gistfile1.txt

function ConvertTo-VectrOutcome {
    param(
        $StatusValue,
        $Finding,
        [string] $FindingName,
        [string] $DetectedPath = 'Alerted.Alerted_Priority_Medium',
        [string] $DetectedHighPath = 'Alerted.Alerted_Priority_High',
        [string] $DetectedBlockedPath = 'Blocked.Blocked_Alerted_Yes',
        [string] $NotDetectedPath = 'TBD'
    )

    $statusText = ''
    if ($null -ne $StatusValue -and -not ($StatusValue -is [bool])) {
        $statusText = ([string]$StatusValue).Trim()
    }

    $isDetected = $null
    if ($StatusValue -is [bool]) { $isDetected = [bool]$StatusValue }
    elseif ($statusText -match '(?i)^not[\s_-]*detected$') { $isDetected = $false }
    elseif ($statusText -match '(?i)^detected$') { $isDetected = $true }

    if ($null -eq $isDetected) { $isDetected = $true }

    if (-not $isDetected) {
        return [pscustomobject]@{
            Outcome        = 'NOTDETECTED'
            OutcomePath    = $NotDetectedPath
            AlertTriggered = 'No'
        }
    }

    $blocked = $false
    $severity = ''
    if ($null -ne $Finding) {
        foreach ($n in @('blocked', 'prevented', 'prevention', 'isBlocked')) {
            $bp = $Finding.PSObject.Properties[$n]
            if ($null -eq $bp -or $null -eq $bp.Value) { continue }
            if ($bp.Value -is [bool]) { $blocked = [bool]$bp.Value; break }
            if (("$($bp.Value)").Trim() -match '(?i)^(true|yes|blocked|prevented)$') { $blocked = $true; break }
        }
        foreach ($n in @('severity', 'alertSeverity', 'priority')) {
            $sp = $Finding.PSObject.Properties[$n]
            if ($null -ne $sp -and $null -ne $sp.Value) { $severity = [string]$sp.Value; break }
        }
    }
    if (-not $blocked -and $FindingName -match '(?i)block|prevent') { $blocked = $true }

    $path = $DetectedPath
    if ($blocked) { $path = $DetectedBlockedPath }
    elseif ($severity -match '(?i)high|crit') { $path = $DetectedHighPath }

    return [pscustomobject]@{
        Outcome        = 'DETECTED'
        OutcomePath    = $path
        AlertTriggered = 'Yes'
    }
}