cves-to-patch-group

#################################################################################
#
#                               DISCLAIMER: EXAMPLE ONLY
#
# Execute this example at your own risk. Ivanti does 
# not warrant that the functions contained in this example will be
# uninterrupted or free of error. The entire risk as to the results and
# performance of this example is assumed by the person executing the example.
# Ivanti is not responsible for any damage caused by this example.
#
#################################################################################
<#
.SYNOPSIS
    This script can be used to parse a file containing CVE's and convert them into a patch group.
    Requires at least Powershell 5.1.

.PARAMETER FilePath
    File Path of CVE file.

.PARAMETER PatchGroupId
    Use a Patch Group id to add CVEs to an existing patch group. Mutually exclusive parameter from PatchGroupName.

.PARAMETER PatchGroupName
    Use a Patch Group name to create a new patch group. Mutually exclusive parameter from PatchGroupId.

.PARAMETER Activate
    Any patch configurations that are associated with the patch group will be automatically made active.

.PARAMETER AuditUser
    Name for audit records of who is making this change.

.PARAMETER ErrorPolicy
    Optional error policy specification. 'Throw' will stop at any unexpected issue; 'Omit' will continue.
    Default is Omit.

.PARAMETER RapidApiKey
    Key for Rapid API. It will be a about 50 alphanumeric characters.

.PARAMETER RapidApiHost
    Host location for Rapid API.

.PARAMETER Token
    The JWT token value of a bearer token.
    Alternatively, supply the tenant id, client id, and client secret for the script to retrieve this token.

.PARAMETER TenantId
    Id in GUID format of the tenant for which the authorization is to occur.

.PARAMETER ClientId
    Client Id for Rapid API. It will start with something like "AppReg_" and contain a guid.
    
.PARAMETER ClientSecret
    Client Secret for Rapid API. It will be about a 24 alphanumeric-symbolic sequence. 

.PARAMETER LogFilePath
    Log file path. The default log file path will be the current file path location.

.EXAMPLE
    .\Import-CvesToPatchGroup.ps1 -FilePath "C:\MyCveFile.txt" -PatchGroupName "mynewpatchgroupname" -AuditUser "Jen Barber" -RapidApiHost "neurons-for-patch-management.ivanti.rapidapi.com" -RapidApiKey "d123mc0..." -TenantId "e6d802ca-fdf4-4a85-8eac-d5684267b170" -ClientId "AppReg_...." -ClientSecret (Read-Host "Enter the Client Secret" -AsSecureString)
    This example creates a new patch group with CVEs. The client secret is read from user input.

.EXAMPLE
    .\Import-CvesToPatchGroup.ps1 -FilePath "C:\MyCveFile.txt" -PatchGroupName "mynewpatchgroupname" -AuditUser "Jen Barber" -RapidApiHost "neurons-for-patch-management.ivanti.rapidapi.com" -RapidApiKey "d123mc0..." -Token (Read-Host "Enter the Auth Token" -AsSecureString)
    This example creates a new patch group with CVEs. The authentication token is read from user input.
         
.EXAMPLE
    .\Import-CvesToPatchGroup.ps1 -FilePath "C:\MyCveFile.txt" -PatchGroupId "fb8d219d-ed06-44a7-ba08-814888aaccfd" -Activate $True -AuditUser "Jen Barber" -RapidApiHost "neurons-for-patch-management.ivanti.rapidapi.com" -RapidApiKey "d123mc0..." -TenantId "e6d802ca-fdf4-4a85-8eac-d5684267b170" -ClientId "AppReg_...." -ClientSecret (Read-Host "Enter the Client Secret" -AsSecureString)
    This example adds CVEs to an existing patch group. The client secret is read from user input.
         
.EXAMPLE
    .\Import-CvesToPatchGroup.ps1 -FilePath "C:\MyCveFile.txt" -PatchGroupId "fb8d219d-ed06-44a7-ba08-814888aaccfd" -Activate $True -AuditUser "Jen Barber" -RapidApiHost "neurons-for-patch-management.ivanti.rapidapi.com" -RapidApiKey "d123mc0..." -Token (Read-Host "Enter the Auth Token" -AsSecureString)
    This example adds CVEs to an existing patch group. The authentication token is read from user input.
#>

[CmdletBinding(DefaultParameterSetName = 'AddAndGetToken')]
param
(
    # File Path of CVE file.
    [Parameter(Mandatory = $true)]
    [ValidateScript( { Test-Path $_ -PathType Leaf })]
    [String]$FilePath,

