Harden release downloads for TLS failures

docs/ocsentinel-deployment.md

@@ -39,12 +39,21 @@ The installer creates two Windows Scheduled Tasks running as `SYSTEM`:
   `04:00` and `06:59`, derived from its Windows `MachineGuid`. This distributes
   a fleet rollout instead of sending all reports at the same time.
 - `OCSentinel Burst Check`: runs every five minutes. It performs no scan unless
-  the NinjaOne device custom field `ocsentinelburst` is enabled.
+  the NinjaOne device custom field `ocsentinelburst` is enabled. Once enabled,
+  it scans for two hours and then disables itself automatically.
 
 Create `ocsentinelburst` as a device-level `Checkbox` custom field and allow
-automation read access. Set it to `true` for a device to begin the five-minute
-burst scans; clear it to stop them. The normal daily scan continues regardless
-of the checkbox.
+automation read and write access. Set it to `true` for a device to begin the
+five-minute burst scans; clear it to stop them early. The normal daily scan
+continues regardless of the checkbox.
+
+Create these accompanying device custom fields and allow automation write
+access:
+
+| Field name | Type | Purpose |
+| --- | --- | --- |
+| `ocsentinelburstuntilutc` | Date/Time | UTC time at which the active burst ends |
+| `ocsentinelburststatus` | Text | `idle`, `active until ...`, or `completed` |
 
 ## Upload Reliability And Client Health
 

installer/runtime-run-ocsentinel-scheduled.ps1

@@ -1,7 +1,9 @@
 [CmdletBinding()]
 param(
     [ValidateSet("daily", "burst")]
-    [string]$Kind = "daily"
+    [string]$Kind = "daily",
+    [ValidateRange(15, 480)]
+    [int]$BurstDurationMinutes = 120
 )
 
 $ErrorActionPreference = "Stop"
@@ -25,11 +27,71 @@ function Get-NinjaBurstEnabled {
     return $false
 }
 
-if ($Kind -eq "burst" -and -not (Get-NinjaBurstEnabled)) {
+function Get-NinjaValue {
+    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Type)
+
+    try {
+        if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
+            return Get-NinjaProperty -Name $Name -Type $Type
+        }
+        if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
+            return Ninja-Property-Get -Name $Name
+        }
+    }
+    catch {
+        Write-Warning "Could not read Ninja field '$Name': $($_.Exception.Message)"
+    }
+    return $null
+}
+
+function Set-NinjaValue {
+    param([Parameter(Mandatory)][string]$Name, [AllowEmptyString()][string]$Value, [Parameter(Mandatory)][string]$Type)
+
+    try {
+        if (Get-Command -Name "Set-NinjaProperty" -ErrorAction SilentlyContinue) {
+            Set-NinjaProperty -Name $Name -Value $Value -Type $Type -Force | Out-Null
+            return $true
+        }
+        if (Get-Command -Name "Ninja-Property-Set" -ErrorAction SilentlyContinue) {
+            Ninja-Property-Set -Name $Name -Value $Value | Out-Null
+            return $true
+        }
+    }
+    catch {
+        Write-Warning "Could not update Ninja field '$Name': $($_.Exception.Message)"
+    }
+    return $false
+}
+
+if ($Kind -eq "burst") {
+    if (-not (Get-NinjaBurstEnabled)) {
+        Set-NinjaValue -Name "ocsentinelburststatus" -Value "idle" -Type "Text" | Out-Null
         Write-Host "OfficeCom Sentinel burst check: disabled."
         exit 0
     }
 
+    $now = [DateTimeOffset]::UtcNow
+    $untilValue = Get-NinjaValue -Name "ocsentinelburstuntilutc" -Type "DateTime"
+    $until = $null
+    if (-not [string]::IsNullOrWhiteSpace([string]$untilValue)) {
+        try { $until = [DateTimeOffset]$untilValue } catch { Write-Warning "Burst end time is invalid and will be restarted." }
+    }
+
+    if ($null -eq $until) {
+        $until = $now.AddMinutes($BurstDurationMinutes)
+        Set-NinjaValue -Name "ocsentinelburstuntilutc" -Value $until.ToString("o") -Type "DateTime" | Out-Null
+        Write-Host "OfficeCom Sentinel burst window started until $($until.ToString('u'))."
+    }
+    elseif ($until -le $now) {
+        Set-NinjaValue -Name "ocsentinelburst" -Value "false" -Type "Checkbox" | Out-Null
+        Set-NinjaValue -Name "ocsentinelburststatus" -Value "completed" -Type "Text" | Out-Null
+        Write-Host "OfficeCom Sentinel burst window completed and was disabled."
+        exit 0
+    }
+
+    Set-NinjaValue -Name "ocsentinelburststatus" -Value "active until $($until.ToUniversalTime().ToString('o'))" -Type "Text" | Out-Null
+}
+
 $createdNew = $false
 $mutex = [Threading.Mutex]::new($false, $mutexName, [ref]$createdNew)
 try {
@@ -39,7 +101,11 @@ try {
     }
 
