psPAS/Functions/EventSecurity/Set-PASPTARule.ps1

# .ExternalHelp psPAS-help.xml
Function Set-PASPTARule {
	[CmdletBinding(SupportsShouldProcess)]
	param(
		[parameter(
			Mandatory = $true,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateRange(1, [int]::MaxValue)]
		[string]$id,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateSet('SSH', 'WINDOWS', 'SCP', 'KEYSTROKES', 'SQL')]
		[string]$category,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[string]$regex,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateRange(1, 100)]
		[int]$score,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[string]$description,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateSet('NONE', 'TERMINATE', 'SUSPEND')]
		[string]$response,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[boolean]$active,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateSet('EXCLUDE', 'INCLUDE')]
		[string]$vaultUsersMode,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[string[]]$vaultUsersList,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[ValidateSet('EXCLUDE', 'INCLUDE')]
		[string]$machinesMode,

		[parameter(
			Mandatory = $false,
			ValueFromPipelinebyPropertyName = $true
		)]
		[string[]]$machinesList

	)

	BEGIN {
		Assert-VersionRequirement -SelfHosted
		Assert-VersionRequirement -RequiredVersion 10.4
		$userScopeParams = [Collections.Generic.List[String]]@('vaultUsersMode', 'vaultUsersList')
		$machineScopeParams = [Collections.Generic.List[String]]@('machinesMode', 'machinesList')
		$scopeParams = [Collections.Generic.List[String]]@($userScopeParams + $machineScopeParams)

	}#begin

	PROCESS {

		#Get all parameters that will be sent in the request
		$boundParameters = $PSBoundParameters | Get-PASParameter

		$PTARule = (Get-PASPTARule).Where({ $PSitem.ID -eq $id })
		if ($null -ne $PTARule) {
			Format-PutRequestObject -InputObject $PTARule -boundParameters $BoundParameters -ParametersToRemove mode, list
		}

		#Create URL for Request
		$URI = "$($psPASSession.BaseURI)/API/pta/API/Settings/RiskyActivity/"

		switch ($PSBoundParameters.keys) {

			{ $scopeParams -contains $PSItem } {

				#Current parameter relates to scope section of request object
				if (-not($boundParameters.ContainsKey('scope'))) {
					#create the scope key
					$boundParameters.Add('scope', @{})
				}

				#determine whether vaultUsers or machines scope item
				if ($userScopeParams -contains $PSItem) {
					$scopeItem = 'vaultUsers'
				} elseif ( $machineScopeParams -contains $PSItem) {
					$scopeItem = 'machines'
				}

				#add scope item key to bond parameters
				if (-not($boundParameters['scope'].ContainsKey($scopeItem))) {
					$boundParameters['scope'].Add($scopeItem, @{})
				}
				#translate parameter names into request property name
				#* Return only last 4 characters of parametername in lowercase
				#*vaultUsersMode & machinesMode translate to "mode"
				#*vaultUsersList & machinesList translate to "list"
				$property = ($PSItem).Substring(($PSItem).length - 4, 4).ToLower()

				if ($null -ne $PSBoundParameters[$PSItem]) {
					#Add scope parameter vaultUsers & machines request values to boundParameters
					$boundParameters['scope'][$scopeItem][$property] = $PSBoundParameters[$PSItem]
				} else {
					#clear vaultUsers/machine scope if null value specified
					$boundParameters['scope'][$scopeItem] = $null
				}


			}

		}

		switch ($boundParameters) {
			{ $PSItem.keys -contains 'scope' } {
				#BoundParameteters Contains Scope Key
				switch ($boundParameters['scope']) {
					{ $PSItem.ContainsKey('vaultUsers') -and (-not($PSItem.ContainsKey('machines'))) } {
						#vaultUser Scope is being updated - copy existing machines scope
						$boundParameters['scope']['machines'] = $PTARule.scope.machines
					}

					{ $PSItem.ContainsKey('machines') -and (-not($PSItem.ContainsKey('vaultUsers'))) } {
						#machines Scope is being updated - copy existing vaultUsers scope
						$boundParameters['scope']['vaultUsers'] = $PTARule.scope.vaultUsers
					}
				}

			}
			default {
				#No updated scope specified - Use existing scope copied from rule
				'third'
				$boundParameters['scope'] = $PTARule.scope
			}
		}
		#Create body of request
		#* Ensure JSON Depth of 3 to capture correct scope format
		$Body = $boundParameters | Get-PASParameter -ParametersToRemove $scopeParams | ConvertTo-Json -Depth 3

		if ($PSCmdlet.ShouldProcess($id, 'Update Risky Activity Rule')) {

			#send request to PAS web service
			Invoke-PASRestMethod -Uri $URI -Method PUT -Body $Body

		}

	}#process

	END { }#end

}