    # Use a Patch Group id to add CVEs to an existing patch group. 
    [Parameter(Mandatory = $true, ParameterSetName = 'AddAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'AddWithToken')]
    [Guid]$PatchGroupId,

    # Use a Patch Group name to create a new patch group.
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateWithToken')]
    [ValidateNotNullOrEmpty()]
    [String]$PatchGroupName,

    # Any patch configurations that are associated with the patch group will be automatically made active.
    [Parameter(Mandatory = $true, ParameterSetName = 'AddAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'AddWithToken')]
    [Bool]$Activate,

    # Name for audit records of who is making this change.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$AuditUser,

    # Optional error policy specification. 'Throw' will stop at any unexpected issue; 'Omit' will continue.
    # Default is Omit.
    [Parameter(Mandatory = $false, HelpMessage = 'Valid error policy values are [None|Omit|Throw]')]
    [String]$ErrorPolicy = 'Omit',

    # Key for Rapid API. It will be a about 50 alphanumeric characters.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$RapidApiKey,

    # Host location for Rapid API.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$RapidApiHost, 

    # The JWT token value of a bearer token.
    [Parameter(Mandatory = $true, ParameterSetName = 'AddWithToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateWithToken')]
    [ValidateNotNullOrEmpty()]
    [Security.SecureString]$Token,

    # Id in GUID format of the tenant for which the authorization is to occur.
    [Parameter(Mandatory = $true, ParameterSetName = 'AddAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateAndGetToken')]
    [Guid]$TenantId,

    # Client Id for Rapid API. It will start with something like "AppReg_" and contain a guid.
    [Parameter(Mandatory = $true, ParameterSetName = 'AddAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateAndGetToken')]
    [ValidateNotNullOrEmpty()]
    [String]$ClientId,
    
    # Client Secret for Rapid API. It will be about a 24 alphanumeric-symbolic sequence. 
    [Parameter(Mandatory = $true, ParameterSetName = 'AddAndGetToken')]
    [Parameter(Mandatory = $true, ParameterSetName = 'CreateAndGetToken')]
    [ValidateNotNullOrEmpty()]
    [Security.SecureString]$ClientSecret,

    # Log file path. The default log file path will be the current file path location.
    [Parameter(Mandatory = $false)]
    [ValidateScript( { Test-Path $_ -PathType Leaf })] 
    [String]$LogFilePath = '.\Import-CvesToPatchGroup.log'
)

function Read-CvesToHashSetFromFile
{
    param
    (
        [String]$filePath
    )

    $cveHashSet = [System.Collections.Generic.HashSet[String]]@()
    $options = [Text.RegularExpressions.RegexOptions]::IgnoreCase -bor [Text.RegularExpressions.RegexOptions]::Multiline -bor [Text.RegularExpressions.RegexOptions]::Compiled
    $regex = '(CVE|CAN)-(1999|2\d{3})-(0\d{3}(?!\d)|[1-9]\d{3,})'
    foreach ($line in Get-Content $filePath)
    {
        $matches = [regex]::Matches($line, $regex, $options)
        if ($matches.Success -eq $true)
        {
            foreach($match in $matches)
            {
                $cveHashSet.Add($match.Value.ToUpper()) | Out-Null
            }
        }
    }

    if ($cveHashSet.Count -gt 0)
    {
        Write-Information "$($cveHashSet.Count) CVE(s) were successfully parsed from given file path."
    }
    else
    {
        Write-Information "No CVE's were found in given file path."
        exit
    }

    return $cveHashSet
}

function New-CvesToPatchGroup
{
    param
    (
        [String]$patchGroupName,
        [System.Collections.Generic.HashSet[String]]$cveHashSet,
        [string]$errorPolicy,
        [string]$auditUser,
        [string]$apiVersion,
        [string]$apiKey,
        [string]$apiHost,
        [Security.SecureString]$token
    )

    $cveBody = @{ DataUpdateErrorPolicy = $errorPolicy; CveIds = @($cveHashSet); PatchGroupName = $patchGroupName; }
    Invoke-RestCall -method 'POST' -body $cveBody -auditUser $auditUser -apiVersion $apiVersion -apiKey $apiKey -apiHost $apiHost -token $token
}

function Add-CvesToPatchGroup
{
    param
    (
        [Guid]$patchGroupId,
        [System.Collections.Generic.HashSet[String]]$cveHashSet,
        [Bool] $activateAssociatedPolicies,
        [string]$errorPolicy,
        [string]$auditUser,
        [string]$apiVersion,
        [string]$apiKey,
        [string]$apiHost,
        [Security.SecureString]$token
    )