     Write-Host "OfficeCom Sentinel scheduled $Kind scan started."
-    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitorScript -Mode status -UploadMode required -SecretPath $secretPath -SuppressTriggerExit
+    $monitorArgs = @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", $monitorScript, "-Mode", "status", "-UploadMode", "required", "-SecretPath", $secretPath, "-SuppressTriggerExit")
+    if ($Kind -eq "burst") {
+        $monitorArgs += @("-LookbackDays", "1", "-TopCount", "25")
+    }
+    & powershell.exe @monitorArgs
     exit $LASTEXITCODE
 }
 finally {

installer/update-ocsentinel.ps1

@@ -7,6 +7,39 @@ param(
 
 $ErrorActionPreference = "Stop"
 
+function Initialize-OCSentinelTls {
+    $protocols = [Net.SecurityProtocolType]::Tls12
+    if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains "Tls13") {
+        $protocols = $protocols -bor [Net.SecurityProtocolType]::Tls13
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = $protocols
+    [Net.ServicePointManager]::Expect100Continue = $false
+}
+
+function Get-OCSentinelManifest {
+    param([Parameter(Mandatory)][string]$Uri)
+
+    $parameters = @{ Method = "Get"; Uri = $Uri; TimeoutSec = 60 }
+    if ((Get-Command Invoke-RestMethod).Parameters.ContainsKey("UseBasicParsing")) {
+        $parameters.UseBasicParsing = $true
+    }
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            return Invoke-RestMethod @parameters
+        }
+        catch {
+            if ($attempt -eq 3) {
+                throw "Could not retrieve the OCSentinel release manifest after 3 attempts. Verify that the device can reach gitea.officecom.cloud with TLS 1.2 or newer. Last error: $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds (3 * $attempt)
+        }
+    }
+}
+
+Initialize-OCSentinelTls
+
 $installRoot = Join-Path ${env:ProgramFiles} "OCSentinel"
 $appExe = Join-Path $installRoot "app\OCSentinelCli.exe"
 $installScript = Join-Path $installRoot "scripts\install-ocsentinel.ps1"
@@ -66,7 +99,7 @@ if ([string]::IsNullOrWhiteSpace($ManifestUrl)) {
 $resolvedManifestUrl = Resolve-ManifestUrl -ManifestUrl $ManifestUrl -Channel $Channel
 Write-Host "Checking update manifest: $resolvedManifestUrl"
 
-$manifest = Invoke-RestMethod -Method Get -Uri $resolvedManifestUrl -TimeoutSec 60
+$manifest = Get-OCSentinelManifest -Uri $resolvedManifestUrl
 if (-not $manifest.version -or -not $manifest.artifactUrl -or -not $manifest.sha256) {
     throw "Update manifest is missing required fields: version, artifactUrl, sha256."
 }

release/stable/version.json

@@ -1,8 +1,8 @@
 {
   "channel": "stable",
-  "version": "1.3.2",
-  "publishedAtUtc": "2026-07-26T00:23:31.3024295Z",
-  "artifactUrl": "https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v1.3.2/OCSentinelClient-win-x64.zip",
-  "sha256": "dbfedf0890176873cef8bc91b9f7a6d6c3c8382ffadc972324b9900bad1153cc",
+  "version": "1.3.4",
+  "publishedAtUtc": "2026-07-26T19:13:59.3121556Z",
+  "artifactUrl": "https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v1.3.4/OCSentinelClient-win-x64.zip",
+  "sha256": "36b2ea0ce6b017bb46539eeb397ce013679155ce4805e526df983db8d3fca65f",
   "minUpdaterVersion": "1.0.0"
 }

