117 lines
4.2 KiB
PowerShell
117 lines
4.2 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[ValidateSet("daily", "burst")]
|
|
[string]$Kind = "daily",
|
|
[ValidateRange(15, 480)]
|
|
[int]$BurstDurationMinutes = 120
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
|
|
$monitorScript = Join-Path $scriptDir "run-ocsentinel-monitor.ps1"
|
|
$secretPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
|
|
$mutexName = "Global\OfficeComSentinelScan"
|
|
|
|
function Get-NinjaBurstEnabled {
|
|
if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
|
|
return [bool](Get-NinjaProperty -Name "ocsentinelburst" -Type "Checkbox")
|
|
}
|
|
|
|
if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
|
|
$value = Ninja-Property-Get -Name "ocsentinelburst"
|
|
return [string]$value -match "^(1|true|yes)$"
|
|
}
|
|
|
|
Write-Warning "Ninja custom-field reader is unavailable; burst scan skipped."
|
|
return $false
|
|
}
|
|
|
|
function Get-NinjaValue {
|
|
param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Type)
|
|
|
|
try {
|
|
if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
|
|
return Get-NinjaProperty -Name $Name -Type $Type
|
|
}
|
|
if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
|
|
return Ninja-Property-Get -Name $Name
|
|
}
|
|
}
|
|
catch {
|
|
Write-Warning "Could not read Ninja field '$Name': $($_.Exception.Message)"
|
|
}
|
|
return $null
|
|
}
|
|
|
|
function Set-NinjaValue {
|
|
param([Parameter(Mandatory)][string]$Name, [AllowEmptyString()][string]$Value, [Parameter(Mandatory)][string]$Type)
|
|
|
|
try {
|
|
if (Get-Command -Name "Set-NinjaProperty" -ErrorAction SilentlyContinue) {
|
|
Set-NinjaProperty -Name $Name -Value $Value -Type $Type -Force | Out-Null
|
|
return $true
|
|
}
|
|
if (Get-Command -Name "Ninja-Property-Set" -ErrorAction SilentlyContinue) {
|
|
Ninja-Property-Set -Name $Name -Value $Value | Out-Null
|
|
return $true
|
|
}
|
|
}
|
|
catch {
|
|
Write-Warning "Could not update Ninja field '$Name': $($_.Exception.Message)"
|
|
}
|
|
return $false
|
|
}
|
|
|
|
if ($Kind -eq "burst") {
|
|
if (-not (Get-NinjaBurstEnabled)) {
|
|
Set-NinjaValue -Name "ocsentinelburststatus" -Value "idle" -Type "Text" | Out-Null
|
|
Write-Host "OfficeCom Sentinel burst check: disabled."
|
|
exit 0
|
|
}
|
|
|
|
$now = [DateTimeOffset]::UtcNow
|
|
$untilValue = Get-NinjaValue -Name "ocsentinelburstuntilutc" -Type "DateTime"
|
|
$until = $null
|
|
if (-not [string]::IsNullOrWhiteSpace([string]$untilValue)) {
|
|
try { $until = [DateTimeOffset]$untilValue } catch { Write-Warning "Burst end time is invalid and will be restarted." }
|
|
}
|
|
|
|
if ($null -eq $until) {
|
|
$until = $now.AddMinutes($BurstDurationMinutes)
|
|
Set-NinjaValue -Name "ocsentinelburstuntilutc" -Value $until.ToString("o") -Type "DateTime" | Out-Null
|
|
Write-Host "OfficeCom Sentinel burst window started until $($until.ToString('u'))."
|
|
}
|
|
elseif ($until -le $now) {
|
|
Set-NinjaValue -Name "ocsentinelburst" -Value "false" -Type "Checkbox" | Out-Null
|
|
Set-NinjaValue -Name "ocsentinelburststatus" -Value "completed" -Type "Text" | Out-Null
|
|
Write-Host "OfficeCom Sentinel burst window completed and was disabled."
|
|
exit 0
|
|
}
|
|
|
|
Set-NinjaValue -Name "ocsentinelburststatus" -Value "active until $($until.ToUniversalTime().ToString('o'))" -Type "Text" | Out-Null
|
|
}
|
|
|
|
$createdNew = $false
|
|
$mutex = [Threading.Mutex]::new($false, $mutexName, [ref]$createdNew)
|
|
try {
|
|
if (-not $mutex.WaitOne(0)) {
|
|
Write-Host "OfficeCom Sentinel scan skipped: another scan is already running."
|
|
exit 0
|
|
}
|
|
|
|
Write-Host "OfficeCom Sentinel scheduled $Kind scan started."
|
|
$monitorArgs = @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", $monitorScript, "-Mode", "status", "-UploadMode", "required", "-SecretPath", $secretPath, "-SuppressTriggerExit")
|
|
if ($Kind -eq "burst") {
|
|
$monitorArgs += @("-LookbackDays", "1", "-TopCount", "25")
|
|
}
|
|
& powershell.exe @monitorArgs
|
|
exit $LASTEXITCODE
|
|
}
|
|
finally {
|
|
if ($null -ne $mutex) {
|
|
try { $mutex.ReleaseMutex() } catch { }
|
|
$mutex.Dispose()
|
|
}
|
|
}
|