Skip to content

Commit

Permalink
Update Write-HawkBanner to include switch to display welcome message …
Browse files Browse the repository at this point in the history
…or not. Update Initalize-HawkGlobalObject to only show welcome message during interactive mode..
  • Loading branch information
jonnybottles committed Jan 14, 2025
1 parent 76db272 commit 2b4daaf
Show file tree
Hide file tree
Showing 2 changed files with 81 additions and 37 deletions.
73 changes: 47 additions & 26 deletions Hawk/internal/functions/Initialize-HawkGlobalObject.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -199,7 +199,13 @@

if (($null -eq (Get-Variable -Name Hawk -ErrorAction SilentlyContinue)) -or ($Force -eq $true) -or ($null -eq $Hawk)) {

Write-HawkBanner
if ($NonInteractive) {
Write-HawkBanner
} else {
Write-HawkBanner -DisplayWelcomeMessage
}



# Create the global $Hawk variable immediately with minimal properties
$Global:Hawk = [PSCustomObject]@{
Expand Down Expand Up @@ -272,31 +278,34 @@
Out-LogFile " OR enter a date in MM/DD/YYYY format" -isPrompt
Out-LogFile " Default is 90 days back: " -isPrompt -NoNewLine
$StartRead = (Read-Host).Trim()

# Determine if input is a valid date
if ($null -eq ($StartRead -as [DateTime])) {

#### Not a DateTime ####
# First convert StartRead to integer for comparison
#### Not a DateTime => interpret as # of days ####
if ([string]::IsNullOrEmpty($StartRead)) {
[int]$StartRead = 90
}
else {
[int]$StartRead = $StartRead
# Validates the input is an integer
elseif ($StartRead -match '^\d+$') {
# Only convert to int if it is a valid positive number
[int]$StartRead = [int]$StartRead
}

# Validate input is a positive number
if ($StartRead -match '^\-') {
Out-LogFile -string "Please enter a positive number of days." -isError
else {
Out-LogFile -string "Invalid input. Please enter a number between 1 and 365, or a date in MM/DD/YYYY format." -isError
continue
}

# Validate numeric value
if ($StartRead -notmatch '^\d+$') {
Out-LogFile -string "Please enter a valid number of days." -isError

# We store this integer in $StartDays so we can potentially re-anchor from EndDate later
$StartDays = $StartRead

# Validate the input is within range
if (($StartRead -gt 365) -or ($StartRead -lt 1)) {
Out-LogFile -string "Days to go back must be between 1 and 365." -isError
continue
}


# Validate the entered days back
if ([int]$StartRead -gt [int]$MaxDaysToGoBack) {
Out-LogFile -string "You have entered a time frame greater than your license allows ($MaxDaysToGoBack days)." -isWarning
Expand All @@ -305,22 +314,16 @@
if ($Proceed -eq 'R') { continue }
}

if ([int]$StartRead -gt 365) {
Out-LogFile -string "Log retention cannot exceed 365 days. Setting retention to 365 days." -isWarning
[int]$StartRead = 365
}


# Calculate start date

# At this point, we do not yet have EndDate set. So temporarily anchor from "today":
[DateTime]$StartDate = ((Get-Date).ToUniversalTime().AddDays(-$StartRead)).Date

Write-Output ""
Out-LogFile -string "Start date set to: $StartDate [UTC]" -Information

Out-LogFile -string "Start date set to: $StartDate" -Information
}
# Handle DateTime input
elseif (!($null -eq ($StartRead -as [DateTime]))) {
[DateTime]$StartDate = (Get-Date $StartRead).ToUniversalTime().Date

# ========== The user entered a DateTime, so $StartDays stays 0 ==========
# Validate the date
if ($StartDate -gt (Get-Date).ToUniversalTime()) {
Out-LogFile -string "Start date cannot be in the future." -isError
Expand Down Expand Up @@ -452,6 +455,24 @@
}
}

# --- AFTER the EndDate block, do a final check to "re-anchor" StartDate if it was given in days ---
if ($StartDays -gt 0) {
# Recalculate StartDate anchored to the final EndDate
Out-LogFile -string "Recalculating StartDate based on EndDate = $EndDate and StartDays = $StartDays" -Information

$StartDate = $EndDate.ToUniversalTime().AddDays(-$StartDays).Date

# (Optional) Additional validations again if necessary:
if ($StartDate -gt (Get-Date).ToUniversalTime()) {
Out-LogFile -string "Start date is in the future. Resetting to today's date." -isWarning
$StartDate = (Get-Date).ToUniversalTime().Date
}


Out-LogFile -string "Final StartDate (UTC) after re-anchoring: $StartDate" -Information
}


# Configuration Example, currently not used
#TODO: Implement Configuration system across entire project
Set-PSFConfig -Module 'Hawk' -Name 'DaysToLookBack' -Value $Days -PassThru | Register-PSFConfig
Expand Down
45 changes: 34 additions & 11 deletions Hawk/internal/functions/Write-HawkBanner.ps1
Original file line number Diff line number Diff line change
@@ -1,16 +1,38 @@
Function Write-HawkBanner {
<#
.SYNOPSIS
Displays the Hawk welcome banner.
Displays the Hawk welcome banner in the terminal.
.DESCRIPTION
Displays an ASCII art banner when starting Hawk operations.
The banner is sized to fit most terminal windows.
The `Write-HawkBanner` function displays a visually appealing ASCII art banner
when starting Hawk operations. The banner includes the Hawk logo and additional
information about the tool. Optionally, the function can display a welcome
message to guide users through the initial setup process.
.PARAMETER DisplayWelcomeMessage
This optional switch parameter displays a series of informational messages
to help the user configure their investigation environment.
.INPUTS
None. The function does not take pipeline input.
.OUTPUTS
[String]
The function outputs the Hawk banner as a string to the terminal.
.EXAMPLE
Write-HawkBanner
Displays the Hawk welcome banner
Displays the Hawk welcome banner without the welcome message.
.EXAMPLE
Write-HawkBanner -DisplayWelcomeMessage
Displays the Hawk welcome banner followed by a welcome message that guides
the user through configuring the investigation environment.
#>
[CmdletBinding()]
param()
param(
[Switch]$DisplayWelcomeMessage
)

$banner = @'
========================================
Expand All @@ -31,11 +53,12 @@ https://cloudforensicator.com

Write-Output $banner

Write-Information "Welcome to Hawk! Let's get your investigation environment set up."
Write-Information "We'll guide you through configuring the output file path and investigation date range."
Write-Information "You'll need to specify where logs should be saved and the time window for data retrieval."
Write-Information "If you're unsure, don't worry! Default options will be provided to help you out."
Write-Information "`nLet's get started!`n"

if ($DisplayWelcomeMessage) {
Write-Information "Welcome to Hawk! Let's get your investigation environment set up."
Write-Information "We'll guide you through configuring the output file path and investigation date range."
Write-Information "You'll need to specify where logs should be saved and the time window for data retrieval."
Write-Information "If you're unsure, don't worry! Default options will be provided to help you out."
Write-Information "`nLet's get started!`n"
}

}

0 comments on commit 2b4daaf

Please sign in to comment.