-
-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy pathSend-AzSentinelLog.ps1
More file actions
45 lines (36 loc) · 1.45 KB
/
Send-AzSentinelLog.ps1
File metadata and controls
45 lines (36 loc) · 1.45 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
function Send-AzSentinelLog {
param (
[Parameter(Mandatory)]
[string] $Message,
[ValidateSet('Information', 'Verbose', 'Warning', 'Error')]
[string] $Level = 'Information',
[string] $Log = 'PowerShell',
[string] $FunctionName = ((Get-PSCallStack)[0].Command),
[string] $ModuleName = ((Get-PSCallStack)[0].InvocationInfo.MyCommand.ModuleName),
[string] $File = ((Get-PSCallStack)[0].Position.File),
[int] $Line = ((Get-PSCallStack)[0].Position.StartLineNumber)
)
# Additional data "borrowed" from PowershellFrameworkCollective / psframework
# https://github.com/PowershellFrameworkCollective/psframework
Import-Module -Name 'OMSIngestionAPI'
$OMSCreds = Get-StoredCredential -Target 'OMS'
$TimeStamp = (Get-Date -Format 'o')
$MessageData = @{
'Message' = $Message
'LogLevel' = $Level
'FunctionName' = $FunctionName
'ModuleName' = $ModuleName
'File' = $File
'Line' = $Line
'TimeStamp' = $TimeStamp
'Computer' = $env:COMPUTERNAME
} | ConvertTo-Json
$OmsSplat = @{
'customerId' = $OMSCreds.UserName
'sharedKey' = $OMSCreds.GetNetworkCredential().Password
'body' = $MessageData
'logType' = $Log
'TimeStampField' = 'TimeStamp'
}
Send-OMSAPIIngestionFile @OmsSplat
}