diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json new file mode 100644 index 00000000000..e03b7547950 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/function.json @@ -0,0 +1,19 @@ +{ + "bindings": [ + { + "authLevel": "function", + "type": "httpTrigger", + "direction": "in", + "name": "Request", + "methods": [ + "get", + "post" + ] + }, + { + "type": "http", + "direction": "out", + "name": "Response" + } + ] +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 new file mode 100644 index 00000000000..178c2b8271d --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/GetInboxRule/run.ps1 @@ -0,0 +1,44 @@ +using namespace System.Net + +# Input bindings are passed in via param block. +param($Request, $TriggerMetadata) +$flag = 0 +# Write to the Azure Functions log stream. +Write-Host "Fetching list of Malware policies" + +$Mailbox = $Request.Body.Mailbox +# Interact with query parameters or the body of the request. + +try{ +if($Mailbox) +{ + $Result = Get-InboxRule -Mailbox "$Mailbox" + if($?){Write-Host "Successfully fetched list of Inbox Rules" + $flag = 1 +} + else + {Write-Host "Failed to fetch list of Inbox Rules"} + +}else + {Write-Host "Mailbox not provided : Failed to fetch list of Inbox Rules"} +} + +catch{ + Write-Host "$_.Exception" + $Result = "$_.Exception" +} + +finally{ +if($flag){ + # Associate values to output bindings by calling 'Push-OutputBinding'. + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Result + })}else{ + + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = $Result + }) + } +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip index fdfac24ccb9..b4812ae5379 100644 Binary files a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip and b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/O365DefenderFunctionApp.zip differ diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json new file mode 100644 index 00000000000..e03b7547950 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/function.json @@ -0,0 +1,19 @@ +{ + "bindings": [ + { + "authLevel": "function", + "type": "httpTrigger", + "direction": "in", + "name": "Request", + "methods": [ + "get", + "post" + ] + }, + { + "type": "http", + "direction": "out", + "name": "Response" + } + ] +} diff --git a/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 new file mode 100644 index 00000000000..be8cc5f8721 --- /dev/null +++ b/Solutions/Microsoft Defender for Office 365/Playbooks/CustomConnector/O365_Defender_FunctionAppConnector/RemoveInboxRule/run.ps1 @@ -0,0 +1,45 @@ +using namespace System.Net + +# Input bindings are passed in via param block. +param($Request, $TriggerMetadata) +$flag = 0 +# Write to the Azure Functions log stream. +Write-Host "Proceeding with delete of Inbox Rule" + +$Mailbox = $Request.Body.Mailbox +$Identity = $Request.Body.Identity +# Interact with query parameters or the body of the request. + +try{ +if($Mailbox -AND $Identity) +{ + $Result = Remove-InboxRule -Mailbox "$Mailbox" -Identity "$Identity" -Confirm:$false + if($?){Write-Host "Successfully Deleted the rule" + $flag = 1 +} + else + {Write-Host "Failed to delete Inbox Rules"} + +}else + {Write-Host "Mailbox or Identity not provided : Failed to delete Inbox Rules"} +} + +catch{ + Write-Host "$_.Exception" + $Result = "$_.Exception" +} + +finally{ +if($flag){ + # Associate values to output bindings by calling 'Push-OutputBinding'. + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::OK + Body = $Result + })}else{ + + Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{ + StatusCode = [HttpStatusCode]::NotFound + Body = $Result + }) + } +} \ No newline at end of file