# BluSapphire Manuals
## BluSapphire
## [BluGenie](/blugenie/full-function-list)
## BluSniper
## BluArmour
# Detections
Sigma Rule Format & Learnings
## Overview:
BluSapphire SIEM platform enables support for writing and deploy custom SIGMA rules from within BluSapphire Portal. This document is meant for Security Analysts & IT/System Administrators to help answer queries that he/she may have while writing Sigma rule.
## What is Sigma?
While we've Snort rules for detecting Network Traffic, Yara Signatures for identifying suspicious files, consider Sigma rules for searching/pattern matching through log data. Sigma is a generic and open signature format that allows analysts to write & describe searches on log data in a straightforward manner. These rules can be converted and applied to many log management or SIEM systems. Writing Sigma rules is easy and follows the YAML format, which is quite flexible to accommodate custom fields.
**Note**: Sigma specifications may change over time with versions, in case of any missing or new attribute, please refer to the official SIGMA specifications wiki available at SIGMAHQ with frequent updates.
The following pages will help empower your abilities in understanding Sigma format and use them effectively to write/edit Detections.
###
# Creating "Detections" Using BluSapphire Portal
**Note**: Please watch this [video](https://youtu.be/yB3AkJ6m3hc) to follow along as needed.
### Sigma Structure & Attributes:
Assuming analysts might be interested in tracking installation of malicious windows services on a compromised workstation to achieve persistence or to move laterally between systems later on. Most common red team techniques involve installing a new service that would allow adversaries to run commands on remote machines or creating a new account upon execution of malicious service.
Here analysts would be more interested to look for Windows Event-ID: “7045 - Windows Service Installation”, which holds the details about the binary (ServiceFileName) that the service is using.
| **Required Condition** |
Search for Windows EventID “7045”
Look for Windows service binary path’s pointing to suspicious/unwanted executables and alert
|
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
To detect malicious service installations on windows workstation, you know what and where to look for. The Sigma rule for this would be as follows:
| **Sigma Rule - Installation of Malicious Service** | | |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
|
title: Installation of Malicious Service
status: stable
author: Blusapphire, SOC
date: 2017/03/27
description: Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.
references:
-
-
tags:
- attack.persistence
- attack.privilege\_escalation
- attack.t1035
- attack.t1050
level: critical
falsepositives:
- Penetration testing
logsource:
product: windows
service: system
detection:
selection:
EventID: 7045
malsvc\_paexec:
ServiceFileName | contains: '\PAExec'
malsvc\_wannacry:
ServiceName: 'mssecsvc2.0'
malsvc\_persistence:
ServiceFileName | contains: 'net user'
condition: selection and ( malsvc\_paexec or malsvc\_wannacry or malsvc\_persistence)
|
Let’s break it down further to understand Sigma rule structure and attributes within, A Sigma rule has different attributes, each of which has a unique purpose. In the structure table below, sigma rule has been grouped into three sections “Metadata, Logsource, Detections” for understanding purposes.
| **Sections** | **Attributes** | **Value (Example)** | **Remark** | | |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------ | - | - |
| **Metadata** | title | Installation of Malicious Service | Mandatory | | |
| id | 2cfe636e-317a-4bee-9f2c-1066d9f54d1a | Optional | | | |
| status | stable | | | | |
| author | Blusapphire, SOC | | | | |
| date | 2017/03/27 | | | | |
| modified | 2021/07/06 | | | | |
| description | Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities. | | | | |
| references |
| | |
| condition | selection and (malsvc\_paexec or malsvc\_wannacry or malsvc\_persistence) | | | | |
**Note:** Additional information related to field attributes and their properties are available in Annexure-A.
### Understanding Sigma Operators/Attributes:
* **Metadata:** This section has fields that are common across all Sigma rules of a collection.
* **Logsource:** This section describes the log data on which the detection is meant to be applied. It consists of three sub-attributes which define the details of the log source:
* Category – e.g.: Firewall, Web, Antivirus, Process\_Creation
* Product – e.g.: Windows, Apache
* Service – e.g.: System, AppLocker, Security, Sysmon
* Definition – e.g.: Information that describes the log source
| **Logsource Example** |
| --------------------------------------------------------------------------------------------------------------------------- |
|
logsource:
product: windows
service: powershell
definition: 'Script block logging must be enabled'
|
**Note:** Instead of referring to a particular service using the mentioned sub-attributes, a generic log sources can be used in the rule, which has category and product information.
| **Generic Logsource Example** |
| -------------------------------------------------------------------------- |
|
logsource:
category: process\_creation
product: windows
|
* **Detection (Detection-Expression):** Defines a set of search-identifiers that represent ‘what an analyst would want to search for’ on the given log data source. This section is made up of the following sub-attributes “Search-Identifier and Condition-Expression”.
* **Search-Identifier** is at the core for detection, supports both “lists and maps” type data structures.
* Lists – Can have multiple items or strings, each of which are linked with a logical ‘OR’ as below.
* Maps (dictionaries) – Are key/value pairs, in which the key is a field in the log data and value can be string or integer. All the elements of map are linked with a logical ‘AND’ as below.
| Data Type | Examples | Operator | Translates To |
| --------- | ------------------------------------------------------------------ | -------- | ------------------------------------------- |
| **Lists** |
selection:
EventID:
- 4624
- 4625
| OR | (EventID:”4624” OR EventID:”4625”) |
| **Maps** |
selection:
EventID: 1
Image: ‘\*powershell.exe’
| AND | (EventID:”1” AND Image:”\*.powershell.exe”) |
* * **Value Modifiers** can be used to modify values in a rule, Value Modifiers can change search identifier behavior and are attached to the end of a field name after the pipe “|” character.
| Value Modifier | What changes, when value modifiers are used | Examples |
| -------------- | --------------------------------------------------- | -------------------------- |
| contains | Adds ‘\*’ to beginning & end of the field value | CommandLine\|contains |
| all | Chages the default list behavior from ‘or’ to ‘and’ | CommandLine\|contains\|all |
| startswith | Adds ‘\*’ to the end of the field value | Image\|startswith |
| endswith | Adds ‘\*’ to the beginning of the field value | ParentImage\|endswith |
* * **Condition (Condition-Expression)** – Uses operators to link ties **Search-Identifier** fields together, defining how the detection tool will process each field in relation to the others.
| Operator | Examples |
| -------------------------- | ------------------------------------------- |
| Logical and/or | selection1 or selection2 |
| 1/all of search-identifier | 1 of selection |
| 1/all of them | all of them |
| 1/all of search-id-pattern | all of filter\_\* |
| Negation with ‘not’ | Selection and not filter |
| Order of operation ‘()’ | 1 of selection and not (filter1 or filter2) |
### Basic Syntax:
**The following are some basic rules to be followed while writing a sigma rule:**
* Follows YAML format, use spaces (not tabs).