    $cveBody = @{ DataUpdateErrorPolicy = $errorPolicy; CveIds = @($cveHashSet); PatchGroupId = $patchGroupId; ActivateAssociatedPolicies = $activateAssociatedPolicies }
    Invoke-RestCall -method 'PUT' -body $cveBody -auditUser $auditUser -apiVersion $apiVersion -apiKey $apiKey -apiHost $apiHost -token $token
}

function Invoke-RestCall
{
    param
    (
        [Microsoft.PowerShell.Commands.WebRequestMethod]$method,
        [object]$body,
        [string]$auditUser,
        [string]$apiVersion,
        [string]$apiKey,
        [string]$apiHost,
        [Security.SecureString]$token
    )

    if (-not ($null -eq $body))
    {
        $body = ConvertTo-JSon $body -Depth 99
    }

    $uri = "https://neurons-for-patch-management.p.rapidapi.com/v1/cves-to-patch-group"
    
    $headers = @{
        "X-RapidAPI-Key"  = $apiKey
        "X-RapidAPI-Host" = $apiHost
        "X-On-Behalf-Of"  = $auditUser
        "Authorization"   = "Bearer " + [System.Net.NetworkCredential]::new('', $token).Password
        "Content-Type"    = "application/json"
    }
    Invoke-RestMethod -Uri $uri -Method $method -Headers $headers -ContentType 'application/json' -Body $body | ConvertTo-Json
}

function Read-ErrorDetails
{
    param
    (
        [System.Net.WebException]$exception
    )

    if ($exception -eq $null)
    {
        return [string]::Empty
    }
    $streamReader = [System.IO.StreamReader]::new($exception.Response.GetResponseStream())
    $ErrResp = $streamReader.ReadToEnd() | ConvertFrom-Json
    $streamReader.Close()

    $ErrResp
}

Start-Transcript -Append "$LogFilePath" | Out-Null
try
{
    if ([System.String]::IsNullOrWhiteSpace($AuditUser))
    {
        Write-Information "The audit user cannot be empty. Terminating script."
        return
    }

    $cveHashSet = Read-CvesToHashSetFromFile -filePath $FilePath

    if ($token.Length -eq 0)
    {
        $token = .\Get-AuthToken.ps1 -TenantId $TenantId -ClientId $ClientId -ClientSecret $ClientSecret -RapidApiHost $RapidApiHost -RapidApiKey $RapidApiKey -LogFilePath $LogFilePath
    }
    
    if ($PatchGroupId -ne $null)
    {
        Write-Information "Adding to the existing patch group: $PatchGroupId"
        Add-CvesToPatchGroup -patchGroupId $PatchGroupId -cveHashSet $cveHashSet -errorPolicy $ErrorPolicy -auditUser $AuditUser -apiVersion $ApiVersion -activateAssociatedPolicies $Activate -apiKey $RapidApiKey -apiHost $RapidApiHost -token $Token
    }
    elseif (!([string]::IsNullOrEmpty($PatchGroupName)))
    {
        Write-Information "Create a new patch group with the name $PatchGroupName"
        New-CvesToPatchGroup -patchGroupName $PatchGroupName -cveHashSet $cveHashSet -errorPolicy $ErrorPolicy -auditUser $AuditUser -apiVersion $ApiVersion -apiKey $RapidApiKey -apiHost $RapidApiHost -token $Token
    }
    else 
    {
        Write-Information "A patch group id, or a patch group name, must be supplied. Terminating script."
    }
}
catch [Exception]
{
    $private:e = $_.Exception

    if ($private:e.Response.StatusCode -eq "BadRequest")
    {
        $errorDetails = Read-ErrorDetails -exception $private:e
        $msg = $errorDetails.title + ": " + $errorDetails.detail
        Write-Error -Message $msg
    }
    elseif ($private:e.Response.StatusCode -eq "Unauthorized")
    {
        Write-Error -Exception $private:e -Category AuthenticationError 
        Write-Information "Validate that the combination of token, tenantid, host, and key are correct."    
    }
    else 
    {
        Write-Error -Exception $private:e
    }
}
finally
{
    Stop-Transcript | Out-Null
}

#################################################################################
#
#                               DISCLAIMER: EXAMPLE ONLY
#
# Execute this example at your own risk. Ivanti does 
# not warrant that the functions contained in this example will be
# uninterrupted or free of error. The entire risk as to the results and
# performance of this example is assumed by the person executing the example.
# Ivanti is not responsible for any damage caused by this example.
#
#################################################################################
<#
.SYNOPSIS
    Retrieve an authorization token for calling APIs in Ivanti's public Rapid APIs.
    Requires at least Powershell 5.1.

