Get-Indicatior.ps1
|
Function Get-Indicatior { <# .SYNOPSIS Get Defender indicatior. .PARAMETER Token Authorization token. .EXAMPLE $Indicatiors = Get-Indicatior -Token $Token .NOTES Author: Michal Gajda .LINK https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-ti-indicators-collection?view=o365-worldwide #> [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] $Token ) Begin {} Process { $Headers = @{ 'Content-Type' = 'application/json' Accept = 'application/json' Authorization = "Bearer $Token" } $Uri = "https://api.securitycenter.windows.com/api/indicators" $Results = @() while($null -ne $Uri) { $Request = @{ Method = "GET" Uri = $Uri Headers = $Headers ErrorAction = "Stop" } $Response = Invoke-RestMethod @Request $Results += $Response.value $Uri = $Response."@odata.nextLink" } Return $Results } End {} } |