* All values are case-insensitive strings
* You can make use of wildcard characters '\*' and '?' in strings
* Wildcards can be escaped with '\\' e.g., '\\\*'
* Special Field Values:
* Null values are defined with 'null'
* Empty value is defined with '’
### Rule Creation from BluSapphire Portal:
This section provides information on creation/modification and deployment of new/existing sigma rules from within Blusapphire Portal.
Steps for Rule creation:
1. From Blusapphire portal, navigate to “Rule Management" page available under “Entity Behavior” menu item.
1. To create a new rule, click on “New” button available on top right side. As described earlier in this document:
1. Provide an appropriate rule name
* 1. Provide the required metadata fields
* 1. Provide required **Logsource** as per specifications.
2. Define the **search-identifiers (selection/filters)** for the rule and the condition.
* 1. Finally check, validate and save the new rule.
* 1. Newly created rules will be enabled by default.
* 1. To update an existing rule:
* Use filters to search for an existing rule
* Make the required changes in the rule, validate and save.
### Annexure-A
| **Field Attributes** | **Attribute Properties** | |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Title |
Provide a brief title for the rule, keep it simple and short
Type: string
| |
| ID | Global unique identifier for rule, auto generated during rule creation and used internally (optional) | |
| Status |
Defines the maturity of the rule. (optional)
Possible values:
experimental - usable in test environment, which may require additional tuning to reduce noise and false-positives (FPs)
testing - Tunning is required
stable - Usable in production environments
Note:
Blusapphire offers a mixed set of base rules, which may require tuning and can vary between organizations depending on IT policies implemented.
Any newly created custom rule for an organization, it is preferred to initially set it to experimental and change it overtime depending on tunning.
| |
| Author |
Author of the rule (special should be inside single quotes), Comma is used to separate multiple users. (optional)
Type: string
| |
| Date |
Creation date of the rule. (optional)
Format: YYYY/MM/DD
| |
| Modified |
Modified date of the rule. (optional)
Format: YYYY/MM/DD
| |
| Description |
Short description of the rule and its context of detection. (optional)
Type: String
| |
| References | List of references to external sources for the rule | |
| Tags |
Tag the rule based on the context of logsource or log data or even detection.
Field allows lowercase, underscores hyphens and no-spaces.
Type: String
E.g., For windows rule you may tag it with Mitre Framework based on Technique like attack.t1086
| |
| Level |
Field defines the criticality of the rule.
Possible values:
Low
Medium
High
Critical
| |
| Logsource |
Defines the log data source which will be used to search data from. Logsource has additional sub-attributes 'Category, Product, Service, Definition' for pointing to a specific log source.
Instead of Logsource, you can use Generic Logsource format which only has two sub-attributes ‘Category, Product’. This is used internally during the conversion process, specifically for field mapping.
Possible values:
Category – logs which fall under a particular category (e.g., DNS, Server-Logs, Process\_Creation, Network, etc.)
Product – logs generated by a particular product (e.g., windows event channel, Linux, Firewall, etc.)
Service – Subset of product log (e.g., Security, Powershell, Sysmon, etc.)
Definition – Describes the
| |
| Detection |
Defines a set of search-identifiers that represent searches on log data, support both lists, maps(dictionaries) data-structures.
Search-Identifiers (selection) – are key/value pairs, what an analyst would want to select (or) search from the log data. Multiple values can be included in a Lists (OR – dash bulleted) or Maps (AND – new lines).
Value Modifiers can be used to change the search-identifier behavior and are attached to the end of a field name after the pipe “ | ” character.
Condition-Expression (condition) – ties the selection fields together, defining how the detection tool will process each selection, filter fields in relation to the others.
|
Note: Please watch this [video](https://youtu.be/yB3AkJ6m3hc) to follow along as needed.
# Roles & Permissions
In this we define and elaborate on the roles and permissions assigned to different users within our system. We outline four distinct user types:
Service Provider Admin,
Service Provider Analyst,
Client Admin, and
Client Analyst
Each user type is assigned specific responsibilities and permissions tailored to their role in the system. The document provides an overview of these roles, detailing their respective duties and the permissions they possess. By clearly defining these roles and permissions, we ensure efficient management and utilization of our services, fostering effective collaboration between service providers and clients.
\\
\
**Service Provider Admin:**
```
This role has administrative privileges .
**Permissions:**
```
* **User Management**: Create, update, delete, and view users. Admins can manage user accounts, roles, and permissions.
* **System Settings**: Modify system-wide settings, configurations, and parameters.
* **Access Control Management**: Define and modify roles and permissions, assign roles to users, and manage access levels.
* **Security Settings**: Manage security policies, including password policies, two-factor authentication settings, and access controls.
\\
Provider Admin Privileges Overview:
The Service Provider Admin has the following key privileges:
Creation of Child Organizations
Management of Users within Organizations
Access to Default Organization and Child Organizations
**Privileges Breakdown:**
a. Creation of Child Organizations:
* The Service Provider Admin has the authority to create child organizations under their default organization.
* Child organizations may represent distinct departments, branches, or divisions within the larger organizational structure.
b. Management of Users within Organizations:
* Service Provider Admins can add, modify, and remove users within their default organization and its child organizations.
* This includes assigning roles, permissions, and other user-related configurations.
c. Access to Default Organization and Child Organizations:
* The Service Provider Admin has full access to their default organization and all child organizations created under it.
* They can view, edit, and manage organizational data within these entities.
d. Cannot create Partner Entities:
* While Service Provider Admins cannot directly create partner entities, they have access to their organization and child organizations.
