psPAS

6.3.78

Functions/EventSecurity/Set-PASPTARule.ps1

# .ExternalHelp psPAS-help.xml
Function Set-PASPTARule {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [parameter(
            Mandatory = $true,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateRange(1, [int]::MaxValue)]
        [string]$id,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateSet('SSH', 'WINDOWS', 'SCP', 'KEYSTROKES', 'SQL')]
        [string]$category,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [string]$regex,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateRange(1, 100)]
        [int]$score,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [string]$description,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateSet('NONE', 'TERMINATE', 'SUSPEND')]
        [string]$response,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [boolean]$active,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateSet('EXCLUDE', 'INCLUDE')]
        [string]$vaultUsersMode,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [string[]]$vaultUsersList,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [ValidateSet('EXCLUDE', 'INCLUDE')]
        [string]$machinesMode,

        [parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true
        )]
        [string[]]$machinesList

    )

    BEGIN {

        Assert-VersionRequirement -RequiredVersion 10.4
        $userScopeParams = [Collections.Generic.List[String]]@('vaultUsersMode', 'vaultUsersList')
        $machineScopeParams = [Collections.Generic.List[String]]@('machinesMode', 'machinesList')
        $scopeParams = [Collections.Generic.List[String]]@($userScopeParams + $machineScopeParams)

    }#begin

    PROCESS {

        #Get all parameters that will be sent in the request
        $boundParameters = $PSBoundParameters | Get-PASParameter

        $PTARule = (Get-PASPTARule).Where({ $PSitem.ID -eq $id })
        if ($null -ne $PTARule) {
            Format-PutRequestObject -InputObject $PTARule -boundParameters $BoundParameters -ParametersToRemove mode, list
        }

        #Create URL for Request
        $URI = "$($psPASSession.BaseURI)/API/pta/API/Settings/RiskyActivity/"

        switch ($PSBoundParameters.keys) {

            { $scopeParams -contains $PSItem } {

                #Current parameter relates to scope section of request object
                if (-not($boundParameters.ContainsKey('scope'))) {
                    #create the scope key
                    $boundParameters.Add('scope', @{})
                }

                #determine whether vaultUsers or machines scope item
                if ($userScopeParams -contains $PSItem) {
                    $scopeItem = 'vaultUsers'
                } elseif ( $machineScopeParams -contains $PSItem) {
                    $scopeItem = 'machines'
                }

                #add scope item key to bond parameters
                if (-not($boundParameters['scope'].ContainsKey($scopeItem))) {
                    $boundParameters['scope'].Add($scopeItem, @{})
                }
                #translate parameter names into request property name
                #* Return only last 4 characters of parametername in lowercase
                #*vaultUsersMode & machinesMode translate to "mode"
                #*vaultUsersList & machinesList translate to "list"
                $property = ($PSItem).Substring(($PSItem).length - 4, 4).ToLower()

                if ($null -ne $PSBoundParameters[$PSItem]) {
                    #Add scope parameter vaultUsers & machines request values to boundParameters
                    $boundParameters['scope'][$scopeItem][$property] = $PSBoundParameters[$PSItem]
                } else {
                    #clear vaultUsers/machine scope if null value specified
                    $boundParameters['scope'][$scopeItem] = $null
                }


            }

        }

        switch ($boundParameters) {
            { $PSItem.keys -contains 'scope' } {
                #BoundParameteters Contains Scope Key
                switch ($boundParameters['scope']) {
                    { $PSItem.ContainsKey('vaultUsers') -and (-not($PSItem.ContainsKey('machines'))) } {
                        #vaultUser Scope is being updated - copy existing machines scope
                        $boundParameters['scope']['machines'] = $PTARule.scope.machines
                    }

                    { $PSItem.ContainsKey('machines') -and (-not($PSItem.ContainsKey('vaultUsers'))) } {
                        #machines Scope is being updated - copy existing vaultUsers scope
                        $boundParameters['scope']['vaultUsers'] = $PTARule.scope.vaultUsers
                    }
                }

            }
            default {
                #No updated scope specified - Use existing scope copied from rule
                'third'
                $boundParameters['scope'] = $PTARule.scope
            }
        }
        #Create body of request
        #* Ensure JSON Depth of 3 to capture correct scope format
        $Body = $boundParameters | Get-PASParameter -ParametersToRemove $scopeParams | ConvertTo-Json -Depth 3

        if ($PSCmdlet.ShouldProcess($id, 'Update Risky Activity Rule')) {

            #send request to PAS web service
            Invoke-PASRestMethod -Uri $URI -Method PUT -Body $Body

        }

    }#process

    END { }#end

}