# Publish-BluGenieArtifact ### Publish-BluGenieArtifact ### SYNOPSIS Manage Artifact data from a JSON/YAML file to query local and remote systems for a specfic Indicator of compromise or IOC ### SYNTAX ``` Publish-BluGenieArtifact [[-Artifact] ] [-Import] [[-Export] ] [-Remove] [-Review] [[-ExportType] ] [-Walkthrough] [] ``` ### DESCRIPTION Import, Export, and Review Artifact data from a JSON/YAML file. Artifacts are contructed logic to query local and remote systems for a specfic Indicator of compromise or IOC IOC is a forensic term that refers to the evidence on a device that points out to a security breach. The data of IOC is gathered after a suspicious incident, security event or unexpected call-outs from the network. ### EXAMPLES #### EXAMPLE 1 ``` ``` ``` Description: Use this commadn to set the Artifact and get it ready for importing or review Notes: This option uses the default cmdlet name ``` #### EXAMPLE 2 ``` Command: Publish-BGArtifact -Artifact . ``` ``` Description: Use this command to quickly bring up the file select dialog to manually select the Artifact to import Notes: This option uses the Short-Hand cmdlet name ``` #### EXAMPLE 3 ``` Command: BGArtifact -Review ``` ``` Description: Use this command to show any issues with the currently selected Artifact. Notes: This option uses the BG Alias name ``` #### EXAMPLE 4 ``` Command: BGArtifact -Artifact .\Artifacts\TestPack.YAML -Review ``` ``` Description: Use this command to Select the Artifact and to process a Review on it with a single command Notes: ``` #### EXAMPLE 5 ``` Command: BGArtifact -Import ``` ``` Description: Use this command to import and utilize an Artifact Notes: If an Artifact was not previsouly set, a file select dialog will be displayed to manually select the Artifact to import ``` #### EXAMPLE 6 ``` Command: BGArtifact -Artifact .\Artifacts\TestPack.YAML -Import ``` ``` Description: Use this command to Select and Import an Artifact to process Notes: ``` #### EXAMPLE 7 ``` Command: BGArtifact -ExportType 'JSON' -Export .\QueryOpenPorts ``` ``` Description: Use this command to export an Artifact to a JSON formated file. Notes: Items will be saved in the .\Artifacts\ Directory ``` #### EXAMPLE 8 ``` Command: BGArtifact -Export .\QueryOpenPorts ``` ``` Description: Use this command to export an Artifact to a YAML formated file. Notes: YAML is the default export format. Items will be saved in the .\Artifacts\ Directory ``` #### EXAMPLE 9 ``` Command: BGArtifact -Help ``` ``` Description: Use this command to provide you with an interactive help system to show more examples and commands Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` #### EXAMPLE 10 ``` Command: BGArtifact -WalkThrough ``` ``` Description: Use this command to provide you with an interactive help system to show more examples and commands Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` ### PARAMETERS #### Artifact ``` -Artifact Required? false Position? 1 Default value $global:ConsoleJSONJob Accept pipeline input? false Accept wildcard characters? false ``` #### Import ``` -Import [] Description: Import a JSON/YAML Artifact to use to query local and remote systems for a specfic IOC Notes: Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Export ``` -Export Description: Export the BluGenie Console settings into a JSON/YAML Artifact Notes: YAML is the default export type. If you want to change it set -Exporttype 'JSON' Alias: ValidateSet: 'YAML','JSON' Required? false Position? 2 Default value Accept pipeline input? false Accept wildcard characters? false ``` #### Remove ``` -Remove [] Description: Remove the currently selected Artifact Notes: If there is no Artifact selected and you run the -Import parameter you will be given a file dialog to choose an Artifact Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Review ``` -Review [] Description: Review a JSON/YAML Artifact without overwritting any predefined Artifact settings Notes: In the BluGenie Conole you can manually update the Artifact settings even while reviewing another Artifact Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ExportType ``` -ExportType Description: Select what Artifact format to export to. Notes: The default is 'YAML' Alias: ValidateSet: 'YAML','JSON' Required? false Position? 3 Default value YAML Accept pipeline input? false Accept wildcard characters? false ``` #### Walkthrough ``` -Walkthrough [] Description: Start the dynamic help menu system to help walk through the current command and all of the parameters Notes: Alias: Help ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://manuals.blusapphire.io/blugenie/full-function-list/publish-blugenieartifact.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.