Merge pull request #945 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertCheckExtension.ps1

@@ -0,0 +1,52 @@
+function Get-CIPPAlertCheckExtension {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory)]
+        $TenantFilter,
+        [Alias('input')]
+        $InputValue
+    )
+
+    try {
+        $CheckTable = Get-CippTable -tablename 'CheckExtensionAlerts'
+        $LastRunTable = Get-CippTable -tablename 'AlertLastRun'
+        $LastRunKey = "$TenantFilter-Get-CIPPAlertCheckExtension"
+
+        # Get the last run timestamp for this tenant to only fetch new alerts
+        $LastRun = Get-CIPPAzDataTableEntity @LastRunTable -Filter "PartitionKey eq 'AlertLastRun' and RowKey eq '$LastRunKey'" | Select-Object -First 1
+        $Since = if ($LastRun.Timestamp) {
+            $LastRun.Timestamp.UtcDateTime
+        } else {
+            (Get-Date).AddDays(-1).ToUniversalTime()
+        }
+        $SinceString = $Since.ToString('yyyy-MM-ddTHH:mm:ssZ')
+
+        $CheckAlerts = Get-CIPPAzDataTableEntity @CheckTable -Filter "PartitionKey eq 'CheckAlert' and tenantFilter eq '$TenantFilter' and Timestamp ge datetime'$SinceString'"
+
+        $AlertData = foreach ($Alert in $CheckAlerts) {
+            [PSCustomObject]@{
+                Message                  = "Phishing alert: $($Alert.type) detected for user $($Alert.potentialUserName) at URL $($Alert.url) - $($Alert.reason)"
+                Type                     = $Alert.type
+                URL                      = $Alert.url
+                Reason                   = $Alert.reason
+                Score                    = $Alert.score
+                Threshold                = $Alert.threshold
+                PotentialUserName        = $Alert.potentialUserName
+                PotentialUserDisplayName = $Alert.potentialUserDisplayName
+                ReportedByIP             = $Alert.reportedByIP
+                Tenant                   = $TenantFilter
+            }
+        }
+
+        if ($AlertData) {
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-AlertMessage -message "Check Extension alert failed: $($ErrorMessage.NormalizedError)" -tenant $TenantFilter -LogData $ErrorMessage
+    }
+}

Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1

@@ -12,8 +12,11 @@ function Get-CippAlertSecureScore {
         $TenantFilter
     )
     try {
-        $SecureScore = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/security/secureScores?$top=1' -tenantid $TenantFilter -noPagination $true
-        if ($InputValue.ThresholdType.value -eq "absolute") {
+        $TopCount = if ($InputValue.ThresholdType.value -eq 'drop') { 2 } else { 1 }
+        $SecureScores = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/security/secureScores?`$top=$TopCount" -tenantid $TenantFilter -noPagination $true)
+        $SecureScore = $SecureScores[0]
+
+        if ($InputValue.ThresholdType.value -eq 'absolute') {
             if ($SecureScore.currentScore -lt $InputValue.InputValue) {
                 $SecureScoreResult = [PSCustomObject]@{
                     Message        = "Secure Score is below acceptable threshold"
@@ -24,21 +27,46 @@ function Get-CippAlertSecureScore {
             } else {
                 $SecureScoreResult = @()
             }
-        } elseif ($InputValue.ThresholdType.value -eq "percent") {
-            $PercentageScore = [math]::Round((($SecureScore.currentScore / $SecureScore.maxScore) * 100),2)
+        } elseif ($InputValue.ThresholdType.value -eq 'percent') {
+            $PercentageScore = [math]::Round((($SecureScore.currentScore / $SecureScore.maxScore) * 100), 2)
             if ($PercentageScore -lt $InputValue.InputValue) {
                 $SecureScoreResult = [PSCustomObject]@{
                     Message                  = "Secure Score is below acceptable threshold"
                     Tenant                   = $TenantFilter
                     CurrentScore             = $SecureScore.currentScore
                     MaxScore                 = $SecureScore.maxScore
-                    CurrentScorePercentage   = [math]::Round($PercentageScore,2)
+                    CurrentScorePercentage   = [math]::Round($PercentageScore, 2)
                     ScoreThresholdPercentage = $InputValue.InputValue
                 }
             } else {
                 $SecureScoreResult = @()
             }
+        } elseif ($InputValue.ThresholdType.value -eq 'drop') {
+            if ($SecureScores.Count -ge 2) {
+                $PreviousScore = $SecureScores[1]
+                if ($PreviousScore.currentScore -gt 0) {
+                    $DropPercentage = [math]::Round((($PreviousScore.currentScore - $SecureScore.currentScore) / $PreviousScore.currentScore) * 100, 2)
+                    if ($DropPercentage -ge $InputValue.InputValue) {
+                        $SecureScoreResult = [PSCustomObject]@{
+                            Message        = "Secure Score dropped by $DropPercentage% (from $($PreviousScore.currentScore) to $($SecureScore.currentScore))"
+                            Tenant         = $TenantFilter
+                            CurrentScore   = $SecureScore.currentScore
+                            PreviousScore  = $PreviousScore.currentScore
+                            MaxScore       = $SecureScore.maxScore
+                            DropPercentage = $DropPercentage
+                            DropThreshold  = $InputValue.InputValue
+                        }
+                    } else {
+                        $SecureScoreResult = @()
+                    }
+                } else {
+                    $SecureScoreResult = @()
+                }
+            } else {
+                $SecureScoreResult = @()
+            }
         }
+
         if ($SecureScoreResult) {
             Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $SecureScoreResult -PartitionKey SecureScore
         }

Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1

@@ -23,6 +23,11 @@ function Start-CIPPStatsTimer {
             $RawExt = @{}
         }
 
+        $ConfigTable = Get-CIPPTable -tablename 'Config'
+        $FunctionOffloading = (Get-CIPPAzDataTableEntity @ConfigTable -Filter "RowKey eq 'OffloadFunctions' and PartitionKey eq 'OffloadFunctions'").state
+        $OffloadingEnabled = $false
+        [bool]::TryParse($FunctionOffloading, [ref]$OffloadingEnabled) | Out-Null
+
         # Get counts of various entities across all tenants
         $counts = Get-CIPPDbItem -TenantFilter AllTenants -CountsOnly
         $userCount = ($counts | Where-Object { $_.RowKey -eq 'Users-Count' } | Measure-Object -Property DataCount -Sum).Sum
@@ -34,6 +39,8 @@ function Start-CIPPStatsTimer {
         $SendingObject = [PSCustomObject]@{
             rgid                = $env:WEBSITE_SITE_NAME
             SetupComplete       = $SetupComplete
+            Hosted              = $env:CIPP_HOSTED -eq 'true'
+            OffloadingEnabled   = $OffloadingEnabled
             RunningVersionAPI   = $APIVersion.trim()
             CountOfTotalTenants = $TenantCount
             uid                 = $env:TenantID
@@ -53,6 +60,7 @@ function Start-CIPPStatsTimer {
             CFZTNA              = $RawExt.CFZTNA.Enabled
             GitHub              = $RawExt.GitHub.Enabled
         } | ConvertTo-Json
+
         try {
             Invoke-CIPPRestMethod -Uri 'https://management.cipp.app/api/stats' -Method POST -Body $SendingObject -ContentType 'application/json'
         } catch {