Get-S1CriticalApplicationsReport.ps1

<#
.SYNOPSIS
    Generates a comprehensive report of SentinelOne applications with critical vulnerabilities.

.DESCRIPTION
    Queries the SentinelOne Application Management API to retrieve all applications with Critical severity.
    Calculates and reports on exploitation metrics including:
    - Total critical applications
    - Percentage exploited in the wild
    - Percentage with high exploit code maturity
    
    Supports filtering by account/site and multiple output formats (Console, CSV, JSON, HTML, All).

.PARAMETER BaseUrl
    SentinelOne console URL
    
.PARAMETER ApiToken
    SentinelOne API token for authentication
   
.PARAMETER ClientName
    Client name(s) to filter by. Supports wildcards and fuzzy matching.
    Automatically looks up site IDs from human-readable client names.

.PARAMETER ExportFormat
    Export format: "Console", "CSV", "JSON", "HTML", "All" (Default: "Console")

.PARAMETER OutputPath
    Directory path for exported files (Default: ".\")

.PARAMETER IncludeAllApplications
    Include all applications in the detailed list, not just critical (Default: False)

.EXAMPLE
    .\Get-S1CriticalApplicationsReport.ps1
    
    Generates console output using PowerShell Universal variables

.EXAMPLE
    .\Get-S1CriticalApplicationsReport.ps1 -BaseUrl "https://usea1-swprd1.sentinelone.net" -ApiToken "your_token" -ExportFormat HTML

.EXAMPLE
    .\Get-S1CriticalApplicationsReport.ps1 -ClientName "Contoso","Acme Corp" -ExportFormat All

.NOTES
    Author: Geoff Tankersley
    Version: 1.0
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [ValidatePattern('https://.*\.sentinelone\.net$')]
    [string]$BaseUrl,
    
    [Parameter(Mandatory = $true)]
    [string]$ApiToken,
    
    
    [Parameter(Mandatory = $false)]
    [string[]]$ClientName,
    
    [Parameter(Mandatory = $false)]
    [ValidateSet("Console", "CSV", "JSON", "HTML", "All")]
    [string]$ExportFormat = "Console",
    
    [Parameter(Mandatory = $false)]
    [string]$OutputPath = ".\",
    
    [Parameter(Mandatory = $false)]
    [switch]$IncludeAllApplications
)

begin {
    $ErrorActionPreference = "Stop"
    
    $BaseUrl = $BaseUrl.TrimEnd('/')
    
    $headers = @{
        "Authorization" = "ApiToken $ApiToken"
        "Content-Type" = "application/json"
    }
    
    if ($ExportFormat -eq "All" -or $ExportFormat -ne "Console") {
        if (-not (Test-Path -Path $OutputPath)) {
            New-Item -Path $OutputPath -ItemType Directory -Force | Out-Null
        }
    }
    
    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
    
    Write-Host "`n=== SentinelOne Critical Applications Report ===" -ForegroundColor Cyan
    Write-Host "Starting report generation at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray
}

process {
    try {
        $siteIds = $null
        
        if ($ClientName) {
            Write-Host "`nLooking up sites for client name(s): $($ClientName -join ', ')..." -ForegroundColor Yellow
            
            try {
                $sitesUrl = "$BaseUrl/web/api/v2.1/sites?limit=1000"
                $allSites = @()
                $cursor = $null
                
                do {
                    $fetchUrl = if ($cursor) { "$sitesUrl&cursor=$cursor" } else { $sitesUrl }
                    $sitesResponse = Invoke-RestMethod -Uri $fetchUrl -Headers $headers -Method Get
                    
                    if ($sitesResponse.data.sites) {
                        $allSites += $sitesResponse.data.sites
                    }
                    
                    $cursor = $sitesResponse.pagination.nextCursor
                } while ($cursor)
                
                Write-Host "Fetched $($allSites.Count) total sites" -ForegroundColor Gray
                
                $matchedSites = @()
                
                foreach ($pattern in $ClientName) {
                    $sitesForPattern = $allSites | Where-Object {
                        $siteName = $_.name
                        
                        $companyName = if ($siteName -match '^(.+?)\s*\(') {
                            $matches[1].Trim()
                        } else {
                            $siteName
                        }
                        
