@@ -13,30 +13,47 @@ function Get-CippAuditLogSearches {
1313 [Parameter ()]
1414 [switch ]$ReadyToProcess
1515 )
16- $AuditLogSearchesTable = Get-CippTable - TableName ' AuditLogSearches'
17- if ($ReadyToProcess.IsPresent ) {
18- $15MinutesAgo = (Get-Date ).AddMinutes(-15 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
19- $1DayAgo = (Get-Date ).AddDays(-1 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
20- $PendingQueries = Get-CIPPAzDataTableEntity @AuditLogSearchesTable - Filter " PartitionKey eq 'Search' and Tenant eq '$TenantFilter ' and (CippStatus eq 'Pending' or (CippStatus eq 'Processing' and Timestamp le datetime'$15MinutesAgo ')) and Timestamp ge datetime'$1DayAgo '" | Sort-Object Timestamp
21- } else {
22- $7DaysAgo = (Get-Date ).AddDays(-7 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
23- $PendingQueries = Get-CIPPAzDataTableEntity @AuditLogSearchesTable - Filter " Tenant eq '$TenantFilter ' and Timestamp ge datetime'$7DaysAgo '"
16+
17+ Measure-CippTask - TaskName ' GetAuditLogSearches' - EventName ' CIPP.AuditLogsProfile' - Script {
18+ $AuditLogSearchesTable = Get-CippTable - TableName ' AuditLogSearches'
19+
20+ if ($ReadyToProcess.IsPresent ) {
21+ Measure-CippTask - TaskName ' QueryReadyToProcess' - EventName ' CIPP.AuditLogsProfile' - Script {
22+ $15MinutesAgo = (Get-Date ).AddMinutes(-15 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
23+ $1DayAgo = (Get-Date ).AddDays(-1 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
24+ Get-CIPPAzDataTableEntity @AuditLogSearchesTable - Filter " PartitionKey eq 'Search' and Tenant eq '$TenantFilter ' and (CippStatus eq 'Pending' or (CippStatus eq 'Processing' and Timestamp le datetime'$15MinutesAgo ')) and Timestamp ge datetime'$1DayAgo '" | Sort-Object Timestamp
25+ }
26+ } else {
27+ Measure-CippTask - TaskName ' QueryAllSearches' - EventName ' CIPP.AuditLogsProfile' - Script {
28+ $7DaysAgo = (Get-Date ).AddDays(-7 ).ToUniversalTime().ToString(' yyyy-MM-ddTHH:mm:ssZ' )
29+ Get-CIPPAzDataTableEntity @AuditLogSearchesTable - Filter " Tenant eq '$TenantFilter ' and Timestamp ge datetime'$7DaysAgo '"
30+ }
31+ }
2432 }
2533
26- $BulkRequests = foreach ($PendingQuery in $PendingQueries ) {
27- @ {
28- id = $PendingQuery.RowKey
29- url = ' security/auditLog/queries/' + $PendingQuery.RowKey
30- method = ' GET'
34+ Measure-CippTask - TaskName ' BuildBulkRequests' - EventName ' CIPP.AuditLogsProfile' - Script {
35+ $BulkRequests = foreach ($PendingQuery in $PendingQueries ) {
36+ @ {
37+ id = $PendingQuery.RowKey
38+ url = ' security/auditLog/queries/' + $PendingQuery.RowKey
39+ method = ' GET'
40+ }
3141 }
42+ $BulkRequests
3243 }
44+
3345 if ($BulkRequests.Count -eq 0 ) {
3446 return @ ()
3547 }
36- $Queries = New-GraphBulkRequest - Requests @ ($BulkRequests ) - AsApp $true - TenantId $TenantFilter | Select-Object - ExpandProperty body
48+
49+ $Queries = Measure-CippTask - TaskName ' ExecuteBulkGraphRequests' - EventName ' CIPP.AuditLogsProfile' - Script {
50+ New-GraphBulkRequest - Requests @ ($BulkRequests ) - AsApp $true - TenantId $TenantFilter | Select-Object - ExpandProperty body
51+ }
3752
3853 if ($ReadyToProcess.IsPresent ) {
39- $Queries = $Queries | Where-Object { $PendingQueries.RowKey -contains $_.id -and $_.status -eq ' succeeded' }
54+ $Queries = Measure-CippTask - TaskName ' FilterSucceededQueries' - EventName ' CIPP.AuditLogsProfile' - Script {
55+ $Queries | Where-Object { $PendingQueries.RowKey -contains $_.id -and $_.status -eq ' succeeded' }
56+ }
4057 }
4158
4259 return $Queries
0 commit comments