-
-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy pathSend-AzSentinelLog.ps1
More file actions
73 lines (58 loc) · 2.15 KB
/
Send-AzSentinelLog.ps1
File metadata and controls
73 lines (58 loc) · 2.15 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#Requires -Module OMSIngestionAPI, Microsoft.PowerShell.SecretsManagement
function Send-AzSentinelLog {
param (
[Parameter(Mandatory)]
[string] $Message,
[ValidateSet('Information', 'Verbose', 'Warning', 'Error')]
[string] $Level = 'Information',
[string] $Log = 'PowerShell',
[string] $FunctionName = ((Get-PSCallStack)[0].Command),
[string] $ModuleName = ((Get-PSCallStack)[0].InvocationInfo.MyCommand.ModuleName),
[string] $File = ((Get-PSCallStack)[0].Position.File),
[int] $Line = ((Get-PSCallStack)[0].Position.StartLineNumber)
)
# Additional data "borrowed" from PowershellFrameworkCollective / psframework
# https://github.com/PowershellFrameworkCollective/psframework
Import-Module -Name 'OMSIngestionAPI'
Import-Module -Name 'Microsoft.PowerShell.SecretsManagement'
$WorkspaceId = Get-Secret -Name 'OMS Workspace Id' -AsPlainText
$WorkspaceKey = Get-Secret -Name 'OMS Key' -AsPlainText
$TimeStamp = (Get-Date -Format 'o')
$MessageData = @{
'Message' = $Message
'LogLevel' = $Level
'FunctionName' = $FunctionName
'ModuleName' = $ModuleName
'File' = $File
'Line' = $Line
'TimeStamp' = $TimeStamp
'Computer' = $env:COMPUTERNAME
} | ConvertTo-Json
$OmsSplat = @{
'customerId' = $WorkspaceId
'sharedKey' = $WorkspaceKey
'body' = $MessageData
'logType' = $Log
'TimeStampField' = 'TimeStamp'
}
Send-OMSAPIIngestionFile @OmsSplat
}
#region Scheduled Job
$BlogAddress = 'toastit.dev'
if (Test-Connection -ComputerName $BlogAddress -Count 2 -Quiet) {
$SentinelSplat = @{
Message = 'All OK, blog is online.'
Level = 'Information'
Log = 'BlogCheck'
ModuleName = 'Scheduled Job'
}
} else {
$SentinelSplat = @{
Message = 'Panic stations, blog is OFFLINE!'
Level = 'Error'
Log = 'BlogCheck'
ModuleName = 'Scheduled Job'
}
}
Send-AzSentinelLog @SentinelSplat
#endregion