Updated to write to and read from cetralised CIPP database

Added license check for new Defender category

Signed-off-by: DamienMatthys <damien@pcunplug.com>

Cleaned up logging

Signed-off-by: DamienMatthys <damien@pcunplug.com>

…enant.ps1

Remove old sync function

Signed-off-by: DamienMatthys <damien@pcunplug.com>

Remove old sync schedule

Signed-off-by: DamienMatthys <damien@pcunplug.com>

Fixed sync to add one CVE per Device

Signed-off-by: DamienMatthys <damien@pcunplug.com>

Add severity and resolvingComment to the incident PATCH so users can
reprioritise and document why an incident was resolved. Build the body
as a hashtable/JSON so free-text comments with quotes are escaped, and
gate assignee changes behind an explicit AssignToSelf flag so status
and severity and status edits no longer clobber the existing owner.

The generated openapi.json types every request body but leaves each 200
response as the generic StandardResults envelope, and carries no operationId
on any operation. That makes the spec hard to consume: OpenAPI importers that
key on operationId skip every operation, and downstream tools get no typed
output fields to map against.

This adds a deterministic post-processing stage that enriches the generated
spec without replacing the upstream generator:

- operationId injection: bare endpoint name per operation, method-prefixed
  only where a single path carries multiple methods. Existing operationIds are
  preserved; collisions are a hard failure.
- typed 200 responses: derived from two checked-in sources, the frontend shape
  baselines (Tests/Shapes/*.json) and page simpleColumns declarations. The
  { Results, Metadata } envelope is preserved as the API actually returns it.

The enriched spec is published as the openapi.enriched.json asset on each
GitHub Release. A PR check workflow runs the test suite and strictly lints the
enriched spec against a committed ignore-baseline that pins pre-existing
upstream findings, so any new finding fails CI.

Pure function of the two repositories; same input produces byte-identical
output. Stage and runner are PowerShell with a Pester suite (50 tests).

Add ExcludeGroupIds and AssignmentDirection so exclude groups are
targeted by ID and a Replace edits only one direction, preserving
the other plus All Users/All Devices. Exclude-only requests no longer
error or wipe assignments, and exclusion targets drop the settings
block that Graph rejects.

…vanced)

Get-CIPPAlertCheckExtension reads a per-tenant watermark from the AlertLastRun
table to only fetch alerts newer than the previous run, but never wrote it back.
So $Since always fell back to the default 24h window and the same alerts were
re-sent on every scheduled run.

Capture the run start, read/store an explicit LastRunTime watermark (falling
back to the existing Timestamp for compatibility), and upsert it after
processing so each run only sends alerts created since the last run.

Fixes #6216

The detection script of a Win32 Custom Application was base64-encoded from the
raw input, so %tenantid% and other Get-CIPPTextReplacement tokens were not
resolved (they reached Intune as literal text), unlike the install and uninstall
scripts. Run the detection script through Get-CIPPTextReplacement first, matching
the install/uninstall handling.

Fixes KelvinTegelaar/CIPP#6226

…vanced) (#2114)

## What

The "Check" add-in's alerts are re-sent on every scheduled run - each
run dumps the whole recent backlog to the configured webhook instead of
only new alerts. Reported in #6216 (e.g. 13 test alerts resulted in 13
entries on every run).

## Cause

`Get-CIPPAlertCheckExtension` reads a per-tenant watermark from the
`AlertLastRun` table (`PartitionKey 'AlertLastRun'`, `RowKey
"<tenant>-Get-CIPPAlertCheckExtension"`) so it only fetches alerts newer
than the previous run - but it never writes that watermark back. As a
result `$Since` always falls back to the default 24-hour window, so
every run re-fetches and re-sends the same alerts (and the
day-partitioned de-dupe in `Write-AlertTrace` resets at midnight, which
lines up with the reported timing jumps).

## Fix

Capture the run start, read/store an explicit `LastRunTime` watermark
(falling back to the existing `Timestamp` for backward compatibility),
and upsert the `AlertLastRun` row after processing. Each run now only
sends alerts created since the previous run.

## Testing

- PowerShell parses clean.
- A mock-storage harness confirms the behaviour: run 1 sends the
backlog, run 2 (no new alerts) sends nothing, run 3 sends only a
newly-added alert.

Fixes KelvinTegelaar/CIPP#6216

# Resolve tenant variables in the Win32 Custom App detection script

Fixes KelvinTegelaar/CIPP#6226.

`%tenantid%` and the other `Get-CIPPTextReplacement` tokens resolve in a
Win32 Custom Application's install and uninstall scripts, but not in the
detection script, which reaches Intune with the literal `%tenantid%`
string.

In `Add-CIPPW32ScriptApplication.ps1` the install and uninstall scripts
are passed through `Get-CIPPTextReplacement` before being
base64-encoded, but the detection script was encoded from the raw
`$Properties.detectionScript`. This change runs the detection script
through `Get-CIPPTextReplacement` first, the same way as the install and
uninstall scripts directly below it.

Verified against the real `Get-CIPPTextReplacement` with mocked tenant
lookups: before the change the detection script keeps the literal
`%tenantid%`; after, it resolves to the tenant's customerId and matches
what the install script produces. Other tokens such as `%tenantfilter%`
resolve too.

Improve logging and error handling in the GDAP relationship termination
function

This pull request enhances the `Push-BECRun` PowerShell function by
adding the retrieval and logging of sent message traces for a user, and
includes this data in the output object. These changes improve the
auditing and incident response capabilities of the function by providing
more comprehensive information about user activity.

**Enhancements to auditing and user activity tracking:**

* Added retrieval of sent message traces using the `Get-MessageTraceV2`
cmdlet, with error handling and logging in case of failures. The trace
includes message details such as status, subject, recipient, received
time, and sender IP.
* Included the collected sent message trace data as a new property
(`SentMessages`) in the output object returned by the function.

Introduce support for ExcludeGroupIds and ExcludeGroupNames in
assignment functions.

Frontend PR: KelvinTegelaar/CIPP#6244

Overhaul of the rather interesting way to construct a JSON payload and
add in severity and resolving comment functionality.

Frontend PR: KelvinTegelaar/CIPP#6234

#2104)

Frontend PR: KelvinTegelaar/CIPP#6207

Frontend PR: KelvinTegelaar/CIPP#6206

Updated to write to and read from cetralised CIPP database