scripts/bootstrap-ocsentinel-ninja.ps1

@@ -8,7 +8,39 @@ param(
 
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+function Initialize-OCSentinelTls {
+    $protocols = [Net.SecurityProtocolType]::Tls12
+    if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains "Tls13") {
+        $protocols = $protocols -bor [Net.SecurityProtocolType]::Tls13
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = $protocols
+    [Net.ServicePointManager]::Expect100Continue = $false
+}
+
+function Get-OCSentinelManifest {
+    param([Parameter(Mandatory)][string]$Uri)
+
+    $parameters = @{ Method = "Get"; Uri = $Uri; TimeoutSec = 60 }
+    if ((Get-Command Invoke-RestMethod).Parameters.ContainsKey("UseBasicParsing")) {
+        $parameters.UseBasicParsing = $true
+    }
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            return Invoke-RestMethod @parameters
+        }
+        catch {
+            if ($attempt -eq 3) {
+                throw "Could not retrieve the OCSentinel release manifest after 3 attempts. Verify that the device can reach gitea.officecom.cloud with TLS 1.2 or newer. Last error: $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds (3 * $attempt)
+        }
+    }
+}
+
+Initialize-OCSentinelTls
 
 $installRoot = Join-Path $env:ProgramFiles "OCSentinel"
 $updaterPath = Join-Path $installRoot "scripts\update-ocsentinel.ps1"
@@ -54,7 +86,7 @@ if (Test-Path -LiteralPath $updaterPath) {
 }
 else {
     Write-Host "Reading OCSentinel release manifest: $ManifestUrl"
-    $manifest = Invoke-RestMethod -Method Get -Uri $ManifestUrl -TimeoutSec 60
+    $manifest = Get-OCSentinelManifest -Uri $ManifestUrl
     if ([string]::IsNullOrWhiteSpace($manifest.version) -or [string]::IsNullOrWhiteSpace($manifest.artifactUrl) -or [string]::IsNullOrWhiteSpace($manifest.sha256)) {
         throw "Release manifest is missing version, artifactUrl, or sha256."
     }

scripts/install-ocsentinel-ninja-once.ps1

@@ -7,7 +7,39 @@ param(
 
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+function Initialize-OCSentinelTls {
+    $protocols = [Net.SecurityProtocolType]::Tls12
+    if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains "Tls13") {
+        $protocols = $protocols -bor [Net.SecurityProtocolType]::Tls13
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = $protocols
+    [Net.ServicePointManager]::Expect100Continue = $false
+}
+
+function Get-OCSentinelManifest {
+    param([Parameter(Mandatory)][string]$Uri)
+
+    $parameters = @{ Method = "Get"; Uri = $Uri; TimeoutSec = 60 }
+    if ((Get-Command Invoke-RestMethod).Parameters.ContainsKey("UseBasicParsing")) {
+        $parameters.UseBasicParsing = $true
+    }
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            return Invoke-RestMethod @parameters
+        }
+        catch {
+            if ($attempt -eq 3) {
+                throw "Could not retrieve the OCSentinel release manifest after 3 attempts. Verify that the device can reach gitea.officecom.cloud with TLS 1.2 or newer. Last error: $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds (3 * $attempt)
+        }
+    }
+}
+
+Initialize-OCSentinelTls
 
 function Get-NinjaValue {
     param([Parameter(Mandatory)][string]$Name)
@@ -26,7 +58,7 @@ if ([string]::IsNullOrWhiteSpace($WebhookUrl) -or [string]::IsNullOrWhiteSpace($
     throw "WebhookUrl and SecretValue must be set as NinjaOne script variables."
 }
 
-$manifest = Invoke-RestMethod -Method Get -Uri $ManifestUrl -TimeoutSec 60
+$manifest = Get-OCSentinelManifest -Uri $ManifestUrl
 if ([string]::IsNullOrWhiteSpace($manifest.artifactUrl) -or [string]::IsNullOrWhiteSpace($manifest.sha256)) {
     throw "The release manifest is incomplete."
 }

scripts/run-ocsentinel-scheduled.ps1

@@ -1,7 +1,9 @@
 [CmdletBinding()]
 param(
     [ValidateSet("daily", "burst")]
-    [string]$Kind = "daily"
+    [string]$Kind = "daily",
+    [ValidateRange(15, 480)]
+    [int]$BurstDurationMinutes = 120
 )
 
 $ErrorActionPreference = "Stop"
@@ -25,11 +27,71 @@ function Get-NinjaBurstEnabled {
     return $false
 }
 
