Skip to content

Commit d8b0a05

Browse files
pull[bot]pull[bot]
authored
Merge pull request #16 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents 77684ea + 4310485 commit d8b0a05

4 files changed

Lines changed: 127 additions & 29 deletions

File tree

‎Modules/CIPPCore/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,16 @@ function Get-CIPPAlertVulnerabilities {
1818
$AgeThresholdHours = if ($InputValue.VulnerabilityAgeHours) { [int]$InputValue.VulnerabilityAgeHours } else { 0 }
1919
# Autocomplete inputs store value in .value subproperty
2020
$CVSSSeverity = if ($InputValue.CVSSSeverity.value) { $InputValue.CVSSSeverity.value } else { 'low' }
21+
# Switch inputs are stored as boolean
22+
$NewerThanMode = [bool]($InputValue.NewerThanMode)
2123
# Multi-select autocomplete returns array of objects with .value
2224
if ($InputValue.ExploitabilityLevels) {
2325
foreach ($level in $InputValue.ExploitabilityLevels) {
2426
$ExploitabilityLevels.Add($(if ($level.value) { $level.value } else { $level }))
2527
}
2628
}
2729
} else {
30+
$NewerThanMode = $false
2831
# Backward compatibility: simple value = hours threshold
2932
$AgeThresholdHours = if ($InputValue) { [int]$InputValue } else { 0 }
3033
$CVSSSeverity = 'low'
@@ -52,9 +55,17 @@ function Get-CIPPAlertVulnerabilities {
5255
$FirstVuln = $Group.Group | Sort-Object firstSeenTimestamp | Select-Object -First 1
5356
$HoursOld = [math]::Round(((Get-Date) - [datetime]$FirstVuln.firstSeenTimestamp).TotalHours)
5457

55-
# Skip if vulnerability is not old enough
56-
if ($HoursOld -lt $AgeThresholdHours) {
57-
continue
58+
# Skip based on age threshold mode
59+
if ($NewerThanMode) {
60+
# Newer-than mode: only alert on items newer than threshold
61+
if ($HoursOld -gt $AgeThresholdHours) {
62+
continue
63+
}
64+
} else {
65+
# Older-than mode (default): only alert on items older than threshold
66+
if ($HoursOld -lt $AgeThresholdHours) {
67+
continue
68+
}
5869
}
5970

6071
# Skip if CVSS score is below minimum threshold

‎Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1‎

Lines changed: 72 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -39,31 +39,33 @@ function Push-DomainAnalyserDomain {
3939
}
4040

4141
$Result = [PSCustomObject]@{
42-
Tenant = $Tenant.Tenant
43-
TenantID = $Tenant.TenantGUID
44-
GUID = $($Domain.Replace('.', ''))
45-
LastRefresh = $(Get-Date (Get-Date).ToUniversalTime() -UFormat '+%Y-%m-%dT%H:%M:%S.000Z')
46-
Domain = $Domain
47-
NSRecords = (Read-NSRecord -Domain $Domain).Records
48-
ExpectedSPFRecord = ''
49-
ActualSPFRecord = ''
50-
SPFPassAll = ''
51-
ActualMXRecords = ''
52-
MXPassTest = ''
53-
DMARCPresent = ''
54-
DMARCFullPolicy = ''
55-
DMARCActionPolicy = ''
56-
DMARCReportingActive = ''
57-
DMARCPercentagePass = ''
58-
DNSSECPresent = ''
59-
MailProvider = ''
60-
DKIMEnabled = ''
61-
DKIMRecords = ''
62-
MSCNAMEDKIMSelectors = ''
63-
Score = ''
64-
MaximumScore = 160
65-
ScorePercentage = ''
66-
ScoreExplanation = ''
42+
Tenant = $Tenant.Tenant
43+
TenantID = $Tenant.TenantGUID
44+
GUID = $($Domain.Replace('.', ''))
45+
LastRefresh = $(Get-Date (Get-Date).ToUniversalTime() -UFormat '+%Y-%m-%dT%H:%M:%S.000Z')
46+
Domain = $Domain
47+
NSRecords = (Read-NSRecord -Domain $Domain).Records
48+
ExpectedSPFRecord = ''
49+
ActualSPFRecord = ''
50+
SPFPassAll = ''
51+
ActualMXRecords = ''
52+
MXPassTest = ''
53+
DMARCPresent = ''
54+
DMARCFullPolicy = ''
55+
DMARCActionPolicy = ''
56+
DMARCReportingActive = ''
57+
DMARCPercentagePass = ''
58+
DNSSECPresent = ''
59+
MailProvider = ''
60+
DKIMEnabled = ''
61+
DKIMRecords = ''
62+
MSCNAMEDKIMSelectors = ''
63+
EnterpriseEnrollment = ''
64+
EnterpriseRegistration = ''
65+
Score = ''
66+
MaximumScore = 160
67+
ScorePercentage = ''
68+
ScoreExplanation = ''
6769
}
6870

6971
$Scores = [PSCustomObject]@{
@@ -246,6 +248,51 @@ function Push-DomainAnalyserDomain {
246248
}
247249
#EndRegion DKIM Check
248250

