResourceGroup') {
                    Get-AZSCSafeProperty -InputObject $data -Path 'ResourceIdentifiers.ResourceGroup'
                } else { 'N/A' }
 
                # Get alert time
                $alertTimeValue = Get-AZSCSafeProperty -InputObject $data -Path 'TimeGeneratedUtc'
                $alertTime = if ($alertTimeValue) {
                    $alertTimeValue.ToString('yyyy-MM-dd HH:mm:ss')
                } else { 'N/A' }
 
                # Get description and remediation
                $description = if (Get-AZSCSafeProperty -InputObject $data -Path 'Description') { Get-AZSCSafeProperty -InputObject $data -Path 'Description' } else { 'See Azure Portal' }
                $remediationStepsValue = Get-AZSCSafeProperty -InputObject $data -Path 'RemediationSteps'
                $remediationSteps = if ($remediationStepsValue) {
                    ($remediationStepsValue -join '; ')
                } else { 'See Azure Portal for recommended actions' }
 
                # Get intent and tactics (MITRE ATT&CK)
                $intent = if (Get-AZSCSafeProperty -InputObject $data -Path 'Intent') { Get-AZSCSafeProperty -InputObject $data -Path 'Intent' } else { 'Unknown' }
                $tacticsValue = Get-AZSCSafeProperty -InputObject $data -Path 'ExtendedProperties.Tactics'
                $tactics = if ($tacticsValue) {
                    $tacticsValue -join ', '
                } else { 'N/A' }
'@

    AdditionalRowLoops = @()

    TagLoop = $null

    Fields = @(
        @{
            Name = 'ID'
            Expression = 'Get-AZSCSafeProperty -InputObject $1 -Path ''Name'''
        }
        @{
            Name = 'Subscription'
            Expression = 'Get-AZSCSafeProperty -InputObject $sub1 -Path ''Name'''
        }
        @{
            Name = 'Alert Name'
            Expression = '$alertName'
        }
        @{
            Name = 'Alert Type'
            Expression = '$alertType'
        }
        @{
            Name = 'Severity'
            Expression = '$severity'
        }
        @{
            Name = 'Status'
            Expression = '$status'
        }
        @{
            Name = 'Time Generated (UTC)'
            Expression = '$alertTime'
        }
        @{
            Name = 'Resource Group'
            Expression = '$resourceGroup'
        }
        @{
            Name = 'Affected Resources'
            Expression = '$affectedResources'
        }
        @{
            Name = 'Description'
            Expression = '$description'
        }
        @{
            Name = 'Intent'
            Expression = '$intent'
        }
        @{
            Name = 'Tactics (MITRE ATT&CK)'
            Expression = '$tactics'
        }
        @{
            Name = 'Remediation Steps'
            Expression = '$remediationSteps'
        }
        @{
            Name = 'Confidence Level'
            Expression = 'if (Get-AZSCSafeProperty -InputObject $data -Path ''ConfidenceLevel'') { Get-AZSCSafeProperty -InputObject $data -Path ''ConfidenceLevel'' } else { ''N/A'' }'
        }
        @{
            Name = 'Portal Link'
            Expression = '"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0"'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
    )

    Export = @{
        WorksheetName = 'Defender Alerts'
        TableNamePrefix = 'DefenderAlertTable_'
        Columns = @(
            'Subscription'
            'Alert Name'
            'Alert Type'
            'Severity'
            'Status'
            'Time Generated (UTC)'
            'Resource Group'
            'Affected Resources'
            'Description'
            'Intent'
            'Tactics (MITRE ATT&CK)'
            'Remediation Steps'
            'Confidence Level'
            'Portal Link'
            'Resource U'
        )
        TagColumns = @()
        TagColumnsBefore = $null
        NumberFormat = '0'
        ConditionalText = @(
            'New-ConditionalText -Text ''High'' -BackgroundColor ''#FFC7CE'' -ConditionalTextColor ''#9C0006'''
            'New-ConditionalText -Text ''Active'' -BackgroundColor ''#FFEB9C'' -ConditionalTextColor ''#9C6500'''
        )
    }

    SourceCollector = 'Modules/Public/InventoryModules/Security/DefenderAlerts.ps1'
}