#Function created by Iain Waddingham - Aug 14th 2023
function CreateSuperOpsAlert {
# Set any parameters that are needed
param (
[string]$alertSubject, # Subject for the Alert
[string]$alertText, # Message body of the Alert
[string]$Severity, # Severity can be Critical, High, Medium or Low
[string]$filePath # Path to where the alert subject and ID will be held for resolving later
)
# Check if the alert subject already exists in the file
$escapedAlertSubject = [regex]::Escape($alertSubject)
if (Get-Content -Path $filePath -ErrorAction SilentlyContinue | Select-String -Pattern $escapedAlertSubject) {
Write-Output "Alert with subject '$alertSubject' already exists. Skipping writing response."
return
}
# Set your API Key and Customer Subdomain
$apiKey = "YOUR-API-KEY-HERE"
$customerSubDomain = "YOUR SUDOMAIN HERE"
# Construct headers
$headers = @{
"CustomerSubDomain" = $customerSubDomain
"Authorization" = "Bearer $apiKey"
"Content-Type" = "application/json"
}
# Set the GraphQL query
$query = @'
mutation CreateAlert($input: CreateAlertInput!) {
createAlert(input: $input) {
id
asset
createdTime
message
description
severity
policy
}
}
'@
# Set the Variables
$variables = @{
"input" = @{
"assetId" = $assetId
"message" = "$alertSubject"
"description" = "$alertText"
"severity" = "$Severity"
}
}
# Construct the body
$body = @{
"query" = $query
"variables" = $variables
}
# Make the API request
$response = Invoke-RestMethod -Uri 'https://api.superops.ai/msp' -Method 'POST' -Headers $headers -Body ($body | ConvertTo-Json)
# Retrieve and save the Alert ID
$alertId = $response.data.createAlert.id
Write-Output $alertId
#Creates the alert file if it doesn't exist
if (-not (Test-Path $filePath)) {
New-Item -Path $filePath -ItemType File
}
#Appends the alert details to the file
"$alertSubject,$alertId" | Out-File -FilePath $filePath -Append
# Output the response
$response | ConvertTo-Json
Write-Output $response
}
# Call the function example
CreateSuperOpsAlert -alertSubject "Test Alert" -alertText "This is an alert message" -Severity "Low" -filePath "C:\Alerts.txt"
Script data
Language - PowerShell
Run as - System / Root User
Script timeout duration - 5 Mins
Script variables
Placeholder Variables - assetId - asset.defaultField.assetId
Read me
Use the "Resolve Alert Function via API" in conjunction with this to get the function for resolving the alerts later. You'll need to fill in your API Key and Customer Subdomain. Placeholder variable of "assetId" to "asset.defaultField.assetId" needs to be set. Copy the function to an existing script to easily create alerts in a script. See the "API Alert Functions Example - Check File Exists" script for usage in a full script.