**Responsibilities:**
The Service Provider Admin is responsible for managing organizational structures and user permissions effectively. They must ensure that user access is granted according to organizational requirements and security policies. Service Provider Admins should maintain the integrity and confidentiality of organizational data, adhering to applicable regulatory standards and compliance requirements. Best Practices:
Regularly review and update organizational structures to reflect changes in the business landscape. Provide training and support to Service Provider Admins to empower them to effectively manage users and organizations. Implement access controls and monitoring mechanisms to detect and prevent unauthorized access to sensitive data. Default Organization:
The Service Provider Admin has a default organization under which child organizations are created. This default organization serves as the parent entity for organizational hierarchy and administrative purposes.
**Conclusion**:
Service Provider Admin privileges grant elevated access and control over organizational structures and user management within the system. It's essential for Service Provider Admins to exercise their privileges responsibly and in accordance with organizational policies and best practices.
\\
**Service Provider Analyst:**
```
This role has privileges to view and analyze data for multiple organizations.
**Permissions:**
```
* **View/Edit Own Profile**: Users can view and edit their own profile information but cannot view or edit other users' profiles.
* **Data Management**: Can view and analyze the data pertaining to their client organization.
* **Limited System Settings**: Access to a limited set of system settings that pertain to their user experience, like changing their password or configuring personal preferences.
**Privileges Breakdown:**
a. Access to Specific Pages and Data:
* Service Provider Analysts are granted access to a subset of pages within the system, typically those relevant to their role or responsibilities.
* This access allows them to view data and perform necessary tasks within their designated area of operation.
b. Restricted Access to Organizational and User Management Functions:
* Service Provider Analyst do not have permissions to create organizations or add/manage users within the system.
* They are restricted from viewing organizational structures and user lists to maintain data confidentiality and security.
**Responsibilities:**
The primary responsibility of the Service Provider Analyst is to utilize the provided access rights responsibly and in alignment with organizational policies and procedures. They must ensure the confidentiality and integrity of data accessed through the system. Service Provider Analysts should promptly report any security concerns or unauthorized access attempts to designated personnel.
**Conclusion**:
Service Provider Analyst privileges offer limited access to specific pages and data within the system, focusing on enabling users to perform their designated tasks efficiently while maintaining data security and confidentiality.
\
**Client Admin:**
```
This role has administrative privileges, can view and analyze data with respect to specific client.
**Permissions:**
```
* **User Management**: Create, update, delete, and view users. Admins can manage user accounts, roles, and permissions.
* **System Settings**: Modify system-wide settings, configurations, and parameters.
* **Access Control Management**: Define and modify roles and permissions, assign roles to users, and manage access levels.
* **Security Settings**: Manage security policies, including password policies, two-factor authentication settings, and access controls.
* **Data Management**: Can view and analyze the data pertaining to their client organization.
**Privileges Breakdown:**
a. Creation and Management of Client Analysts:
* The Client Admin is authorized to create and manage users within their designated domain(s) in the system.
* They have the ability to add, modify, and delete user accounts, assign roles, and configure permissions within the domain(s) they oversee.
b. Restricted Access to Organizational Data:
* Client Admins do not have permissions to view organizational structures or access organizational data beyond the scope of their designated domain(s).
* Their access is limited to user management functions within their domain(s) to maintain data confidentiality and security.
**Responsibilities:**
The primary responsibility of the Client Admin is to manage user accounts within their designated domain(s) effectively. They must adhere to organizational policies and procedures regarding user management, security, and data privacy. Client Admins should collaborate with other administrative roles, such as Client Admins or Superusers, as needed to ensure smooth operation and alignment with organizational objectives.
**Conclusion**:
Client Admin privileges enable the management of user accounts within specific domains while maintaining restricted access to organizational data. It is essential for Client Admins to fulfill their responsibilities diligently and in accordance with organizational policies and procedures
**Client Analyst:**
```
This role has privilege to view and analyze data with respective to specific client.
**Permissions:**
```
* **View/Edit Own Profile**: Users can view and edit their own profile information but cannot view or edit other users' profiles.
* **Specific Data Access**: Read (and possibly write) access to specific data necessary for their roles, with restrictions on more sensitive or comprehensive data. Can view their organization data.
* **Limited System Settings**: Access to a limited set of system settings that pertain to their user experience, like changing their password or configuring personal preferences.
* **Data Access and Management**: Can view and analyze the data pertaining to their client organization.
Privileges Breakdown:
a. Access to Organization Data:
* Client Analyst are granted access to view and interact with data within their respective organization(s) only.
* They can view, create, modify, and delete data within their organization's scope, such as files, documents, or records.
b. Limited Access to Account Settings:
* Client Analysts have limited access to manage their personal account settings related to security.
* Specifically, they can access and modify settings related to:
1. Password: Change or reset their account password.
2. Multi-Factor Authentication (MFA): Enable or configure MFA settings for enhanced security.
3. Log Monitoring: View logs and monitoring data related to their account activities.
4. Host Monitoring: Access monitoring features related to host systems associated with their account.
**Restricted Access to Other Settings:**
Client Analysts do not have permissions to access most of the system settings beyond those related to password, MFA, log monitoring, and host monitoring. They cannot modify system-wide configurations or settings that impact the overall operation of the system.
**Responsibilities**:
The primary responsibility of the Client Analyst is to utilize the provided access rights responsibly and in alignment with organizational policies and procedures. They must ensure the confidentiality and integrity of data accessed within their organization(s).Client Analysts should promptly report any security concerns or unauthorized access attempts to designated personnel.
**Conclusion:**
Client Analyst privileges offer access to organization data within a specific scope and limited control over personal account settings related to security. It is crucial for Client Analysts to adhere to organizational policies and best practices to maintain data integrity and security.
