Functions/BloxOne/BloxOneTD/Get-B1SOCInsight.ps1

function Get-B1SOCInsight {
    <#
    .SYNOPSIS
        Queries a list of Insights from SOC Insights

    .DESCRIPTION
        This function is used to query a list of Insights from SOC Insights

    .PARAMETER Status
        Filter the results by the status of the Insight. By default, only active insights will be displayed. To see closed insights, use this parameter with a value of 'Closed'.

    .PARAMETER ThreatType
        Filter the results by the threat type of the Insight

    .PARAMETER Priority
        Filter the results by the priority of the Insight

    .PARAMETER insightId
        Filter the results by the insightId of the Insight

    .EXAMPLE
        PS> Get-B1SOCInsight -Priority CRITICAL | ft -AutoSize

        tClass tFamily insightId feedSource startedAt threatType status persistentDate numEvents mostRecentAt
        ------ ------- --------- ---------- --------- ---------- ------ -------------- --------- ------------
        TI-DGA ZLoader 41670f23-4149-4552-a32e-07ab6e57b99e Insight Detection Framework 2/7/2024 4:00:00PM DGA Active 2/7/2024 4:00:00PM 376 3/26/2024 8:57:56AM
        TI-DNST Generic 7846a2ca-3d0c-4b6e-a017-bb765e4ccab0 Insight Detection Framework 4/3/2023 7:00:00AM DNS Tunneling Active 4/5/2023 6:00:00AM 20308 3/26/2024 10:59:30AM
        Lookalike Suspicious 35a1d37e-a1f6-492f-8329-70a42ea50d43 Insight Detection Framework 3/13/2024 8:00:00PM Lookalike Threat Active 3/4/2024 7:00:00PM 10 3/15/2024 4:27:00PM

    .EXAMPLE
        PS> Get-B1SOCInsight -ThreatType 'DGA'

        tClass : TI-DGA
        tFamily : SUPPOBOX
        insightId : e06e383a-eee3-4cd9-ba3a-25a6ded9eeb4
        feedSource : Insight Detection Framework
        startedAt : 2/7/2024 4:00:00PM
        threatType : DGA
        status : Active
        persistentDate : 2/12/2024 8:00:00PM
        numEvents : 12
        mostRecentAt : 3/26/2024 8:57:56AM
        eventsBlockedCount : 12
        dateChanged : 3/18/2024 4:05:49PM
        priorityText : MEDIUM

    .FUNCTIONALITY
        BloxOneDDI

    .FUNCTIONALITY
        BloxOne Threat Defense

    .FUNCTIONALITY
        SOC Insights
    #>

    [CmdletBinding()]
    param(
      [ValidateSet('Active','Closed')]
      [String]$Status,
      [String]$ThreatType,
      [ValidateSet('LOW','MEDIUM','HIGH','CRITICAL')]
      [String]$Priority,
      [String]$insightId
    )

    process {
      $QueryFilters = @()

      if ($Status) {
        $QueryFilters += "status=$($Status)"
      }
      if ($ThreatType) {
        $QueryFilters += "threat_type=$($ThreatType)"
      }
      if ($Priority) {
        $QueryFilters += "priority=$($Priority)"
      }
      if ($QueryFilters) {
        $QueryFilter = ConvertTo-QueryString $QueryFilters
      }
      Write-DebugMsg -Filters $QueryFilters
      if ($insightId) {
        $Results = Invoke-CSP -Uri "$(Get-B1CspUrl)/api/v1/insights/$($insightId)$($QueryFilter)" -Method GET | Select-Object -ExpandProperty insight -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
      } else {
        $Results = Invoke-CSP -Uri "$(Get-B1CspUrl)/api/v1/insights$QueryFilter" -Method GET | Select-Object -ExpandProperty insightList -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
      }

      if ($Results) {
        return $Results
      }
    }
}