-if ($Kind -eq "burst" -and -not (Get-NinjaBurstEnabled)) {
+function Get-NinjaValue {
+    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Type)
+
+    try {
+        if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
+            return Get-NinjaProperty -Name $Name -Type $Type
+        }
+        if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
+            return Ninja-Property-Get -Name $Name
+        }
+    }
+    catch {
+        Write-Warning "Could not read Ninja field '$Name': $($_.Exception.Message)"
+    }
+    return $null
+}
+
+function Set-NinjaValue {
+    param([Parameter(Mandatory)][string]$Name, [AllowEmptyString()][string]$Value, [Parameter(Mandatory)][string]$Type)
+
+    try {
+        if (Get-Command -Name "Set-NinjaProperty" -ErrorAction SilentlyContinue) {
+            Set-NinjaProperty -Name $Name -Value $Value -Type $Type -Force | Out-Null
+            return $true
+        }
+        if (Get-Command -Name "Ninja-Property-Set" -ErrorAction SilentlyContinue) {
+            Ninja-Property-Set -Name $Name -Value $Value | Out-Null
+            return $true
+        }
+    }
+    catch {
+        Write-Warning "Could not update Ninja field '$Name': $($_.Exception.Message)"
+    }
+    return $false
+}
+
+if ($Kind -eq "burst") {
+    if (-not (Get-NinjaBurstEnabled)) {
+        Set-NinjaValue -Name "ocsentinelburststatus" -Value "idle" -Type "Text" | Out-Null
         Write-Host "OfficeCom Sentinel burst check: disabled."
         exit 0
     }
 
+    $now = [DateTimeOffset]::UtcNow
+    $untilValue = Get-NinjaValue -Name "ocsentinelburstuntilutc" -Type "DateTime"
+    $until = $null
+    if (-not [string]::IsNullOrWhiteSpace([string]$untilValue)) {
+        try { $until = [DateTimeOffset]$untilValue } catch { Write-Warning "Burst end time is invalid and will be restarted." }
+    }
+
+    if ($null -eq $until) {
+        $until = $now.AddMinutes($BurstDurationMinutes)
+        Set-NinjaValue -Name "ocsentinelburstuntilutc" -Value $until.ToString("o") -Type "DateTime" | Out-Null
+        Write-Host "OfficeCom Sentinel burst window started until $($until.ToString('u'))."
+    }
+    elseif ($until -le $now) {
+        Set-NinjaValue -Name "ocsentinelburst" -Value "false" -Type "Checkbox" | Out-Null
+        Set-NinjaValue -Name "ocsentinelburststatus" -Value "completed" -Type "Text" | Out-Null
+        Write-Host "OfficeCom Sentinel burst window completed and was disabled."
+        exit 0
+    }
+
+    Set-NinjaValue -Name "ocsentinelburststatus" -Value "active until $($until.ToUniversalTime().ToString('o'))" -Type "Text" | Out-Null
+}
+
 $createdNew = $false
 $mutex = [Threading.Mutex]::new($false, $mutexName, [ref]$createdNew)
 try {
@@ -39,7 +101,11 @@ try {
     }
 
     Write-Host "OfficeCom Sentinel scheduled $Kind scan started."
-    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitorScript -Mode status -UploadMode required -SecretPath $secretPath -SuppressTriggerExit
+    $monitorArgs = @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", $monitorScript, "-Mode", "status", "-UploadMode", "required", "-SecretPath", $secretPath, "-SuppressTriggerExit")
+    if ($Kind -eq "burst") {
+        $monitorArgs += @("-LookbackDays", "1", "-TopCount", "25")
+    }
+    & powershell.exe @monitorArgs
     exit $LASTEXITCODE
 }
 finally {

src/OCSentinelCli/OCSentinelCli.csproj

@@ -9,10 +9,10 @@
     <RootNamespace>OCSentinelCli</RootNamespace>
     <Product>OfficeCom Sentinel</Product>
     <Company>OfficeCom</Company>
-    <Version>1.3.3</Version>
-    <AssemblyVersion>1.3.3.0</AssemblyVersion>
-    <FileVersion>1.3.3.0</FileVersion>
-    <InformationalVersion>1.3.3</InformationalVersion>
+    <Version>1.3.5</Version>
+    <AssemblyVersion>1.3.5.0</AssemblyVersion>
+    <FileVersion>1.3.5.0</FileVersion>
+    <InformationalVersion>1.3.5</InformationalVersion>
   </PropertyGroup>
 
   <ItemGroup>