rebrec

# Extract Deployment information from MECM (SCCM) through WMI for a specific device.
# Useful to monitor specific devide deployment current progression state or to get some history informations

$ComputerName = "VM-XXX" # computer to find deployment information
$ExecutionTime = '20240327100900.000000+000'    # date of the oldest log to extract
$SiteCode = "XYZ" 

pushd "$($SiteCode):"

$steps = Get-WmiObject -ComputerName "srv-mecm-01" -Namespace "Root\SMS\site_$SiteCode"  -Query "Select * from SMS_TaskSequenceExecutionStatus Where ResourceID='$(get-cmdevice -name $Computername -Fast | select -ExpandProperty ResourceId)' AND ExecutionTime > '$ExecutionTime'"  `

rebrec

let maliciousTitles = dynamic(["Malicious URL Click", "Potentially malicious URL"]);
let MaliciousUrlClickAlerts = AlertInfo
| where Title has_any(maliciousTitles)
| project AlertId;
//
let AlertDetails = AlertInfo
| where AlertId in (MaliciousUrlClickAlerts)
| project AlertId, AlertTimestamp = Timestamp, Title, Severity, Category;
//
let interestingNIDs = AlertEvidence