Instantly share code, notes, and snippets.

Embed
What would you like to do?
Get VSTS Access events that are not from a white-list of IPs
param(
[Parameter(Mandatory=$true, HelpMessage="Name of the VSTS account e.g. FabrikamFiber")]
$VSTSAccount,
[Parameter(Mandatory=$true, HelpMessage="Personal Access Token")]
$PAT,
[Parameter(Mandatory=$true, HelpMessage="Date range start in format yyyy-MM-dd e.g. 2018-05-01. Data is only available for the last 28 days.")]
$StartDate,
[Parameter(Mandatory=$true, HelpMessage="Date range end in format yyyy-MM-dd e.g. 2018-05-30")]
$EndDate,
[Parameter(HelpMessage="List of white-list IPs. Any access from access not in this list is considered an exception.")]
$AllowedIPs = @("192.168.1.1")
)
# the url of the API to hit
$url = "https://{0}.visualstudio.com/_apis/Utilization/UsageSummary?queryCriteria%5BuserId%5D=&queryCriteria%5BstartTime%5D={1}&queryCriteria%5BendTime%5D={2}&queryCriteria%5BtimeBucket%5D=00%3A05%3A00&queryCriteria%5Bkeywords%5D=&queryCriteria%5Bstatus%5D=0&queryCriteria%5BtSTUFloor%5D=0&queryCriteria%5Bcolumns%5D%5B%5D=1&queryCriteria%5Bcolumns%5D%5B%5D=2&queryCriteria%5Bcolumns%5D%5B%5D=3&queryCriteria%5Bcolumns%5D%5B%5D=5&queryCriteria%5Bcolumns%5D%5B%5D=6&queryCriteria%5Bcolumns%5D%5B%5D=7&queryCriteria%5Bcolumns%5D%5B%5D=8&queryCriteria%5BrecordLimit%5D=5000&api-version=4.0-preview.2" -f $VSTSAccount, $StartDate, $EndDate
# create a header using a PAT
$basicAuthHeader = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("anything:{0}" -f $PAT)))
$headers = @{Authorization=("Basic {0}" -f $basicAuthHeader)}
# invoke a REST call using the header
Write-Host "Getting audit events" -ForegroundColor Yellow
$result = Invoke-RestMethod -Method Get -Uri $url -Headers $headers
Write-Host "Received $($result.count) records" -ForegroundColor Cyan
$exceptionRecords = $result.value | Where-Object { $allowedIPs -notcontains $_.ipAddress }
if ($exceptionRecords.count -gt 0) {
$file = "VSTS-AccessExceptionReport-{0}.csv" -f (Get-Date -Format "yyyy-MM-dd-HH-mm-ss")
Write-Host "Found $($exceptionRecords.count) exceptions: dumping to $($PWD)\$file" -ForegroundColor Red
$exceptionRecords | Export-Csv -Path $file -NoTypeInformation
} else {
Write-Host "No exceptions!" -ForegroundColor Green
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment