Publish-BluGenieArtifact



Publish-BluGenieArtifact

SYNOPSIS

Manage Artifact data from a JSON/YAML file to query local and remote systems for a specfic Indicator of compromise or IOC

SYNTAX

Publish-BluGenieArtifact [[-Artifact] <String>] [-Import] [[-Export] <String>] [-Remove] [-Review] [[-ExportType] <String>] [-Walkthrough] [<CommonParameters>]

DESCRIPTION

Import, Export, and Review Artifact data from a JSON/YAML file. Artifacts are contructed logic to query local and remote systems for a specfic Indicator of compromise or IOC

IOC is a forensic term that refers to the evidence on a device that points out to a security breach. The data of IOC is gathered after a suspicious incident, security event or unexpected call-outs from the network.

EXAMPLES

EXAMPLE 1

Description: Use this commadn to set the Artifact and get it ready for importing or review
Notes: This option uses the default cmdlet name

EXAMPLE 2

Command: Publish-BGArtifact -Artifact .

Description: Use this command to quickly bring up the file select dialog to manually select the Artifact to import
Notes: This option uses the Short-Hand cmdlet name

EXAMPLE 3

Command: BGArtifact -Review

Description: Use this command to show any issues with the currently selected Artifact.
Notes: This option uses the BG Alias name

EXAMPLE 4

Command: BGArtifact -Artifact .\Artifacts\TestPack.YAML -Review

Description: Use this command to Select the Artifact and to process a Review on it with a single command
Notes:

EXAMPLE 5

Command: BGArtifact -Import

Description: Use this command to import and utilize an Artifact
Notes: If an Artifact was not previsouly set, a file select dialog will be displayed to manually select the Artifact to import

EXAMPLE 6

Command: BGArtifact -Artifact .\Artifacts\TestPack.YAML -Import

Description: Use this command to Select and Import an Artifact to process
Notes:

EXAMPLE 7

Command: BGArtifact -ExportType 'JSON' -Export .\QueryOpenPorts

Description: Use this command to export an Artifact to a JSON formated file.
Notes: Items will be saved in the .\Artifacts\ Directory

EXAMPLE 8

Command: BGArtifact -Export .\QueryOpenPorts

Description: Use this command to export an Artifact to a YAML formated file.
Notes: YAML is the default export format.  Items will be saved in the .\Artifacts\ Directory

EXAMPLE 9

Command: BGArtifact -Help

Description: Use this command to provide you with an interactive help system to show more examples and commands
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
       Get-Help will be called with the -Full parameter

EXAMPLE 10

Command: BGArtifact -WalkThrough

Description: Use this command to provide you with an interactive help system to show more examples and commands
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
       Get-Help will be called with the -Full parameter

PARAMETERS

Artifact

-Artifact <String>
   
   Required?                    false
   Position?                    1
   Default value                $global:ConsoleJSONJob
   Accept pipeline input?       false
   Accept wildcard characters?  false

Import

-Import [<SwitchParameter>]
   Description: Import a JSON/YAML Artifact to use to query local and remote systems for a specfic IOC
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false

Export

-Export <String>
   Description: Export the BluGenie Console settings into a JSON/YAML Artifact
   Notes: YAML is the default export type.  If you want to change it set -Exporttype 'JSON'
   Alias:
   ValidateSet: 'YAML','JSON'
   
   Required?                    false
   Position?                    2
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false

Remove

-Remove [<SwitchParameter>]
   Description: Remove the currently selected Artifact
   Notes: If there is no Artifact selected and you run the -Import parameter you will be given a file dialog to choose an Artifact
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false

Review

-Review [<SwitchParameter>]
   Description: Review a JSON/YAML Artifact without overwritting any predefined Artifact settings
   Notes:  In the BluGenie Conole you can manually update the Artifact settings even while reviewing another Artifact
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false

ExportType

-ExportType <String>
   Description: Select what Artifact format to export to.
   Notes:  The default is 'YAML'
   Alias:
   ValidateSet: 'YAML','JSON'
   
   Required?                    false
   Position?                    3
   Default value                YAML
   Accept pipeline input?       false
   Accept wildcard characters?  false

Walkthrough

-Walkthrough [<SwitchParameter>]
   Description:  Start the dynamic help menu system to help walk through the current command and all of the parameters
   Notes:
   Alias: Help
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.