251+
#Region Intune Enrollment CNAME Check
252+
try {
253+
# Check enterpriseenrollment CNAME
254+
$EnrollmentResult = Resolve-DnsHttpsQuery -Domain "enterpriseenrollment.$Domain" -RecordType CNAME
255+
if ($EnrollmentResult.Answer) {
256+
$EnrollmentCNAME = ($EnrollmentResult.Answer | Where-Object { $_.type -eq 5 }).data -replace '\.$'
257+
if ($EnrollmentCNAME -eq 'enterpriseenrollment-s.manage.microsoft.com') {
258+
$Result.EnterpriseEnrollment = 'Correct'
259+
} elseif ($EnrollmentCNAME -eq 'enterpriseenrollment.manage.microsoft.com') {
260+
$Result.EnterpriseEnrollment = 'Legacy'
261+
$ScoreExplanation.Add('Enterprise Enrollment CNAME points to legacy endpoint (enterpriseenrollment.manage.microsoft.com)') | Out-Null
262+
} else {
263+
$Result.EnterpriseEnrollment = "Unexpected: $EnrollmentCNAME"
264+
$ScoreExplanation.Add('Enterprise Enrollment CNAME points to unexpected target') | Out-Null
265+
}
266+
} else {
267+
$Result.EnterpriseEnrollment = 'No CNAME'
268+
$ScoreExplanation.Add('No Enterprise Enrollment CNAME record found') | Out-Null
269+
}
270+
} catch {
271+
$Result.EnterpriseEnrollment = 'Error'
272+
Write-LogMessage -API 'DomainAnalyser' -tenant $DomainObject.TenantId -message "Enterprise Enrollment CNAME error for $Domain" -LogData (Get-CippException -Exception $_) -sev Error
273+
}
274+
275+
try {
276+
# Check enterpriseregistration CNAME
277+
$RegistrationResult = Resolve-DnsHttpsQuery -Domain "enterpriseregistration.$Domain" -RecordType CNAME
278+
if ($RegistrationResult.Answer) {
279+
$RegistrationCNAME = ($RegistrationResult.Answer | Where-Object { $_.type -eq 5 }).data -replace '\.$'
280+
if ($RegistrationCNAME -eq 'enterpriseregistration.windows.net') {
281+
$Result.EnterpriseRegistration = 'Correct'
282+
} else {
283+
$Result.EnterpriseRegistration = "Unexpected: $RegistrationCNAME"
284+
$ScoreExplanation.Add('Enterprise Registration CNAME points to unexpected target') | Out-Null
285+
}
286+
} else {
287+
$Result.EnterpriseRegistration = 'No CNAME'
288+
$ScoreExplanation.Add('No Enterprise Registration CNAME record found') | Out-Null
289+
}
290+
} catch {
291+
$Result.EnterpriseRegistration = 'Error'
292+
Write-LogMessage -API 'DomainAnalyser' -tenant $DomainObject.TenantId -message "Enterprise Registration CNAME error for $Domain" -LogData (Get-CippException -Exception $_) -sev Error
293+
}
294+
#EndRegion Intune Enrollment CNAME Check
295+
249296
#Region MSCNAME DKIM Records
250297
# Get Microsoft DKIM CNAME selector Records
251298
# Ugly, but i needed to create a scope/loop i could break out of without breaking the rest of the function

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListActiveSyncDevices.ps1‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
function Invoke-ListActiveSyncDevices {
2+
<#
3+
.FUNCTIONALITY
4+
Entrypoint
5+
.ROLE
6+
Exchange.Mailbox.Read
7+
#>
8+
[CmdletBinding()]
9+
param($Request, $TriggerMetadata)
10+
11+
$TenantFilter = $Request.Query.TenantFilter
12+
13+
try {
14+
$GraphRequest = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MobileDevice' -cmdParams @{ ResultSize = 'Unlimited' } |
15+
Select-Object @{ Name = 'userDisplayName'; Expression = { $_.UserDisplayName } },
16+
@{ Name = 'userPrincipalName'; Expression = { ($_.Identity -split '\\')[0] } },
17+
@{ Name = 'deviceFriendlyName'; Expression = { if ([string]::IsNullOrEmpty($_.FriendlyName)) { 'Unknown' } else { $_.FriendlyName } } },
18+
@{ Name = 'deviceModel'; Expression = { $_.DeviceModel } },
19+
@{ Name = 'deviceOS'; Expression = { $_.DeviceOS } },
20+
@{ Name = 'deviceType'; Expression = { $_.DeviceType } },
21+
@{ Name = 'clientType'; Expression = { $_.ClientType } },
22+
@{ Name = 'clientVersion'; Expression = { $_.ClientVersion } },
23+
@{ Name = 'deviceAccessState'; Expression = { $_.DeviceAccessState } },
24+
@{ Name = 'firstSyncTime'; Expression = { if ($_.FirstSyncTime) { $_.FirstSyncTime.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { '' } } },
25+
@{ Name = 'lastSyncAttemptTime'; Expression = { if ($_.LastSyncAttemptTime) { $_.LastSyncAttemptTime.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { '' } } },
26+
@{ Name = 'lastSuccessSync'; Expression = { if ($_.LastSuccessSync) { $_.LastSuccessSync.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { '' } } },
27+
@{ Name = 'deviceID'; Expression = { $_.DeviceId } },
28+
@{ Name = 'identity'; Expression = { $_.Identity } },
29+
@{ Name = 'Guid'; Expression = { $_.Guid } }
30+
$StatusCode = [HttpStatusCode]::OK
31+
} catch {
32+
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
33+
$StatusCode = [HttpStatusCode]::Forbidden
34+
$GraphRequest = $ErrorMessage
35+
}
36+
return ([HttpResponseContext]@{
37+
StatusCode = $StatusCode
38+
Body = @($GraphRequest)
39+
})
40+
}

‎Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ function Set-CIPPDefaultAPDeploymentProfile {
2020
)
2121

2222
try {
23-
if ($Language -in @('user-select', 'os-default')) { $Language = '' }
23+
if ($Language -in @('user-select', 'os-default')) { $Language = "$null" }
2424

2525
# userType in outOfBoxExperienceSetting is only valid for user-driven (singleUser) mode.
2626
# The Intune API rejects it for self-deploying (shared) mode.

0 commit comments

Comments
 (0)