Add "Drop" method

Author: KelvinTegelaar

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1

@@ -12,8 +12,11 @@ function Get-CippAlertSecureScore {
         $TenantFilter
     )
     try {
-        $SecureScore = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/security/secureScores?$top=1' -tenantid $TenantFilter -noPagination $true
-        if ($InputValue.ThresholdType.value -eq "absolute") {
+        $TopCount = if ($InputValue.ThresholdType.value -eq 'drop') { 2 } else { 1 }
+        $SecureScores = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/security/secureScores?`$top=$TopCount" -tenantid $TenantFilter -noPagination $true)
+        $SecureScore = $SecureScores[0]
+
+        if ($InputValue.ThresholdType.value -eq 'absolute') {
             if ($SecureScore.currentScore -lt $InputValue.InputValue) {
                 $SecureScoreResult = [PSCustomObject]@{
                     Message        = "Secure Score is below acceptable threshold"
@@ -24,21 +27,46 @@ function Get-CippAlertSecureScore {
             } else {
                 $SecureScoreResult = @()
             }
-        } elseif ($InputValue.ThresholdType.value -eq "percent") {
-            $PercentageScore = [math]::Round((($SecureScore.currentScore / $SecureScore.maxScore) * 100),2)
+        } elseif ($InputValue.ThresholdType.value -eq 'percent') {
+            $PercentageScore = [math]::Round((($SecureScore.currentScore / $SecureScore.maxScore) * 100), 2)
             if ($PercentageScore -lt $InputValue.InputValue) {
                 $SecureScoreResult = [PSCustomObject]@{
                     Message                  = "Secure Score is below acceptable threshold"
                     Tenant                   = $TenantFilter
                     CurrentScore             = $SecureScore.currentScore
                     MaxScore                 = $SecureScore.maxScore
-                    CurrentScorePercentage   = [math]::Round($PercentageScore,2)
+                    CurrentScorePercentage   = [math]::Round($PercentageScore, 2)
                     ScoreThresholdPercentage = $InputValue.InputValue
                 }
             } else {
                 $SecureScoreResult = @()
             }
+        } elseif ($InputValue.ThresholdType.value -eq 'drop') {
+            if ($SecureScores.Count -ge 2) {
+                $PreviousScore = $SecureScores[1]
+                if ($PreviousScore.currentScore -gt 0) {
+                    $DropPercentage = [math]::Round((($PreviousScore.currentScore - $SecureScore.currentScore) / $PreviousScore.currentScore) * 100, 2)
+                    if ($DropPercentage -ge $InputValue.InputValue) {
+                        $SecureScoreResult = [PSCustomObject]@{
+                            Message        = "Secure Score dropped by $DropPercentage% (from $($PreviousScore.currentScore) to $($SecureScore.currentScore))"
+                            Tenant         = $TenantFilter
+                            CurrentScore   = $SecureScore.currentScore
+                            PreviousScore  = $PreviousScore.currentScore
+                            MaxScore       = $SecureScore.maxScore
+                            DropPercentage = $DropPercentage
+                            DropThreshold  = $InputValue.InputValue
+                        }
+                    } else {
+                        $SecureScoreResult = @()
+                    }
+                } else {
+                    $SecureScoreResult = @()
+                }
+            } else {
+                $SecureScoreResult = @()
+            }
         }
+
         if ($SecureScoreResult) {
             Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $SecureScoreResult -PartitionKey SecureScore
         }