Public/generated/Get-KritTcmSentinelWatchlist.ps1
|
<# ·· × × × ··· SirJ's Deaddrop ··· × × × ··· — If you found this, you were meant to — ---------------- A Seriously Kritical™ Production ---------------- [] → (¯`·.¸¸.·´¯) .·´ `·. [] → `·.______________.·´ | +------------------+ | | | Kritical™ | | | | [] [] | | | | | | | | [] [] [] | | | +------------------+ | (._.·´¯`·.¸_) Your last call. And your first move. ★ ☆ ★ +61 1300 274 655 sales at kritical dot net ----------------------------------------------------------------- .COPYRIGHT (c) 2026 Kritical Pty Ltd. All rights reserved. .AUTHOR Joshua Finley <joshua.finley@kritical.net> .COMPANY Kritical Pty Ltd | ABN 39 687 048 086 Level 4 / 60 Moorabool St Geelong VIC 3220 1300 274 655 | sales@kritical.net | https://kritical.net/ .NOTES HARD RULE 13 canonical Kritical branding — do not overlay other agent banners. Auto-generated by Generate-KritTcmFromM365DscSchema.ps1 (.1507o30+). Upstream reference: Microsoft365DSC by Microsoft (MIT). This shim provides literal search-replace equivalence — see Krit.TCM/generated/index.md. #> function Get-KritTcmSentinelWatchlist { <# .SYNOPSIS Krit.TCM shim for M365DSC resource SentinelWatchlist. .DESCRIPTION Auto-generated from M365DSC .schema.mof by scripts/m365-setup/Generate-KritTcmFromM365DscSchema.ps1 (.1507o30). Search-replace safe: callers that today invoke Get-M365DSCSentinelWatchlist -Credential $cred -TenantId $tid can rename to Get-KritTcmSentinelWatchlist -Credential $cred -TenantId $tid with ZERO other edits. Parameter shape matches the M365DSC .schema.mof exactly. Per operator direction, -PreferM365DscBehavior defaults to true. Actual Graph dispatch is delegated to Invoke-KritTcmM365DscSchemaBridge. Bridge maps resource → Graph endpoint per per-resource wave; where mapping is not yet shipped, bridge returns an object with Verdict='UNMAPPED'. .NOTES Workload: Other Original mof: C:\Users\joshl\OneDrive - Kritical Pty Ltd\Github\KRTPax8ToShopifyConnector\.kritm365-mine\Microsoft365DSC\Modules\Microsoft365DSC\DSCResources\MSFT_SentinelWatchlist\MSFT_SentinelWatchlist.schema.mof Param count: 21 Generator wave: .1507o30 #> [CmdletBinding()] param( # Tha name of the watchlist. [Parameter(Mandatory)] [string]$Name, # The name of the resource group. The name is case insensitive. [string]$SubscriptionId, # The name of the resource group. The name is case insensitive. [string]$ResourceGroupName, # The name of the workspace. [string]$WorkspaceName, # The id (a Guid) of the watchlist [string]$Id, # The display name of the watchlist. [string]$DisplayName, # The source of the watchlist. Only accepts 'Local file' and 'Remote storage'. And it must included in the request. [string]$SourceType, # The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address. [string]$ItemsSearchKey, # A description of the watchlist [string]$Description, # The default duration of a watchlist (in ISO 8601 duration format) [string]$DefaultDuration, # The watchlist alias [string]$Alias, # The number of lines in a csv content to skip before the header [int]$NumberOfLinesToSkip, # The raw content that represents to watchlist items to create. Example : This line will be skipped header1,header2 value1,value2 [string]$RawContent, # Present ensures the instance exists, absent ensures it is removed. [ValidateSet('Absent','Present')] [string]$Ensure, # Credentials of the workload's Admin [string]$Credential, # Id of the Azure Active Directory application to authenticate with. [string]$ApplicationId, # Id of the Azure Active Directory tenant used for authentication. [string]$TenantId, # Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. [string]$CertificateThumbprint, # Username can be made up to anything but password will be used for CertificatePassword [string]$CertificatePassword, # Path to certificate used in service principal usually a PFX file. [string]$CertificatePath, # Managed ID being used for authentication. [bool]$ManagedIdentity ) Invoke-KritTcmM365DscSchemaBridge -ResourceName 'SentinelWatchlist' -Workload 'Other' -Verb 'Get' -CallerParams $PSBoundParameters } |