                        $siteName -like "*$pattern*" -or $companyName -like "*$pattern*"
                    }
                    
                    if ($sitesForPattern) {
                        Write-Host "`nFound $($sitesForPattern.Count) site(s) matching '$pattern':" -ForegroundColor Green
                        $sitesForPattern | ForEach-Object {
                            Write-Host "  - $($_.name) (ID: $($_.id))" -ForegroundColor Gray
                        }
                        $matchedSites += $sitesForPattern
                    } else {
                        Write-Host "`nNo sites found matching '$pattern'" -ForegroundColor Yellow
                    }
                }
                
                if ($matchedSites.Count -eq 0) {
                    Write-Host "`nERROR: No sites found matching any of the provided client names." -ForegroundColor Red
                    Write-Host "Available sites (first 20):" -ForegroundColor Yellow
                    $allSites | Select-Object -First 20 | ForEach-Object {
                        Write-Host "  - $($_.name)" -ForegroundColor Gray
                    }
                    throw "No matching sites found"
                }
                
                $siteIds = ($matchedSites | Select-Object -Unique -ExpandProperty id)
                Write-Host "`nUsing $($siteIds.Count) site ID(s) for the query" -ForegroundColor Cyan
                
            } catch {
                Write-Host "`nError during site lookup: $_" -ForegroundColor Red
                throw
            }
        }
        
        $allApplications = @()
        $criticalApplications = @()
        
        $queryParams = @{
            'limit' = '1000'
            'highestSeverities' = 'CRITICAL'
            'skipCount' = 'false'
        }
        
        if ($siteIds) { 
            $queryParams['siteIds'] = $siteIds -join ',' 
            Write-Verbose "Filtering by site IDs: $($siteIds -join ', ')"
        }
        
        $uri = "$BaseUrl/web/api/v2.1/application-management/risks/applications"
        
        Write-Host "`nQuerying SentinelOne Application Management API..." -ForegroundColor Yellow
        
        $cursor = $null
        $pageCount = 0
        
        do {
            $pageCount++
            
            if ($cursor) {
                $queryParams['cursor'] = $cursor
            }
            
            $queryString = ($queryParams.GetEnumerator() | ForEach-Object { 
                "$($_.Key)=$([System.Uri]::EscapeDataString($_.Value))" 
            }) -join '&'
            
            $fullUri = "$uri`?$queryString"
            
            Write-Verbose "Fetching page $pageCount..."
            
            $response = Invoke-RestMethod -Uri $fullUri -Headers $headers -Method Get
            
            if ($response.data -and $response.data.Count -gt 0) {
                $allApplications += $response.data
                Write-Host "  Retrieved $($response.data.Count) applications (Page $pageCount)" -ForegroundColor Gray
            }
            
            $cursor = $response.pagination.nextCursor
            
        } while ($cursor)
        
        Write-Host "Total applications retrieved: $($allApplications.Count)" -ForegroundColor Green
        
        $criticalApplications = if ($IncludeAllApplications) {
            $allApplications
        } else {
            $allApplications | Where-Object { $_.highestSeverity -eq 'Critical' }
        }
        
        $totalCritical = $criticalApplications.Count
        $exploitedInWild = ($criticalApplications | Where-Object { $_.exploitedInTheWild -eq 'Yes' }).Count
        $highExploitCodeMaturity = ($criticalApplications | Where-Object { 
            $_.exploitCodeMaturity -eq 'High' -or $_.exploitCodeMaturity -eq 'Functional' 
        }).Count
        
        $exploitedInWildPct = if ($totalCritical -gt 0) { 
            [math]::Round(($exploitedInWild / $totalCritical) * 100, 2) 
        } else { 0 }
        
        $highExploitPct = if ($totalCritical -gt 0) { 
            [math]::Round(($highExploitCodeMaturity / $totalCritical) * 100, 2) 
        } else { 0 }
        
        Write-Host "`n=== Summary Statistics ===" -ForegroundColor Cyan
        Write-Host "Total Critical Applications: $totalCritical" -ForegroundColor White
        Write-Host "Exploited in the Wild: $exploitedInWild ($exploitedInWildPct%)" -ForegroundColor $(if ($exploitedInWild -gt 0) { "Red" } else { "Green" })
        Write-Host "High Exploit Code Maturity: $highExploitCodeMaturity ($highExploitPct%)" -ForegroundColor $(if ($highExploitCodeMaturity -gt 0) { "Yellow" } else { "Green" })
        