# Knowledge Base
* **I receive a logmon alert, but when i verify, i see the logs are coming in fine. Why?**
* Logmon alerts are fired if the system hasn't seen logs from a logsource in a defined time period say 30m, 90m or 6h. If you set this to a short time like 30m, this behaviour is often expected. A logsource may or may not have dropped off and it could have come back online and caught up with all the missing logs. This could happen due to a number of reasons like network congestion, very low log volume, system temporarily offline etc.,
*Try increasing the timeout to 90m or higher to decrease these alerts and make alerts reliable.*
# Full Function List
* [Add-BluGenieFirewallRule](/blugenie/full-function-list/add-blugeniefirewallrule)
* [Clear-BlugenieMemory](/blugenie/full-function-list/clear-blugeniememory)
* [Connect-BluGenieToSystem](/blugenie/full-function-list/connect-blugenietosystem)
* [Convert-BluGenieSID2UserName](/blugenie/full-function-list/convert-blugeniesid2username)
* [Convert-BluGenieSize](/blugenie/full-function-list/convert-blugeniesize)
* [Convert-BluGenieUserName2SID](/blugenie/full-function-list/convert-blugenieusername2sid)
* [Convert-BluGenieUTCtoLocal](/blugenie/full-function-list/convert-blugenieutctolocal)
* [ConvertFrom-Yaml](/blugenie/full-function-list/convertfrom-yaml)
* [ConvertTo-BluGenieDate](/blugenie/full-function-list/convertto-blugeniedate)
* [ConvertTo-Yaml](/blugenie/full-function-list/convertto-yaml)
* [Disable-BluGenieAllFirewallRules](/blugenie/full-function-list/disable-blugenieallfirewallrules)
* [Disable-BluGenieFirewallRule](/blugenie/full-function-list/disable-blugeniefirewallrule)
* [Enable-BluGenieAllFirewallRules](/blugenie/full-function-list/enable-blugenieallfirewallrules)
* [Enable-BluGenieFirewallRule](/blugenie/full-function-list/enable-blugeniefirewallrule)
* [Enable-BluGenieWinRMoverWMI](/blugenie/full-function-list/enable-blugeniewinrmoverwmi)
* [Expand-BluGenieArchivePS2](/blugenie/full-function-list/expand-blugeniearchiveps2)
* [Format-BluGenieEvent](/blugenie/full-function-list/format-blugenieevent)
* [Get-BluGenieADGroupMembers](/blugenie/full-function-list/get-blugenieadgroupmembers)
* [Get-BluGenieADGroups](/blugenie/full-function-list/get-blugenieadgroups)
* [Get-BluGenieADMachineInfo](/blugenie/full-function-list/get-blugenieadmachineinfo)
* [Get-BluGenieAuditProcessTracking](/blugenie/full-function-list/get-blugenieauditprocesstracking)
* [Get-BluGenieAutoRuns](/blugenie/full-function-list/get-blugenieautoruns)
* [Get-BluGenieChildItemList](/blugenie/full-function-list/get-blugeniechilditemlist)
* [Get-BluGenieCOMObjectInfo](/blugenie/full-function-list/get-blugeniecomobjectinfo)
* [Get-BluGenieCurrentSessionAliases](/blugenie/full-function-list/get-blugeniecurrentsessionaliases)
* [Get-BluGenieCurrentSessionFunctions](/blugenie/full-function-list/get-blugeniecurrentsessionfunctions)
* [Get-BluGenieCurrentSessionVariables](/blugenie/full-function-list/get-blugeniecurrentsessionvariables)
* [Get-BluGenieErrorAction](/blugenie/full-function-list/get-blugenieerroraction)
* [Get-BluGenieFileADS](/blugenie/full-function-list/get-blugeniefileads)
* [Get-BluGenieFilePermissions](/blugenie/full-function-list/get-blugeniefilepermissions)
* [Get-BluGenieFileSnapshot](/blugenie/full-function-list/get-blugeniefilesnapshot)
* [Get-BluGenieFileStreams](/blugenie/full-function-list/get-blugeniefilestreams)
* [Get-BluGenieFirewallRules](/blugenie/full-function-list/get-blugeniefirewallrules)
* [Get-BluGenieHashInfo](/blugenie/full-function-list/get-blugeniehashinfo)
* [Get-BluGenieHelp](/blugenie/full-function-list/get-blugeniehelp)
* [Get-BluGenieHostingVersion](/blugenie/full-function-list/get-blugeniehostingversion)
* [Get-BluGenieIPrange](/blugenie/full-function-list/get-blugenieiprange)
* [Get-BluGenieLiteralPath](/blugenie/full-function-list/get-blugenieliteralpath)
* [Get-BluGenieLoadedRegHives](/blugenie/full-function-list/get-blugenieloadedreghives)
* [Get-BluGenieLockingProcess](/blugenie/full-function-list/get-blugenielockingprocess)
* [Get-BluGenieMRUActivityView](/blugenie/full-function-list/get-blugeniemruactivityview)
* [Get-BluGenieProcessList](/blugenie/full-function-list/get-blugenieprocesslist)
* [Get-BluGenieRegistry](/blugenie/full-function-list/get-blugenieregistry)
* [Get-BluGenieRegistryProcessTracking](/blugenie/full-function-list/get-blugenieregistryprocesstracking)
* [Get-BluGenieRegSnapshot](/blugenie/full-function-list/get-blugenieregsnapshot)
* [Get-BluGenieRunSpaceSessionAliases](/blugenie/full-function-list/get-blugenierunspacesessionaliases)
* [Get-BluGenieRunSpaceSessionFunctions](/blugenie/full-function-list/get-blugenierunspacesessionfunctions)
* [Get-BluGenieRunSpaceSessionVariables](/blugenie/full-function-list/get-blugenierunspacesessionvariables)
* [Get-BluGenieSchTaskInfo](/blugenie/full-function-list/get-blugenieschtaskinfo)
* [Get-BluGenieScriptDirectory](/blugenie/full-function-list/get-blugeniescriptdirectory)
* [Get-BluGenieServiceList](/blugenie/full-function-list/get-blugenieservicelist)
* [Get-BluGenieServiceStatus](/blugenie/full-function-list/get-blugenieservicestatus)
* [Get-BluGenieSessionAliasList](/blugenie/full-function-list/get-blugeniesessionaliaslist)
* [Get-BluGenieSessionFunctionList](/blugenie/full-function-list/get-blugeniesessionfunctionlist)
