CyThreats.ps1

<#
.SYNOPSIS
    Gets the threat list

.PARAMETER API
    Optional. API Handle (use only when not using session scope).
#>
function Get-CyThreatList {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle
        )

    Read-CyData -API $API -Uri "$($API.BaseUrl)/threats/v2"
}

<#
.SYNOPSIS
    Gets the threat list for the given device

.PARAMETER API
    Optional. API Handle (use only when not using session scope).

.PARAMETER Device
    The device to retrieve the threats for.
#>
function Get-CyDeviceThreatList {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle,
        [Parameter(Mandatory=$true,ParameterSetName="ByDevice",ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
        [object]$Device,
        [Parameter(Mandatory=$true,ParameterSetName="ByDeviceId")]
        [object]$DeviceId
        )

    Process {
        switch ($PSCmdlet.ParameterSetName) {
            "ByDevice" {
                $Uri = "$($API.BaseUrl)/devices/v2/$($Device.id)/threats"
            }
            "ByDeviceId" {
                $Uri = "$($API.BaseUrl)/devices/v2/$($DeviceId)/threats"
            }
        }
        
        Read-CyData -API $API -Uri $Uri    
    }
}

<#
.SYNOPSIS
    Update a device threat.

.PARAMETER API
    Optional. API Handle (use only when not using session scope).

.PARAMETER Action
    The action to take (quarantine or waive the threat)

.PARAMETER Device
    The device object to apply this threat action to.
#>
function Update-CyDeviceThreat {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle,
        [Parameter(
            Mandatory=$true, 
            ValueFromPipeline=$true,
            ValueFromPipelineByPropertyName=$true)]
            [object[]]$DeviceThreat,
        [Parameter(Mandatory=$true)]
        [ValidateSet("Quarantine", "Waive")]
        [String]$Action,
        [Parameter(Mandatory=$true,ParameterSetName="ByDevice")]
        [object]$Device,
        [Parameter(Mandatory=$true,ParameterSetName="ByDeviceId")]
        [object]$DeviceId

    )

    Begin {
    }

    Process {
        $hash = $DeviceThreat.sha256
        if ($null -eq $hash) {
            $hash = $DeviceThreat
        }

        $updateMap = @{
            "threat_id" = $($hash)
            "event" = $Action
        }

        $json = $updateMap | ConvertTo-Json
        # remain silent
        switch ($PSCmdlet.ParameterSetName) {
            "ByDeviceId" {
                $output = Invoke-CyRestMethod -API $API -Method POST -Uri "$($API.BaseUrl)/devices/v2/$($DeviceId)/threats" -ContentType "application/json; charset=utf-8" -Body $json
            }
            "ByDevice" {
                $output = Invoke-CyRestMethod -API $API -Method POST -Uri "$($API.BaseUrl)/devices/v2/$($Device.id)/threats" -ContentType "application/json; charset=utf-8" -Body $json
            }
        }
        
    }
}

<#
.SYNOPSIS
    Retrieves the given threat's Detail from the console. Gets full data, not a shallow version.

.PARAMETER API
    Optional. API Handle (use only when not using session scope).

.PARAMETER SHA256
    A collection of SHA256 values (as strings) to retrieve the data for, or threat objects with a "sha256" property.
#>
function Get-CyThreatDetail {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle,
        [Parameter(Mandatory=$true, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [object]$SHA256
        )

    Process {
        if ($SHA256 -is [String]) {
            $Hash = $SHA256
        } elseif (![String]::IsNullOrEmpty($SHA256.sha256)) {
            $Hash = $SHA256.sha256
        } else {
            Throw "Cannot determine SHA256 value from threat object"
        }
        Invoke-CyRestMethod -API $API -Method GET -Uri  "$($API.BaseUrl)/threats/v2/$($Hash)" | Convert-CyObject
    }
}

<#
.SYNOPSIS
    Retrieves a download link for the given threat

.PARAMETER API
    Optional. API Handle (use only when not using session scope).

.PARAMETER SHA256
    The threat to retrieve the download link for.
#>
function Get-CyThreatDownloadLink {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle,
        [Parameter(
            Mandatory=$true, 
            ValueFromPipeline=$true,
            ValueFromPipelineByPropertyName=$true)]
            [String[]]$SHA256
        )

    Process {
        Invoke-CyRestMethod -API $API -Method GET -Uri  "$($API.BaseUrl)/threats/v2/download/$($SHA256)" 
    }
}


<#
.SYNOPSIS
    Gets the devices affected by a particular threat.

.PARAMETER API
    Optional. API Handle (use only when not using session scope).

.PARAMETER SHA256
    The threat SHA256 hash
#>
function Get-CyThreatDeviceList {
    Param (
        [parameter(Mandatory=$false)]
        [ValidateNotNullOrEmpty()]
        [CylanceAPIHandle]$API = $GlobalCyAPIHandle,
        [Parameter(Mandatory=$true, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [object]$SHA256
        )

    Process {
        if ($SHA256 -is [String]) {
            $Hash = $SHA256
        } elseif (![String]::IsNullOrEmpty($SHA256.sha256)) {
            $Hash = $SHA256.sha256
        } else {
            Throw "Cannot determine SHA256 value from threat object"
        }

        Read-CyData -API $API -Uri "$($API.BaseUrl)/threats/v2/$($Hash)/devices"
    }
}