        $reportData = $criticalApplications | Select-Object @{
            Name = 'Application'; Expression = { $_.name }
        }, @{
            Name = 'Vendor'; Expression = { $_.vendor }
        }, @{
            Name = 'Severity'; Expression = { $_.highestSeverity }
        }, @{
            Name = 'NVD Base Score'; Expression = { $_.highestNvdBaseScore }
        }, @{
            Name = 'Risk Score'; Expression = { $_.highestRiskScore }
        }, @{
            Name = 'CVE Count'; Expression = { $_.cveCount }
        }, @{
            Name = 'Endpoint Count'; Expression = { $_.endpointCount }
        }, @{
            Name = 'Exploited in Wild'; Expression = { $_.exploitedInTheWild }
        }, @{
            Name = 'Exploit Code Maturity'; Expression = { $_.exploitCodeMaturity }
        }, @{
            Name = 'Remediation Level'; Expression = { $_.remediationLevel }
        }, @{
            Name = 'Detection Date'; Expression = { $_.detectionDate }
        }, @{
            Name = 'Days Detected'; Expression = { $_.daysDetected }
        }, @{
            Name = 'Application ID'; Expression = { $_.applicationId }
        }
        
        $summaryStats = [PSCustomObject]@{
            'Report Date' = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
            'Total Critical Applications' = $totalCritical
            'Exploited in Wild' = $exploitedInWild
            'Exploited in Wild %' = "$exploitedInWildPct%"
            'High Exploit Code Maturity' = $highExploitCodeMaturity
            'High Exploit Code Maturity %' = "$highExploitPct%"
        }
        
        if ($ExportFormat -eq "Console" -or $ExportFormat -eq "All") {
            Write-Host "`n=== Top 10 Critical Applications ===" -ForegroundColor Cyan
            $reportData | Select-Object -First 10 | Format-Table -AutoSize
        }
        
        if ($ExportFormat -eq "CSV" -or $ExportFormat -eq "All") {
            $csvPath = Join-Path -Path $OutputPath -ChildPath "S1CriticalAppReport.csv"
            $reportData | Export-Csv -Path $csvPath -NoTypeInformation -Encoding UTF8
            Write-Host "`nCSV exported to: $csvPath" -ForegroundColor Green
            
            $summaryPath = Join-Path -Path $OutputPath -ChildPath "S1CriticalAppReport.csv"
            $summaryStats | Export-Csv -Path $summaryPath -NoTypeInformation -Encoding UTF8
            Write-Host "Summary CSV exported to: $summaryPath" -ForegroundColor Green
        }
        
        if ($ExportFormat -eq "JSON" -or $ExportFormat -eq "All") {
            $jsonPath = Join-Path -Path $OutputPath -ChildPath "S1CriticalAppReport.json"
            
            $jsonOutput = @{
                Summary = $summaryStats
                Applications = $reportData
            }
            
            $jsonOutput | ConvertTo-Json -Depth 10 | Out-File -FilePath $jsonPath -Encoding UTF8
            Write-Host "JSON exported to: $jsonPath" -ForegroundColor Green
        }
        
        if ($ExportFormat -eq "HTML" -or $ExportFormat -eq "All") {
            $htmlPath = Join-Path -Path $OutputPath -ChildPath "S1CriticalAppReport.html"
            
            $html = @"
<!DOCTYPE html>
<html>
<head>
    <title>SentinelOne Critical Applications Report</title>
    <style>
        body { 
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; 
            margin: 20px; 
            background-color: #f5f5f5;
        }
        .header { 
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white; 
            padding: 30px; 
            border-radius: 10px;
            margin-bottom: 30px;
            box-shadow: 0 4px 6px rgba(0,0,0,0.1);
        }
        .header h1 { margin: 0 0 10px 0; font-size: 2.2em; }
        .header p { margin: 5px 0; opacity: 0.9; }
        .summary-cards {
            display: grid;
            grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
            gap: 20px;
            margin-bottom: 30px;
        }
        .card {
            background: white;
            padding: 20px;
            border-radius: 8px;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
            border-left: 4px solid #667eea;
        }
        .card-title {
            font-size: 0.9em;
            color: #666;
            margin-bottom: 10px;
            text-transform: uppercase;
            letter-spacing: 0.5px;
        }
        .card-value {
            font-size: 2em;
            font-weight: bold;
            color: #333;
        }
        .card-subtitle {
            font-size: 0.9em;
            color: #999;
            margin-top: 5px;
        }
        .card.danger { border-left-color: #e74c3c; }
        .card.danger .card-value { color: #e74c3c; }
        .card.warning { border-left-color: #f39c12; }
        .card.warning .card-value { color: #f39c12; }
        table { 
            width: 100%; 
            border-collapse: collapse; 
            margin-top: 20px;
            background: white;
            border-radius: 8px;
            overflow: hidden;
            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
        }
        th { 
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white; 
            padding: 15px; 
            text-align: left;
            font-weight: 600;
            text-transform: uppercase;
            font-size: 0.85em;
            letter-spacing: 0.5px;
        }
        td { 
            padding: 12px 15px; 
            border-bottom: 1px solid #f0f0f0;
        }
        tr:hover { background-color: #f8f9fa; }
        tr:last-child td { border-bottom: none; }
        .severity-critical { 
            background-color: #e74c3c; 
            color: white; 
            padding: 4px 8px; 
            border-radius: 4px;
            font-weight: bold;
            font-size: 0.85em;
            display: inline-block;
        }
        .exploited-yes { 
            color: #e74c3c; 
            font-weight: bold;
        }
        .exploit-high, .exploit-functional { 
            color: #f39c12; 
            font-weight: bold;
        }
        .footer {
            margin-top: 30px;
            padding: 20px;
            text-align: center;
            color: #666;
            font-size: 0.9em;
            background: white;
            border-radius: 8px;
        }
    </style>
</head>
<body>
    <div class="header">
        <h1>SentinelOne Critical Applications Report</h1>
        <p>Generated: $(Get-Date -Format 'MMMM dd, yyyy - HH:mm:ss')</p>
        <p>Report includes applications with Critical severity vulnerabilities</p>
    </div>
    