* [Get-BluGenieSessionVariableList](/blugenie/full-function-list/get-blugeniesessionvariablelist)
* [Get-BluGenieSettings](/blugenie/full-function-list/get-blugeniesettings)
* [Get-BluGenieSignature](/blugenie/full-function-list/get-blugeniesignature)
* [Get-BluGenieSystemInfo](/blugenie/full-function-list/get-blugeniesysteminfo)
* [Get-BluGenieToolsDirectory](/blugenie/full-function-list/get-blugenietoolsdirectory)
* [Get-BluGenieTranscriptsDir](/blugenie/full-function-list/get-blugenietranscriptsdir)
* [Get-BluGenieTranscriptsFile](/blugenie/full-function-list/get-blugenietranscriptsfile)
* [Get-BluGenieTrapData](/blugenie/full-function-list/get-blugenietrapdata)
* [Get-BluGenieWindowsTitle](/blugenie/full-function-list/get-blugeniewindowstitle)
* [Get-BluGenieWindowsUpdates](/blugenie/full-function-list/get-blugeniewindowsupdates)
* [Install-BluGenieHarvester](/blugenie/full-function-list/install-blugenieharvester)
* [Install-BluGenieSysMon](/blugenie/full-function-list/install-blugeniesysmon)
* [Invoke-BluGenieAnalyzer](/blugenie/full-function-list/invoke-blugenieanalyzer)
* [Invoke-BluGenieFileBrowser](/blugenie/full-function-list/invoke-blugeniefilebrowser)
* [Invoke-BluGenieLoadAllProfileHives](/blugenie/full-function-list/invoke-blugenieloadallprofilehives)
* [Invoke-BluGenieNetStat](/blugenie/full-function-list/invoke-blugenienetstat)
* [Invoke-BluGenieParallel](/blugenie/full-function-list/invoke-blugenieparallel)
* [Invoke-BluGenieProcess](/blugenie/full-function-list/invoke-blugenieprocess)
* [Invoke-BluGenieProcessHash](/blugenie/full-function-list/invoke-blugenieprocesshash)
* [Invoke-BluGeniePSQuery](/blugenie/full-function-list/invoke-blugeniepsquery)
* [Invoke-BluGeniePython](/blugenie/full-function-list/invoke-blugeniepython)
* [Invoke-BluGenieSQLLQuery](/blugenie/full-function-list/invoke-blugeniesqllquery)
* [Invoke-BluGenieThreadLock](/blugenie/full-function-list/invoke-blugeniethreadlock)
* [Invoke-BluGenieUnLoadAllProfileHives](/blugenie/full-function-list/invoke-blugenieunloadallprofilehives)
* [Invoke-BluGenieWalkThrough](/blugenie/full-function-list/invoke-blugeniewalkthrough)
* [Invoke-BluGenieWipe](/blugenie/full-function-list/invoke-blugeniewipe)
* [Invoke-BluGenieYara](/blugenie/full-function-list/invoke-blugenieyara)
* [Invoke-PSipcalc](/blugenie/full-function-list/invoke-psipcalc)
* [Invoke-PSnmap](/blugenie/full-function-list/invoke-psnmap)
* [Invoke-SQLiteBulkCopy](/blugenie/full-function-list/invoke-sqlitebulkcopy)
* [Invoke-SqliteQuery](/blugenie/full-function-list/invoke-sqlitequery)
* [Invoke-WalkThrough](/blugenie/full-function-list/invoke-walkthrough)
* [Join-BluGenieObjects](/blugenie/full-function-list/join-blugenieobjects)
* [New-BluGenieCommand](/blugenie/full-function-list/new-blugeniecommand)
* [New-BluGenieHelpMenu](/blugenie/full-function-list/new-blugeniehelpmenu)
* [New-BluGenieService](/blugenie/full-function-list/new-blugenieservice)
* [New-BluGenieSessionInfo](/blugenie/full-function-list/new-blugeniesessioninfo)
* [New-BluGenieTimeStamp](/blugenie/full-function-list/new-blugenietimestamp)
* [New-BluGenieUID](/blugenie/full-function-list/new-blugenieuid)
* [New-SQLiteConnection](/blugenie/full-function-list/new-sqliteconnection)
* [Open-BluGenieLog](/blugenie/full-function-list/open-blugenielog)
* [Open-BluGenieLogDir](/blugenie/full-function-list/open-blugenielogdir)
* [Open-BluGenieScriptDir](/blugenie/full-function-list/open-blugeniescriptdir)
* [Open-BluGenieToolDir](/blugenie/full-function-list/open-blugenietooldir)
* [Open-BluGenieTransDir](/blugenie/full-function-list/open-blugenietransdir)
* [Out-DataTable](/blugenie/full-function-list/out-datatable)
* [Publish-BluGenieArtifact](/blugenie/full-function-list/publish-blugenieartifact)
* [Publish-BluGenieFirewallRules](/blugenie/full-function-list/publish-blugeniefirewallrules)
* [Remove-BluGenieFile](/blugenie/full-function-list/remove-blugeniefile)
* [Remove-BluGenieFirewallRule](/blugenie/full-function-list/remove-blugeniefirewallrule)
* [Remove-BluGenieModule](/blugenie/full-function-list/remove-blugeniemodule)
* [Remove-BluGenieService](/blugenie/full-function-list/remove-blugenieservice)
* [Resolve-BluGenieDnsName](/blugenie/full-function-list/resolve-blugeniednsname)
* [Send-BluGenieItem](/blugenie/full-function-list/send-blugenieitem)
* [Set-BluGenieAuditProcessPol](/blugenie/full-function-list/set-blugenieauditprocesspol)
* [Set-BluGenieCommands](/blugenie/full-function-list/set-blugeniecommands)
* [Set-BluGenieCores](/blugenie/full-function-list/set-blugeniecores)
* [Set-BluGenieDebugger](/blugenie/full-function-list/set-blugeniedebugger)
* [Set-BluGenieFirewallGPOStatus](/blugenie/full-function-list/set-blugeniefirewallgpostatus)
* [Set-BluGenieFirewallStatus](/blugenie/full-function-list/set-blugeniefirewallstatus)
* [Set-BluGenieJobId](/blugenie/full-function-list/set-blugeniejobid)
* [Set-BluGenieJobMemory](/blugenie/full-function-list/set-blugeniejobmemory)
* [Set-BluGenieJobTimeout](/blugenie/full-function-list/set-blugeniejobtimeout)
* [Set-BluGenieNoBanner](/blugenie/full-function-list/set-blugenienobanner)
* [Set-BluGenieNoExit](/blugenie/full-function-list/set-blugenienoexit)
* [Set-BluGenieNoSetRes](/blugenie/full-function-list/set-blugenienosetres)
* [Set-BluGenieParallelCommands](/blugenie/full-function-list/set-blugenieparallelcommands)
* [Set-BluGeniePostCommands](/blugenie/full-function-list/set-blugeniepostcommands)
