76 lines
3.0 KiB
PowerShell
76 lines
3.0 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
|
|
[int]$DaysBack = 1,
|
|
[string]$ServerHost = '10.10.10.13',
|
|
[string]$ServerUser = 'awops',
|
|
[string]$RemoteDropDir = '/opt/activitywatch/aw-rus-ops/drop',
|
|
[string]$RemoteKeyPath = 'C:\ProgramData\AWatch-rus\ssh\awops_ed25519',
|
|
[string]$Mode = 'incident',
|
|
[Nullable[int]]$CaseId,
|
|
[switch]$RunRemote,
|
|
[switch]$NoLink
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$exportScript = 'C:\ProgramData\AWatch-rus\export-evtx-for-hayabusa.ps1'
|
|
if (-not (Test-Path -LiteralPath $exportScript)) {
|
|
throw "export script not found: $exportScript"
|
|
}
|
|
if (-not (Test-Path -LiteralPath $RemoteKeyPath)) {
|
|
throw "SSH private key not found: $RemoteKeyPath"
|
|
}
|
|
|
|
$export = powershell.exe -ExecutionPolicy Bypass -File $exportScript -ConfigPath $ConfigPath -DaysBack $DaysBack | ConvertFrom-Json
|
|
$zipPath = [string]$export.zipPath
|
|
$hostName = [string]$export.hostname
|
|
if ([string]::IsNullOrWhiteSpace($zipPath) -or -not (Test-Path -LiteralPath $zipPath)) {
|
|
throw "zipPath missing or not found after export: $zipPath"
|
|
}
|
|
|
|
$zipName = Split-Path -Leaf $zipPath
|
|
$remoteTarget = "$ServerUser@$ServerHost`:$RemoteDropDir/"
|
|
$baseName = [System.IO.Path]::GetFileNameWithoutExtension($zipPath)
|
|
$caseIdPath = Join-Path ([System.IO.Path]::GetDirectoryName($zipPath)) ($baseName + '.caseid')
|
|
|
|
& scp.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $zipPath $remoteTarget
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "scp upload failed with rc=$LASTEXITCODE"
|
|
}
|
|
if ($CaseId.HasValue) {
|
|
Set-Content -LiteralPath $caseIdPath -Value ([string]$CaseId.Value) -Encoding ASCII
|
|
& scp.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $caseIdPath $remoteTarget
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "scp caseid upload failed with rc=$LASTEXITCODE"
|
|
}
|
|
}
|
|
|
|
$result = [ordered]@{
|
|
exportedZip = $zipPath
|
|
uploadedTo = "$RemoteDropDir/$zipName"
|
|
caseIdSidecar = if ($CaseId.HasValue) { "$RemoteDropDir/$baseName.caseid" } else { $null }
|
|
hostname = $hostName
|
|
mode = $Mode
|
|
runRemote = [bool]$RunRemote
|
|
}
|
|
|
|
if ($RunRemote) {
|
|
$accept = "sudo /usr/local/bin/aw-hayabusa accept --package $RemoteDropDir/$zipName --host $hostName"
|
|
$process = "sudo /usr/local/bin/aw-hayabusa process-inbox --mode $Mode --limit 1"
|
|
$link = if ($CaseId.HasValue -and -not $NoLink) {
|
|
" && sudo /usr/local/bin/aw-hayabusa-link-case --case-id $($CaseId.Value) --mode $Mode --link-source windows-direct-upload"
|
|
} else {
|
|
''
|
|
}
|
|
$remoteCmd = "$accept && $process$link && sudo cat /opt/hayabusa/state/latest-intake.json"
|
|
$remoteOut = & ssh.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL "$ServerUser@$ServerHost" $remoteCmd
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "remote Hayabusa run failed with rc=$LASTEXITCODE"
|
|
}
|
|
$result.remoteOutput = $remoteOut
|
|
}
|
|
|
|
$result | ConvertTo-Json -Depth 8
|