.PARAMETER TenantId
    Id in GUID format of the tenant for which the authorization is to occur.

.PARAMETER ClientId
    Client Id for Rapid API. It will start with something like "AppReg_" and contain a guid.

.PARAMETER ClientSecret
    Client Secret for Rapid API. It will be about a 24 alphanumeric-symbolic sequence.

.PARAMETER RapidApiKey
    Key for Rapid API. It will be a ~50-character alphanumeric string

.PARAMETER RapidApiHost
    Host location for Rapid API.

.PARAMETER ApiVersion
    Optional version of the Authentication API.

.PARAMETER LogFilePath
    Log file path. The default log file path will be the current file path location.

.EXAMPLE
    .\Get-AuthToken.ps1 -TenantId "28742dc0-9e49-4a21-9f8b-b6ba3b631575" -ClientId "AppReg_..." -ClientSecret (Read-Host -AsSecureString) -RapidApiHost "neurons-for-patch-management.ivanti.rapidapi.com" -RapidApiKey "d123mc0..."
    This example retrieves a bearer access token as a SecureString. The client id parameter is read from user input.
#>

param
(
    # Id in GUID format of the tenant for which the authorization is to occur.
    [Parameter(Mandatory = $true)]
    [Guid]$TenantId,

    # Client Id for Rapid API. It will start with something like "AppReg_" and contain a guid.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$ClientId,
    
    # Client Secret for Rapid API. It will be about a 24 alphanumeric-symbolic sequence. 
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [Security.SecureString]$ClientSecret,

    # Key for Rapid API. It will be a about 50 alphanumeric characters.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$RapidApiKey,

    # Host location for Rapid API.
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [String]$RapidApiHost, 

    # Log file path. The default log file path will be the current file path location.
    [Parameter(Mandatory = $false)]
    [ValidateScript( { Test-Path $_ -PathType Leaf })] 
    [String]$LogFilePath = '.\Get-AuthToken.log'
)


    function Invoke-RestCall
    {
        param
        (
            [Guid]$tenantId,
            [Security.SecureString]$clientSecret,
            [string]$clientId,
            [string]$apiKey,
            [string]$apiHost,
            [string]$apiVersion
        )

        $uri = "https://neurons-for-patch-management.p.rapidapi.com/v1/authentication"

        $requestParams = @{
            Method = 'GET'
            Uri = $uri
            Headers = @{
                "X-TenantId"      = $tenantId
                "X-ClientSecret"  = [System.Net.NetworkCredential]::new('', $clientSecret).Password
                "X-ClientId"      = $clientId
                "X-RapidAPI-Key"  = $apiKey
                "X-RapidAPI-Host" = $apiHost
            }
        }

        # Returned Json structure returns with an 'expires_in' and 'token_type' properties also. 
        # The token_type is expected to always be of type "Bearer".
        (Invoke-RestMethod @requestParams).access_token | ConvertTo-SecureString -AsPlainText -Force 
    }

function Read-ErrorDetails
{
    param
    (
        [System.Net.WebException]$exception
    )

    if ($exception -eq $null)
    {
        return [string]::Empty
    }
    $streamReader = [System.IO.StreamReader]::new($exception.Response.GetResponseStream())
    $ErrResp = $streamReader.ReadToEnd() | ConvertFrom-Json
    $streamReader.Close()

    $ErrResp
}

Start-Transcript -Append "$LogFilePath" | Out-Null
try
{
    return Invoke-RestCall -tenantId $TenantId -clientId $ClientId  -clientSecret $ClientSecret -apiKey $RapidApiKey -apiHost $RapidApiHost -apiVersion $ApiVersion 
}
catch [Exception]
{
    $private:e = $_.Exception

    if ($private:e.Response.StatusCode -eq "Unauthorized")
    {
        Write-Error -Exception $private:e -Category AuthenticationError 
        Write-Information "Validate that the combination of tenant id, client id, client secret, rapid api key and rapid api host are correct."    
    }
    else 
    {
        Write-Error -Exception $private:e
    }
}
finally
{
    Stop-Transcript | Out-Null
}