* [Set-BluGeniePrefetch](/blugenie/full-function-list/set-blugenieprefetch)
* [Set-BluGenieProcessCPUAffinity](/blugenie/full-function-list/set-blugenieprocesscpuaffinity)
* [Set-BluGenieProcessPriority](/blugenie/full-function-list/set-blugenieprocesspriority)
* [Set-BluGenieRange](/blugenie/full-function-list/set-blugenierange)
* [Set-BluGenieRemoteDesktopProcess](/blugenie/full-function-list/set-blugenieremotedesktopprocess)
* [Set-BluGenieScriptCredentials](/blugenie/full-function-list/set-blugeniescriptcredentials)
* [Set-BluGenieServiceJob](/blugenie/full-function-list/set-blugenieservicejob)
* [Set-BluGenieSessionInfo](/blugenie/full-function-list/set-blugeniesessioninfo)
* [Set-BluGenieSettingsPriority](/blugenie/full-function-list/set-blugeniesettingspriority)
* [Set-BluGenieSystems](/blugenie/full-function-list/set-blugeniesystems)
* [Set-BluGenieThreadCount](/blugenie/full-function-list/set-blugeniethreadcount)
* [Set-BluGenieTrapping](/blugenie/full-function-list/set-blugenietrapping)
* [Set-BluGenieUpdateMods](/blugenie/full-function-list/set-blugenieupdatemods)
* [Set-BluGenieVerbose](/blugenie/full-function-list/set-blugenieverbose)
* [Show-BluGenieGUI](/blugenie/full-function-list/show-blugeniegui)
* [Show-BluGenieMore](/blugenie/full-function-list/show-blugeniemore)
* [Start-BluGenieNewProcess](/blugenie/full-function-list/start-blugenienewprocess)
* [Start-BluGenieRunSpace](/blugenie/full-function-list/start-blugenierunspace)
* [Stop-BluGenieService](/blugenie/full-function-list/stop-blugenieservice)
* [Test-BluGenieIsFileLocked](/blugenie/full-function-list/test-blugenieisfilelocked)
* [Test-BluGenieIsMutexAvailable](/blugenie/full-function-list/test-blugenieismutexavailable)
* [Trace-BluGenieFireWallStatus](/blugenie/full-function-list/trace-blugeniefirewallstatus)
* [Update-BluGenieFirewallProfileStatus](/blugenie/full-function-list/update-blugeniefirewallprofilestatus)
* [Update-BluGenieSysinternals](/blugenie/full-function-list/update-blugeniesysinternals)
* [Update-Sqlite](/blugenie/full-function-list/update-sqlite)
* [Write-BluGenieVerboseMsg](/blugenie/full-function-list/write-blugenieverbosemsg)
# Add-BluGenieFirewallRule
### Add-BluGenieFirewallRule
### SYNOPSIS
Add Windows Firewall Rule(s) from a Rule configuration file
### SYNTAX
```
Add-BluGenieFirewallRule [[-RuleName] ] [[-Walkthrough]] [[-ReturnObject]] [[-OutUnEscapedJSON]] []
```
### DESCRIPTION
Add Windows Firewall Rule(s) from a Rule configuration file
### EXAMPLES
#### EXAMPLE 1
```
Command: Add-BluGenieFirewallRule -RulePath 'Agent_445_Inbound_TCP'
```
```
Description: This will add the Agent_445_Inbound_TCP rules from the Script Directory to the Windows Firewall Rule list.
Notes:
```
#### EXAMPLE 2
```
Command: Add-BluGenieFirewallRule -RulePath 'Agent_445_Inbound_TCP,Agent_445_Inbound_UDP'
```
```
Description: This will add the Agent_445_Inbound_TCP and Agent_445_Inbound_UDP rules from the Script Directory to the Windows Firewall Rule list.
Notes:
```
#### EXAMPLE 3
```
Command: Add-BluGenieFirewallRule -RulePath 'Agent_445_Inbound_TCP','Agent_445_Inbound_UDP'
```
```
Description: This will add the Agent_445_Inbound_TCP and Agent_445_Inbound_UDP rules from the Script Directory to the Windows Firewall Rule list.
Notes:
```
#### EXAMPLE 4
```
Command: Add-BluGenieFirewallRule -RuleName 'C:\Windows\Temp\BGAgent_445_Inbound_TCP.RULE'
```
```
Description: This will add the Agent_445_Inbound_TCP rules from the C:\Windows\Temp\ to the Windows Firewall Rule list.
Notes: The rules are in JSON format
```
#### EXAMPLE 5
```
Command: Add-BluGenieFirewallRule -RuleName 'C:\Windows\Temp\BGAgent_445_Inbound_TCP.RULE,C:\Windows\Temp\BGAgent_445_Inbound_UDP.RULE'
```
```
Description: This will add the Agent_445_Inbound_TCP and Agent_445_Inbound_UDP rules from the C:\Windows\Temp\ to the Windows Firewall Rule list.
Notes: These rules are in JSON format and also note the the rule names are in a sinlge string seperated by a comma. The parameter can also use an array "",""
```
#### EXAMPLE 6
```
Command: Add-BluGenieFirewallRule -RuleName 'C:\Windows\Temp\BGAgent_445_Inbound_TCP.RULE','C:\Windows\Temp\BGAgent_445_Inbound_UDP.RULE'
```
```
Description: This will add the Agent_445_Inbound_TCP and Agent_445_Inbound_UDP rules from the C:\Windows\Temp\ to the Windows Firewall Rule list.
Notes: These rules are in JSON format and also note the the rule names are in an array "","". The parameter can also use a single string with a comma delimiter.
```
#### EXAMPLE 7
```
Command: Add-BluGenieFirewallRule -Help
```
```
Description: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
Notes: Snippet to add to your script function (Read the #region WalkThrough (Dynamic Help)) as part of this script. Make sure to add both the snippet and the parameter to your function.
```
#### EXAMPLE 8
```
Command: Add-BluGenieFirewallRule -WalkThrough
```
```
Description: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
Notes: Snippet to add to your script function (Read the #region WalkThrough (Dynamic Help)) as part of this script. Make sure to add both the snippet and the parameter to your function.
```
#### EXAMPLE 9
```
Command: Add-BluGenieFirewallRule -RuleName 'C:\Windows\Temp\BGAgent_445_Inbound_TCP.RULE' -OutUnEscapedJSON
```
```
Description: This will add the Agent_445_Inbound_TCP rules from the C:\Windows\Temp\ to the Windows Firewall Rule list.
