Skip to content

Commit

Permalink
Revert "event examples"
Browse files Browse the repository at this point in the history
This reverts commit 55d8a1f.
  • Loading branch information
jworkmanjc committed Apr 2, 2024
1 parent 7f06418 commit c1b99d5
Show file tree
Hide file tree
Showing 2 changed files with 74 additions and 98 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,37 +12,13 @@ Query the API for Directory Insights events
curl -X POST 'https://api.jumpcloud.com/insights/directory/v1/events' -H 'Content-Type: application/json' -H 'x-api-key: REPLACE_KEY_VALUE' --data '{\"service\": [\"all\"], \"start_time\": \"2021-07-14T23:00:00Z\", \"end_time\": \"2021-07-28T14:00:00Z\", \"sort\": \"DESC\", \"fields\": [\"timestamp\", \"event_type\", \"initiated_by\", \"success\", \"client_ip\", \"provider\", \"organization\"]}'
```
.Example
PS C:\> Get-JCEvent -Service:('all') -StartTime:((Get-date).AddDays(-30))
PS C:\> {{ Add code here }}
Pull all event records from the last thirty days
{{ Add output here }}
.Example
PS C:\> Get-JCEvent -Service:('directory') -StartTime:((Get-date).AddHours(-1)) -Limit:('10')
PS C:\> {{ Add code here }}
Get directory results from the last hour limit to the last 10 results in the time range
.Example
PS C:\> Get-JCEvent -Service:('directory') -StartTime:((Get-date).AddDays(-30)) -Sort:("DESC") -EndTime:((Get-date).AddDays(-5))
Get directory results between 30 and 5 days ago, sort timestamp by descending value
.Example
PS C:\> Get-JCEvent -Service:('directory') -StartTime:((Get-date).AddDays(-30)) -Limit:('10') -searchTermAnd:@{"event_type" = "group_create"}
Get only group_create from the last thirty days
.Example
PS C:\> Get-JCEvent -Service:('all') -StartTime:('2020-04-14T00:00:00Z') -EndTime:('2020-04-20T23:00:00Z') -SearchTermOr @{"initiated_by.username" = @("user.1", "user.2")}
Get login events initiated by either "user.1" or "user.2" between a universal time zone range
.Example
PS C:\> Get-JCEvent -Service:('all') -StartTime:('2020-04-14T00:00:00Z') -EndTime:('2020-04-20T23:00:00Z') -SearchTermAnd @{"event_type" = "admin_login_attempt"; "resource.email" = "admin.user@adminbizorg.com"}
Get all events between a date range and match event_type = admin_login_attempt and resource.email = admin.user@adminbizorg.com
.Example
PS C:\> Get-JCEvent -Service:('sso') -StartTime:('2020-04-14T00:00:00Z') -EndTime:('2020-04-20T23:00:00Z') -SearchTermAnd @{"initiated_by.username" = "user.1"}
Get sso events with the search term initiated_by: username with value "user.1"
.Example
PS C:\> Get-JCEvent -Service:('all') -StartTime:('2020-04-14T00:00:00Z') -EndTime:('2020-04-20T23:00:00Z') -SearchTermAnd @{"event_type" = "organization_update"}
Get all events filtered by organization_update term between a date range
{{ Add output here }}
.Inputs
JumpCloud.SDK.DirectoryInsights.Models.IEventQuery
Expand All @@ -69,91 +45,95 @@ BODY <IEventQuery>: EventQuery is the users' command to search our auth logs
.Link
https://github.com/TheJumpCloud/jcapi-powershell/tree/master/SDKs/PowerShell/JumpCloud.SDK.DirectoryInsights/docs/exports/Get-JcSdkEvent.md
#>
Function Get-JCEvent {
[OutputType([JumpCloud.SDK.DirectoryInsights.Models.IPost200ApplicationJsonItemsItem])]
[CmdletBinding(DefaultParameterSetName = 'GetExpanded', PositionalBinding = $false, SupportsShouldProcess, ConfirmImpact = 'Medium')]
Param(
[Parameter(ParameterSetName = 'GetExpanded', Mandatory)]
Function Get-JCEvent
{
[OutputType([JumpCloud.SDK.DirectoryInsights.Models.IPost200ApplicationJsonItemsItem])]
[CmdletBinding(DefaultParameterSetName='GetExpanded', PositionalBinding=$false, SupportsShouldProcess, ConfirmImpact='Medium')]
Param(
[Parameter(ParameterSetName='GetExpanded', Mandatory)]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# service name to query.
${Service},

[Parameter(ParameterSetName = 'GetExpanded', Mandatory)]
[Parameter(ParameterSetName='GetExpanded', Mandatory)]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.DateTime]
# query start time, UTC in RFC3339 format
${StartTime},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.DateTime]
# optional query end time, UTC in RFC3339 format
${EndTime},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# optional list of fields to return from query
${Fields},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String]
# optional string for specifying a full text query
${Q},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# Specific query to search after, see x-* response headers for next values
${SearchAfter},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermAnd},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermNot},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermOr},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String]
# ASC or DESC order for timestamp
${Sort},

[Parameter(ParameterSetName = 'Get', Mandatory, ValueFromPipeline)]
[Parameter(ParameterSetName='Get', Mandatory, ValueFromPipeline)]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Models.IEventQuery]
# EventQuery is the users' command to search our auth logs
# To construct, see NOTES section for BODY properties and create a hash table.
${Body}
)
Begin {
Connect-JCOnline -force | Out-Null
$Results = @()
}
Process {
$Results = JumpCloud.SDK.DirectoryInsights\Get-JcSdkEvent @PSBoundParameters
}
End {
Return $Results
}
)
Begin
{
Connect-JCOnline -force | Out-Null
$Results = @()
}
Process
{
$Results = JumpCloud.SDK.DirectoryInsights\Get-JcSdkEvent @PSBoundParameters
}
End
{
Return $Results
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -12,21 +12,13 @@ Query the API for a count of matching events
curl -X POST 'https://api.jumpcloud.com/insights/directory/v1/events/count' -H 'Content-Type: application/json' -H 'x-api-key: REPLACE_KEY_VALUE' --data '{\"service\": [\"all\"], \"start_time\": \"2021-07-14T23:00:00Z\", \"end_time\": \"2021-07-28T14:00:00Z\", \"sort\": \"DESC\", \"fields\": [\"timestamp\", \"event_type\", \"initiated_by\", \"success\", \"client_ip\", \"provider\", \"organization\"]}'
```
.Example
PS C:\> Get-JCEventCount -Service:('all') -StartTime:((Get-date).AddDays(-30))
PS C:\> {{ Add code here }}
Pull all event records from a specified time and count the results
{{ Add output here }}
.Example
PS C:\> Get-JCEventCount -Service:('sso') -StartTime:('2020-04-14T00:00:00Z')
PS C:\> {{ Add code here }}
Pull all SSO event records from a specified time and count the results
.Example
PS C:\> Get-JCEventCount -Service:('all') -StartTime:('2020-04-14T00:00:00Z') -EndTime:('2020-04-20T23:00:00Z') -SearchTermAnd @{"event_type" = "admin_login_attempt"; "resource.email" = "admin.user@adminbizorg.com"}
Get all events counts between a date range and match event_type = admin_login_attempt and resource.email = admin.user@adminbizorg.com
.Example
PS C:\> Get-JCEventCount -Service:('directory') -StartTime:((Get-date).AddDays(-30)) -searchTermAnd:@{"event_type" = "group_create"}
Get only group_create event counts the last thirty days
{{ Add output here }}
.Inputs
JumpCloud.SDK.DirectoryInsights.Models.IEventQuery
Expand All @@ -53,91 +45,95 @@ BODY <IEventQuery>: EventQuery is the users' command to search our auth logs
.Link
https://github.com/TheJumpCloud/jcapi-powershell/tree/master/SDKs/PowerShell/JumpCloud.SDK.DirectoryInsights/docs/exports/Get-JcSdkEventCount.md
#>
Function Get-JCEventCount {
[OutputType([System.Int64])]
[CmdletBinding(DefaultParameterSetName = 'GetExpanded', PositionalBinding = $false, SupportsShouldProcess, ConfirmImpact = 'Medium')]
Param(
[Parameter(ParameterSetName = 'GetExpanded', Mandatory)]
Function Get-JCEventCount
{
[OutputType([System.Int64])]
[CmdletBinding(DefaultParameterSetName='GetExpanded', PositionalBinding=$false, SupportsShouldProcess, ConfirmImpact='Medium')]
Param(
[Parameter(ParameterSetName='GetExpanded', Mandatory)]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# service name to query.
${Service},