    <div class="summary-cards">
        <div class="card">
            <div class="card-title">Total Critical Applications</div>
            <div class="card-value">$totalCritical</div>
            <div class="card-subtitle">Applications requiring attention</div>
        </div>
        <div class="card danger">
            <div class="card-title">Exploited in the Wild</div>
            <div class="card-value">$exploitedInWild</div>
            <div class="card-subtitle">$exploitedInWildPct% of critical applications</div>
        </div>
        <div class="card warning">
            <div class="card-title">High Exploit Code Maturity</div>
            <div class="card-value">$highExploitCodeMaturity</div>
            <div class="card-subtitle">$highExploitPct% of critical applications</div>
        </div>
    </div>
    
    <table>
        <thead>
            <tr>
                <th>Application</th>
                <th>Vendor</th>
                <th>Severity</th>
                <th>CVEs</th>
                <th>Endpoints</th>
                <th>Exploited in Wild</th>
                <th>Exploit Maturity</th>
                <th>Detection Date</th>
            </tr>
        </thead>
        <tbody>
"@
            foreach ($app in $reportData) {
                $exploitedClass = if ($app.'Exploited in Wild' -eq 'Yes') { ' class="exploited-yes"' } else { '' }
                $maturityClass = if ($app.'Exploit Code Maturity' -eq 'High' -or $app.'Exploit Code Maturity' -eq 'Functional') { 
                    ' class="exploit-high"' 
                } else { '' }
                
                $detectionDate = if ($app.'Detection Date') {
                    ([DateTime]$app.'Detection Date').ToString('yyyy-MM-dd')
                } else {
                    'N/A'
                }
                
                $html += @"
            <tr>
                <td>$($app.Application)</td>
                <td>$($app.Vendor)</td>
                <td><span class="severity-critical">$($app.Severity)</span></td>
                <td>$($app.'CVE Count')</td>
                <td>$($app.'Endpoint Count')</td>
                <td$exploitedClass>$($app.'Exploited in Wild')</td>
                <td$maturityClass>$($app.'Exploit Code Maturity')</td>
                <td>$detectionDate</td>
            </tr>
"@
            }
            
            $html += @"
        </tbody>
    </table>
    
    <div class="footer">
        <p>SentinelOne Critical Applications Report</p>
        <p>This report identifies applications with critical vulnerabilities and their exploitation status.</p>
    </div>
</body>
</html>
"@
            
            $html | Out-File -FilePath $htmlPath -Encoding UTF8
            Write-Host "HTML report exported to: $htmlPath" -ForegroundColor Green
        }
        
        Write-Host "`n=== Report Generation Complete ===" -ForegroundColor Cyan
        Write-Host "Completed at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`n" -ForegroundColor Gray
        
        return [PSCustomObject]@{
            TotalCriticalApplications = $totalCritical
            ExploitedInWild = $exploitedInWild
            ExploitedInWildPercentage = $exploitedInWildPct
            HighExploitCodeMaturity = $highExploitCodeMaturity
            HighExploitCodeMaturityPercentage = $highExploitPct
            Applications = $reportData
            Summary = $summaryStats
        }
        
    } catch {
        Write-Host "`nError: $_" -ForegroundColor Red
        Write-Host "Stack Trace: $($_.ScriptStackTrace)" -ForegroundColor Red
        throw
    }
}