Add Azure resources

Author: silverhack

…anagement/utils/New-MonkeyDiskObject.ps1 …t/helpers/disks/New-MonkeyDiskObject.ps1core/api/azure/resourcemanagement/utils/New-MonkeyDiskObject.ps1 renamed to core/api/azure/resourcemanagement/helpers/disks/New-MonkeyDiskObject.ps1 core/api/azure/resourcemanagement/utils/New-MonkeyDiskObject.ps1 renamed to core/api/azure/resourcemanagement/helpers/disks/New-MonkeyDiskObject.ps1

@@ -37,6 +37,7 @@ Function Get-MonkeyAzVMAVInfo {
     #>
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "", Scope="Function")]
 	[CmdletBinding()]
+    [OutputType([System.Boolean])]
 	Param (
         [Parameter(Mandatory=$True, ValueFromPipeline = $True, HelpMessage="VM object")]
         [Object]$InputObject
@@ -45,11 +46,11 @@ Function Get-MonkeyAzVMAVInfo {
         try{
             If($null -ne $InputObject.PsObject.Properties.Item('resources') -and $null -ne $InputObject.resources){
                 $av = @($InputObject.resources).Where({($_.Id -match "IaaSAntimalware" -or $_.Id -match "MDE.Windows" -or $_.Id -match "MDE.Linux") -and ($_.properties.provisioningState -ne 'Failed')})
-                if($av.Count -gt 0){
-                    $InputObject.isAVAgentInstalled = $True
+                If($av.Count -gt 0){
+                    return $True
                 }
-                else{
-                    $InputObject.isAVAgentInstalled = $false
+                Else{
+                    return $false
                 }
             }
         }

core/api/azure/resourcemanagement/helpers/virtualMachine/Get-MonkeyAzVMAVInfo.ps1

@@ -37,19 +37,34 @@ Function Get-MonkeyAzVMOMSInfo {
     #>
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "", Scope="Function")]
 	[CmdletBinding()]
+    [OutputType([System.Boolean])]
 	Param (
         [Parameter(Mandatory=$True, ValueFromPipeline = $True, HelpMessage="VM object")]
-        [Object]$InputObject
+        [Object]$InputObject,
+
+        [Parameter(Mandatory=$false, HelpMessage="Check for legacy OMS")]
+        [Switch]$Legacy
     )
     Process{
         try{
             If($null -ne $InputObject.PsObject.Properties.Item('resources') -and $null -ne $InputObject.resources){
-                $agent = @($vmObject.resources).Where({$_.Id -match "MicrosoftMonitoringAgent" -or $_.Id -match "OmsAgentForLinux"})
-                if($agent.Count -gt 0){
-                    $InputObject.isVMAgentInstalled = $True
+                If($PSBoundParameters.ContainsKey('Legacy') -and $PSBoundParameters['Legacy'].IsPresent){
+                    $agent = @($InputObject.resources).Where({$_.name -match "MicrosoftMonitoringAgent" -or $_.name -match "OmsAgentForLinux"})
+                    If($agent.Count -gt 0){
+                        return $True
+                    }
+                    Else{
+                        return $false
+                    }
                 }
-                else{
-                    $InputObject.isVMAgentInstalled = $false
+                Else{
+                    $agent = @($InputObject.resources).Where({$_.name -match "AzureMonitorAgent"})
+                    If($agent.Count -gt 0){
+                        return $True
+                    }
+                    Else{
+                        return $false
+                    }
                 }
             }
         }

core/api/azure/resourcemanagement/helpers/virtualMachine/Get-MonkeyAzVMOMSInfo.ps1

@@ -0,0 +1,80 @@
+# Monkey365 - the PowerShell Cloud Security Tool for Azure and Microsoft 365 (copyright 2022) by Juan Garrido
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+Function Get-MonkeyAzVMRestorePoint {
+    <#
+        .SYNOPSIS
+		Get Azure VM restore point
+
+        .DESCRIPTION
+		Get Azure VM restore point
+
+
+        .INPUTS
+
+        .OUTPUTS
+
+        .EXAMPLE
+
+        .NOTES
+	        Author		: Juan Garrido
+            Twitter		: @tr1ana
+            File Name	: Get-MonkeyAzVMRestorePoint
+            Version     : 1.0
+
+        .LINK
+            https://github.com/silverhack/monkey365
+    #>
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "", Scope="Function")]
+	[CmdletBinding()]
+	Param (
+        [Parameter(Mandatory=$True, ValueFromPipeline = $True, HelpMessage="VM object")]
+        [Object]$InputObject,
+
+        [parameter(Mandatory=$false, HelpMessage="API version")]
+        [String]$APIVersion = '2021-03-01'
+    )
+    Process{
+        Try{
+            #Set array
+		    $restorePoints = [System.Collections.Generic.List[System.Object]]::new()
+            $q = ('resources\n| where type =~ \"microsoft.compute/restorepointcollections\"\n | where properties.source.id =~ \"{0}\"\n| project id,\nlocation,\nname,\ntype,\nproperties' -f $InputObject.id);
+            $data = @{
+                subscriptions = @($O365Object.auth_tokens.ResourceManager.SubscriptionId);
+                query = $q;
+            } | ConvertTo-Json -Depth 10 -Compress | ForEach-Object { [System.Text.RegularExpressions.Regex]::Unescape($_) }
+
+            $p = @{
+                Resource = '/providers/Microsoft.ResourceGraph/resources';
+                Method = 'POST';
+                Data = $data;
+                ApiVersion = $APIVersion;
+                Verbose = $O365Object.verbose;
+                Debug = $O365Object.debug;
+                InformationAction = $O365Object.InformationAction;
+            }
+            $response = Get-MonkeyAzObjectById @p
+            If($null -ne $response -and $response.Count -gt 0){
+                ForEach($rp in $response.data){
+                    [void]$restorePoints.Add($rp);
+                }
+            }
+            #return Object
+            Write-Output $restorePoints -NoEnumerate
+        }
+        Catch{
+            Write-Verbose $_
+        }
+    }
+}