Tachyon Send Notification and Kill Process Instructions

1E-Demo-SendNotification.xml

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<InstructionDefinition Author="june.castillote@gmail.com" Name="1E-Demo-SendNotification" ReadablePayload="Send a notification with Title: %Title%, Message: %Message%" Description="Sends a notification to target devices" InstructionType="Action" InstructionTtlMinutes="10" ResponseTtlMinutes="10" Version="1.0" xmlns="http://schemas.1e.com/Tachyon/InstructionDefinition/1.0">
  <Payload><![CDATA[Interaction.ShowNotification(Title:"%Title%",Description:"%Message%", Type:"Information");
]]></Payload>
  <SchemaJson><![CDATA[[
  {
    "Name": "UserName",
    "Type": "string",
    "Length": 32
  },
  {
    "Name": "Result",
    "Type": "string",
    "Length": 16
  },
  {
    "Name": "SessionId",
    "Type": "int64",
    "Length": 0
  }
]]]></SchemaJson>
  <ParameterJson><![CDATA[[
  {
    "Name": "Title",
    "Pattern": "%Title%",
    "DataType": "string",
    "ControlType": "freeText",
    "ControlMetadata": "",
    "Placeholder": "",
    "DefaultValue": "",
    "Validation": {
      "Regex": "",
      "MaxLength": "",
      "AllowedValues": []
    },
    "HintText": "",
    "Source": ""
  },
  {
    "Name": "Message",
    "Pattern": "%Message%",
    "DataType": "string",
    "ControlType": "freeText",
    "ControlMetadata": "",
    "Placeholder": "",
    "DefaultValue": "",
    "Validation": {
      "Regex": "",
      "MaxLength": "",
      "AllowedValues": []
    },
    "HintText": "",
    "Source": ""
  }
]]]></ParameterJson>
  <Workflow><![CDATA[{"StateMachine":"State"}]]></Workflow>
</InstructionDefinition>

1E-Demo-TerminateProcessList.xml

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<InstructionDefinition Author="june.castillote@gmail.com" Name="1E-Demo-TerminateProcessList" ReadablePayload="Terminate processes %ProcessIdList%" Description="Forcibly terminate all processes in a comma delimited process ID list (eg. 10222,8759,23424)" InstructionType="Action" InstructionTtlMinutes="10" ResponseTtlMinutes="10" Version="1.0" xmlns="http://schemas.1e.com/Tachyon/InstructionDefinition/1.0">
  <Payload><![CDATA[@psIdList = Utilities.SplitLines(Text:"%ProcessIdList%",Delimiter:",");
FOREACH @psId IN @psIdList
DO
    OperatingSystem.KillProcess(ProcessId:@psId);
DONE;]]></Payload>
  <SchemaJson><![CDATA[[
  {
    "Name": "Killed",
    "Type": "bool",
    "Length": 0
  }
]]]></SchemaJson>
  <ParameterJson><![CDATA[[
  {
    "Name": "ProcessIdList",
    "Pattern": "%ProcessIdList%",
    "DataType": "string",
    "ControlType": "freeText",
    "ControlMetadata": "",
    "Placeholder": "",
    "DefaultValue": "",
    "Validation": {
      "Regex": "",
      "MaxLength": "",
      "AllowedValues": []
    },
    "HintText": "",
    "Source": ""
  }
]]]></ParameterJson>
  <Workflow><![CDATA[{"StateMachine":"State"}]]></Workflow>
</InstructionDefinition>

Kill-TachyonRougeProcess.ps1

Import-Module 'C:\Program Files\1E\Tachyon\pstoolkit\PSTachyonToolkit.psd1'
Set-TachyonServer 1E01.corp.1EDemoLab.com
Set-TachyonInstructionPrefix "1E-Demo"

# Get all desktop endpoints that are online.
$targetEndpoints = @((Get-TachyonDevice -Full | Where-Object { $_.DeviceType -eq 'Desktop' -and $_.Status -eq 1 }).FQDN)

# Invoke the instruction to get the running processes details on each endpoint.
$instructionID = Invoke-TachyonInstruction -instruction '1E-Exchange-ProcessDetails' -TargetFqdns $targetEndpoints -NoWait

# Filter results
$memThreshold = 1.5GB
$result = Get-TachyonInstructionResult -Id $instructionID -Resultfilter "MemoryUsageBytes>=$($memThreshold)"

# For good measure, end the script here IF the filtered result returned ZERO items.
if ($result.Count -lt 1) {
    Out-Default "There are zero (0) results. Exiting script."
    return $null
}

# Merge Fqdn and values
$result.Keys | ForEach-Object {
    $result[$_] | Add-Member -MemberType NoteProperty -Name Fqdn -Value $_ -Force
}
# Convert result from Hashtable to custom object
$result = $result.Values.ToArray() | Sort-Object Fqdn | Select-Object Fqdn, Executable, ProcessId, ParentExecutable, MemoryUsageBytes, AccountName


# Get a unique FQDNs
$fqdns = @(($result | Select-Object -Unique Fqdn).Fqdn)
# Loop through each FQDN and issue the notify and kill instructions
for ($i = 0; $i -lt $fqdns.Count; $i++) {
    # Get all the processes to terminate on the current endpoint
    $process = $result | Where-Object { $_.Fqdn -eq $fqdns[$i] }

    # Notify Users
    $notificationSplat = @{
        TargetFqdns = $fqdns[$i]
        Instruction = '1E-Demo-SendNotification' # Must publish the 1E-Demo-SendNotification.xml instruction first
        NoWait      = $true
        InstTTL     = 10
        Title       = 'Kill Process Notification'
        Message     = "The follow processes are consuming over $("{0:N0}" -f $memThreshold) bytes of memory each and may be affecting your system's performance. " +
        "Your IT department will now attempt to close these processes and there are no actions required from you at this time." +
        "`n`nProcess list: $(($process.Executable) -Join ',')"
    }
    $null = Invoke-TachyonInstruction @notificationSplat

    # Kill Processes
    $killProcessSplat = @{
        TargetFqdns   = $fqdns[$i]
        Instruction   = '1E-Demo-TerminateProcessList' # Must publish the 1E-Demo-TerminateProcessList.xml instruction first
        NoWait        = $true
        InstTTL       = 10
        ProcessIdList = $(($process.ProcessId) -Join ',')
    }
    $null = Invoke-TachyonInstruction @killProcessSplat
}