Notes: The OutUnEscapedJSON is used to beatify the JSON return and not Escape any Characters
```
#### EXAMPLE 10
```
Command: Add-BluGenieFirewallRule -RuleName 'C:\Windows\Temp\BGAgent_445_Inbound_TCP.RULE' -ReturnObject
```
```
Description: This will add the Agent_445_Inbound_TCP rules from the C:\Windows\Temp\ to the Windows Firewall Rule list.
Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table.
```
### PARAMETERS
#### RuleName
```
-RuleName
Description: Full Path to a New Firewall Rule (.Rule) file.
Notes: This can be more than one file, seperated with a comma (,) or an array of strings
Alias:
ValidateSet:
Required? false
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Description: Start the dynamic help menu system to help walk through the current command and all of the parameters
Notes:
Alias: Help
ValidateSet:
Required? false
Position? 2
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### ReturnObject
```
-ReturnObject []
Description: Return information as an Object
Notes: By default the data is returned as a Hash Table
Alias:
ValidateSet:
Required? false
Position? 2
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### OutUnEscapedJSON
```
-OutUnEscapedJSON []
Description: Removed UnEsacped Char from the JSON information.
Notes: This will beautify json and clean up the formatting.
Alias:
ValidateSet:
Required? false
Position? 2
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Clear-BlugenieMemory
### Clear-BlugenieMemory
### SYNOPSIS
Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption
### SYNTAX
```
Clear-BlugenieMemory [-All] [[-SleepTimer] ] [[-LoopCount] ] [-Walkthrough] [-ReturnObject] [-OutUnEscapedJSON] [[-FormatView] ] []
```
### DESCRIPTION
Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption.
### EXAMPLES
#### EXAMPLE 1
```
Command: Clear-BlugenieMemory
```
```
Description: Remove any garbage collected in memory
Notes:
```
#### EXAMPLE 2
```
Command: 1..4 | ForEach-Object -Process { Get-ChildItem -Path C:\Windows -Recurse }; CM
```
```
Description: Run Get-ChildItem 5 times to start adding artifacts to memory, then remove any garbage collected in memory using the ( CM ) alias.
Notes:
```
#### EXAMPLE 3
```
Command: Clear-BlugenieMemory -Help
```
```
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
```
#### EXAMPLE 4
```
Command: Clear-BlugenieMemory -WalkThrough
```
```
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
```
#### EXAMPLE 5
```
Command: Clear-BlugenieMemory -OutUnEscapedJSON
```
```
Description: and Return Output as UnEscaped JSON format
Notes: The OutUnEscapedJSON is used to beatify the JSON return and not Escape any Characters. Normal return data is a Hash Table.
```
#### EXAMPLE 6
```
Command: Clear-BlugenieMemory -ReturnObject
```
```
Description: and Return Output an Object
Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table.
```
### PARAMETERS
#### All
```
-All []
Description: Clear the Console Screen, and any variables that might be holding a lot of data
Notes: Variables that are cleared of data are ($StackTrace, Error)
Alias: Help
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### SleepTimer
```
-SleepTimer
Required? false
Position? 1
Default value 1
Accept pipeline input? false
Accept wildcard characters? false
```
#### LoopCount
```
-LoopCount
Required? false
Position? 2
Default value 1
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Description: Start the dynamic help menu system to help walk through the current command and all of the parameters
Notes:
Alias: Help
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### ReturnObject
```
-ReturnObject []
Description: Return information as an Object
Notes: By default the data is returned as a Hash Table
Alias:
ValidateSet:
Required? false
Position? named
Default value True
Accept pipeline input? false
Accept wildcard characters? false
```
#### OutUnEscapedJSON
```
-OutUnEscapedJSON []
Description: Remove UnEsacped Char from the JSON information.
Notes: This will beautify json and clean up the formatting.
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### FormatView
```
-FormatView
Required? false
Position? 3
Default value None
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Connect-BluGenieToSystem
### Connect-BluGenieToSystem
### SYNOPSIS
Connect-BluGenieToSystem will spawn a remote session into the computer you specify
### SYNTAX
```
Connect-BluGenieToSystem [[-ComputerName] ] [-Walkthrough] [-Force] [-CopyModules] [-SystemtModulePath] []
```
### DESCRIPTION
Connect-BluGenieToSystem is a trouble shooting process to spawn a remote session into the computer(s) you specify. You can also send the BluGenie Module, Service, and Tools to any of the rolling remote system directories
\- $env:ProgramFiles\BluGenie (This is the Default Path)
\- $env:ProgramFiles\WindowsPowerShell\ModuleSource
Note: When you copy the tools BluGenie will not Auto Load. It was designed to force an Import
### EXAMPLES
#### EXAMPLE 1
```
Connect-BluGenieToSystem -ComputerName 10.20.136.52
```
```
This will try and resolve the IP to a Domain name, test to see if the system is online, and then spawn a remote session into the system
```
#### EXAMPLE 2
```
Connect-BluGenieToSystem -ComputerName TestPC05
```
```
This will test to see if the system is online, and then spawn a remote session into the system
```
### PARAMETERS
#### ComputerName
```
-ComputerName
Description: Computer name or IP Address of the remote system.
Notes: This can be an Array of systems. All Systems will process in an asynchronous order and all connections will be minimized at start.
Alias:
ValidateSet:
Required? false
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Description: An automated process to walk through the current function and all the parameters
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### Force
```
-Force []
Description: Do not test the connect to the computer, just execute the connection process
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### CopyModules
```
-CopyModules []
Description: Copy the BluGenie Module content to the remote host over WinRM. This will not use SMB.
Notes: Default path is $env:\ProgramFiles\BluGenie
If the default path is set you can run Import-Module 'C:\Program Files\BluGenie' to load the module
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### SystemtModulePath
```
-SystemtModulePath []
Description: When Copying the BluGenie Module content set the save path to the default Windows PowerShell Module directory
Notes: Path is $env:\ProgramFiles\WindowsPowerShell\Modules\BluGenie.
If this path is set you can run Import-Module BluGenie without having to set a Module path
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Convert-BluGenieSID2UserName
### Convert-BluGenieSID2UserName
### SYNOPSIS
Convert Security ID (SID) to UserName
### SYNTAX
```
Convert-BluGenieSID2UserName [[-SID] ] [[-Walkthrough]] []
```
### DESCRIPTION
Convert Security ID (SID) to UserName
### EXAMPLES
#### EXAMPLE 1
```
Convert-BluGenieSID2UserName -SID S-1-5-21-544048806-3957405606-1151431920-500
```
```
This will return user 'Administrator' for the Security ID (SID)
```
### PARAMETERS
#### SID
```
-SID
Security ID (SID) to be converted to UserName
String
Required? false
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Required? false
Position? 2
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Convert-BluGenieSize
### Convert-BluGenieSize
### SYNOPSIS
convert a value from Bytes, KB, MB, GB, TB to \[TB/GB/MB/KB/Bytes]
### SYNTAX
```
Convert-BluGenieSize [-Value] [-InputType ] [-OutputType ] [-Precision ] [-Walkthrough] [-ReturnObject] [-OutUnEscapedJSON] [-FormatView ] []
```
### DESCRIPTION
convert a value from Bytes, KB, MB, GB, TB to \[TB/GB/MB/KB/Bytes]
### EXAMPLES
#### EXAMPLE 1
```
```
```
Description:
Notes:
```
#### EXAMPLE 2
```
```
```
Description:
Notes:
```
#### EXAMPLE 3
```
Command: Convert-BluGenieSize -Help
```
```
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
```
#### EXAMPLE 4
```
Command: Convert-BluGenieSize -WalkThrough
```
```
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter
```
#### EXAMPLE 5
```
Command: Convert-BluGenieSize -OutUnEscapedJSON
```
```
Description: and Return Output as UnEscaped JSON format
Notes: The OutUnEscapedJSON is used to beatify the JSON return and not Escape any Characters. Normal return data is a Hash Table.
```
#### EXAMPLE 6
```
Command: Convert-BluGenieSize -ReturnObject
```
```
Description: and Return Output an Object
Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table.
```
### PARAMETERS
#### Value
```
-Value
Description: The Size value to be converted
Notes:
Alias:
ValidateSet:
Required? true
Position? 1
Default value 0
Accept pipeline input? false
Accept wildcard characters? false
```
#### InputType
```
-InputType
Description: Source Size Type
Notes: Default is KB
Alias:
ValidateSet: 'Bytes','KB','MB','GB','TB'
Required? false
Position? named
Default value KB
Accept pipeline input? false
Accept wildcard characters? false
```
#### OutputType
```
-OutputType
Description: Destination Size Type
Notes: Default is MB
Alias:
ValidateSet: 'Bytes','KB','MB','GB','TB'
Required? false
Position? named
Default value MB
Accept pipeline input? false
Accept wildcard characters? false
```
#### Precision
```
-Precision
Description: Return the value of digits after the dot/decimal point
Notes: Default is 2
Alias:
ValidateSet:
Required? false
Position? named
Default value 2
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Description: Start the dynamic help menu system to help walk through the current command and all of the parameters
Notes:
Alias: Help
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### ReturnObject
```
-ReturnObject []
Description: Return information as an Object
Notes: By default the data is returned as a Hash Table
Alias:
ValidateSet:
Required? false
Position? named
Default value True
Accept pipeline input? false
Accept wildcard characters? false
```
#### OutUnEscapedJSON
```
-OutUnEscapedJSON []
Description: Remove UnEsacped Char from the JSON information.
Notes: This will beautify json and clean up the formatting.
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### FormatView
```
-FormatView
Required? false
Position? named
Default value None
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Convert-BluGenieUserName2SID
### Convert-BluGenieUserName2SID
### SYNOPSIS
Convert UserName to Security ID (SID)
### SYNTAX
```
Convert-BluGenieUserName2SID [[-UserName] ] [[-Walkthrough]] []
```
### DESCRIPTION
Convert UserName to Security ID (SID)
### EXAMPLES
#### EXAMPLE 1
```
Convert-BluGenieUserName2SID -UserName Administrator
```
```
This will return Security ID (SID) for the user 'Administrator'
```
### PARAMETERS
#### UserName
```
-UserName
UserName to be converted to Security ID (SID)
String
Required? false
Position? 1
Default value
Accept pipeline input? false
Accept wildcard characters? false
```
#### Walkthrough
```
-Walkthrough []
Required? false
Position? 2
Default value False
Accept pipeline input? false
Accept wildcard characters? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# Convert-BluGenieUTCtoLocal
### Convert-BluGenieUTCtoLocal
### SYNOPSIS
Convert UTC Data Information to Local Time
### SYNTAX
Convert-BluGenieUTCtoLocal \[\[-UTCTime] ]
### DESCRIPTION
Convert UTC Data Information to Local Time
### EXAMPLES
```
```
```
```
### PARAMETERS
#### UTCTime
```
-UTCTime
Required? false
Position? 0
Accept pipeline input? false
Parameter set name (All)
Aliases None
Dynamic? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# ConvertFrom-Yaml
### ConvertFrom-Yaml
### SYNOPSIS
Convert a Yaml Formatted String/Files to a \[PSCustomObject]
### SYNTAX
ConvertFrom-Yaml \[\[-Yaml] ] \[-AllDocuments] \[-Ordered] \[-UseMergingParser] \[\]
### DESCRIPTION
Convert a Yaml Formatted String/Files to a \[PSCustomObject]
### EXAMPLES
```
```
```
```
### PARAMETERS
#### AllDocuments
```
-AllDocuments
Required? false
Position? Named
Accept pipeline input? false
Parameter set name (All)
Aliases None
Dynamic? false
```
#### Ordered
```
-Ordered
Required? false
Position? Named
Accept pipeline input? false
Parameter set name (All)
Aliases None
Dynamic? false
```
#### UseMergingParser
```
-UseMergingParser
Required? false
Position? Named
Accept pipeline input? false
Parameter set name (All)
Aliases None
Dynamic? false
```
#### Yaml
```
-Yaml
Required? false
Position? 0
Accept pipeline input? true (ByValue)
Parameter set name (All)
Aliases None
Dynamic? false
```
#### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
# ConvertTo-BluGenieDate
## ConvertTo-BluGenieDate
### SYNOPSIS
Helper function for AD Properties
### SYNTAX
ConvertTo-BluGenieDate \[\[-accountExpires] ]
### DESCRIPTION
Helper function for AD Properties
### EXAMPLES
####
### PARAMETERS
#### accountExpires
```
-accountExpires