AESB - ACMP Defender Telegram Notifier

$global:TelegramBotKey = ""
$global:TelegramChatIDs = ""
#$global:[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12


#
# Telegram API
#
function global:Send-TeleMessage([string] $Botkey , [array] $ChatIDs , [string] $Message)
{
	$sendMsgLink = "https://api.telegram.org/bot$BotKey/sendMessage"
	foreach ($ID in $ChatIDs)
	{
		try
		{
		
			$ExecuteInvokeWeb = Invoke-WebRequest -Uri "$sendMsgLink" -Method Post -ContentType "application/json;charset=utf-8" -Body (ConvertTo-Json -Compress -InputObject @{chat_id=$ID; text="$Message"})
			$Status = (ConvertFrom-Json -InputObject $ExecuteInvokeWeb.Content)
			if($Status.ok){Write-Host "Message successfully sent to Chat ID : $ID (Type : $($Status.result.chat.type))" -ForegroundColor Green}
		}
		catch [Exception]
		{
			$exception = $_.Exception.ToString().Split(".")[2]
			Write-Host "Message faild to  sent at Chat ID : $ID ($exception)" -ForegroundColor Red
		}
	}
}


#
# Windows Notifiaction ansprechen
#
function global:Show-Notification {
	[cmdletbinding()]
	Param (
		[string]
		$ToastTitle,
		[string]
		[parameter(ValueFromPipeline)]
		$ToastText
	)
	
	[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
	$Template = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)
	
	$RawXml = [xml] $Template.GetXml()
	($RawXml.toast.visual.binding.text|where {$_.id -eq "1"}).AppendChild($RawXml.CreateTextNode($ToastTitle)) > $null
	($RawXml.toast.visual.binding.text|where {$_.id -eq "2"}).AppendChild($RawXml.CreateTextNode($ToastText)) > $null
	
	$SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument
	$SerializedXml.LoadXml($RawXml.OuterXml)
	
	$Toast = [Windows.UI.Notifications.ToastNotifiaction]::new($SerializedXml)
	$Toast.Tag = "PowerShell"
	$Toast.Group = "PowerShell"
	$Toast.ExpirationTime = [DateTimeOffset]::Now.AddMinutes(1)
	
	$Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier("PowerShell")
	$Notifier.Show($Toast);
}


#
# die ACMP ClientList anfragen (um die ClientID in einem Hostnamen im Event aufzulösen)
#
function global:GetClient {
	param($clientId)
	$clients = Acmp-GetClientList_V1 -AcmpServerId "*"
	foreach ($client in $clients.Clients) {
		if ($client.ClientId -eq $clientId) {
			return $client.ComputerName
		}
	}
}


#
# @brief: This event gets fired on StartUp.
#
Register-EngineEvent -SourceIdentifier 'MicroService.OnStart' -Action { 
 Write-LogMessage -Message "Starting.. ACMPDefender"
 WriteBusinessLog-Message -Code 0 -Message "Starting.. ACMPDefender" -LogType Info 
}


#
# @brief: This event gets fired on Shut down
#
Register-EngineEvent -SourceIdentifier 'MicroService.OnStop' -Action {
 Write-LogMessage -Message "Stopping.. ACMPDefender"
 WriteBusinessLog-Message -Code 0 -Message "Stopping.. ACMPDefender" -LogType Info
}


#
# brief: This event gets fired when a message is received.
#


#
Register-EngineEvent -SourceIdentifier 'MicroService.OnMessage' -Action {
	Write-LogMessage -Message "Received Event"
	[string]$messageBody = [System.Text.Encoding]::UTF8.GetString($args[0].Body)
	$event = (Select-Xml -Content $messageBody -XPath "/ICQL/ACMP/Event").Node.Name 
	
	if ($event -eq "Event") {
		Write-LogMessage -Message "$messageBody"
		
		#XML auswerten
		$type = (Select-Xml -Content $messageBody -XPath "/ICQL/ACMP/Event/TEventNotifierMessage_V1/Items/TPublicAPIBaseData/EventType").Node.InnerText 
		$clientId = (Select-Xml -Content $messageBody -XPath "/ICQL/ACMP/Event/TEventNotifierMessage_V1/Items/TPublicAPIBaseData/ClientID").Node.InnerText 
		$EventDetail = (Select-Xml -Content $messageBody -XPath "/ICQL/ACMP/Event/TEventNotifierMessage_V1/Items/TPublicAPIBaseData/EventDetail_de").Node.InnerText
	
		#Name des Clients erfahren 
		$clientName = global:GetClient -clientId $clientId
	
		#Nachrichten zusammenbasteln - `r`n ist ein Zeilenumbruch in Powershell 
		$notification = "Type: " + $type + "`r`nClient: " + $clientName 
		$TeleMessage = "Es wurde eine Bedrohung erkannt, bitte überprüfen Sie ihre ACMP Console.`r`n`r`n" + $EventDetail + "`r`n`r`n" + " Client: " + $clientName
	
		Write-LogMessage -Message $notification
	
		#Windows Notfication los schießen
		global:Show-Notification -ToastTitle "ACMP Defender Notification" -ToastText $notification
	
		#Wenn der Eventtyp ein Alarm ist, dann sende die Telegramnachricht
		if ($type -eq "Alarm")
		{
			global:Send-TeleMessage -BotKey "$TelegramBotKey" -ChatIDs "$TelegramChatIDs" -Message "$TeleMessage"
		}
	}	
}


#Lese die Werte aus den AESB Schema
Register-EngineEvent -SourceIdentifier 'MicroService.OnConfigChanged' -Action {
	$config = $args[0]
	Write-LogMessage -Message "Received config: $config"
	
	$global:TelegramBotKey = (Select-Xml -Content $config -XPath "/ACMP.TelegramNotification/TelegramBotKey").Node.InnerText
	$global:TelegramChatIDs = (Select-Xml -Content $config -XPath "/ACMP.TelegramNotification/TelegramChatIDs").Node.InnerText
	
 #	 Write-LogMessage -Message "Parsed values: # $global:TelegramBotKey ## $global:TelegramChatIDs"
 
}