OMS-custom-monitor_1

1.ps1

Import-Module OneLogin

$Credential = Get-Credential
$Token = New-OneLoginToken -Credential $Credential -Region us -SetAsDefault
$Events = Get-OneLoginEvent -Since (Get-Date).AddHours(-1)

2.ps1

Import-Module OneLogin
Import-Module OMSDataInjection

$OMSWorkSpaceID = "<your workspace ID here>"
$OmsPrimaryKey = "<your key here>"
$OmsSecondaryKey = "<your key here>"
$LogType = "OneLoginEvent"
$TimeStampFieldName = "LogTime"

# calculate start and end times for the previous hour
$Now = Get-Date
$CurrentHour = $Now.Hour
$PreviousHour = $Now.AddHours(-1).Hour
$Today = Get-Date | Select-Object -ExpandProperty Date
$Begin = $Today.AddHours($PreviousHour)
$End = $Today.AddHours($CurrentHour)

try
{
    New-OneLoginToken -Credential $OneLoginApiCredential -Region us -SetAsDefault
    $HourEvents = Get-OneLoginEvent -Since $Begin -Until $End
}
catch { exit }

$OMSSplat = @{
    OMSWorkSpaceId = $OmsWorkspaceId
    PrimaryKey     = $OmsPrimaryKey	
    SecondaryKey   = $OmsSecondaryKey
    LogType        = $LogType

}
foreach ($Event in $HourEvents | Select-Object -Property *,@{n=$TimeStampFieldName; e={$_.created_at.UtcDateTime}} -ExcludeProperty created_at)
{
    try
    {
        New-OMSDataInjection @OMSSplat -OMSDataObject $Event -UTCTimeStampField $TimeStampFieldName
    }
    catch
    {
        Write-Error $_
    }
}

3.ps1

Install-Module OneLogin

4.ps1

Install-Module OMSDataInjection