[Parameter(ParameterSetName = 'GetExpanded', Mandatory)]
[Parameter(ParameterSetName='GetExpanded', Mandatory)]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.DateTime]
# query start time, UTC in RFC3339 format
${StartTime},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.DateTime]
# optional query end time, UTC in RFC3339 format
${EndTime},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# optional list of fields to return from query
${Fields},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String]
# optional string for specifying a full text query
${Q},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[AllowEmptyCollection()]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String[]]
# Specific query to search after, see x-* response headers for next values
${SearchAfter},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermAnd},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermNot},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes = ([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[JumpCloud.SDK.DirectoryInsights.Runtime.Info(PossibleTypes=([JumpCloud.SDK.DirectoryInsights.Models.ITermConjunction]))]
[System.Collections.Hashtable]
# TermConjunction represents a conjunction (and/or)NOTE: the validator limits what the operator can be, not the objectfor future-proof-nessand a list of sub-values
${SearchTermOr},

[Parameter(ParameterSetName = 'GetExpanded')]
[Parameter(ParameterSetName='GetExpanded')]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[System.String]
# ASC or DESC order for timestamp
${Sort},

[Parameter(ParameterSetName = 'Get', Mandatory, ValueFromPipeline)]
[Parameter(ParameterSetName='Get', Mandatory, ValueFromPipeline)]
[JumpCloud.SDK.DirectoryInsights.Category('Body')]
[JumpCloud.SDK.DirectoryInsights.Models.IEventQuery]
# EventQuery is the users' command to search our auth logs
# To construct, see NOTES section for BODY properties and create a hash table.
${Body}
)
Begin {
Connect-JCOnline -force | Out-Null
$Results = @()
}
Process {
$Results = JumpCloud.SDK.DirectoryInsights\Get-JcSdkEventCount @PSBoundParameters
}
End {
Return $Results
}
)
Begin
{
Connect-JCOnline -force | Out-Null
$Results = @()
}
Process
{
$Results = JumpCloud.SDK.DirectoryInsights\Get-JcSdkEventCount @PSBoundParameters
}
End
{
Return $Results
}
}

0 comments on commit c1b99d5

Please sign in to comment.