Seasons Greetings Friends,

I would like to share a project with you that I have been leveraging for the better part of 2020 that I have now named the PowerShell Deployment Automation Toolkit (PSDAT for short). The PSDAT provides a way to deliver automated deployments through the Tanium Endpoint Management platform with a greater degree of granularity and automation potential than what is natively available within the platform itself.

A much rougher draft of the solution was initially developed in January of 2020 but the idea itself has been percolating since 2016 as I have long wished to fully automate the lifecycle of our application management wherever possible. In 2018, I challenged myself to develop a proof-of-concept for end-to-end automation of our Java JRE/JDK application with the logic being that the idea could be fully realized with anything if it could address the laborious nature of everyone’s favorite Oracle product. Having successfully managed that, I expanded upon the concept and fully automated the weekly reboot mechanism that I developed with the help of the PowerShell Application Deployment Toolkit.

As one might expect, the current release of the PSDAT is very much a work in progress with tons of functionality and error handling to come. I am definitely adhering to the “If you’re not embarrassed by the first version of your product, you’ve launched too late” mindset even though this is a project rather than a product. With that being said, I feel like it is time to begin sharing the tool as there is a great deal of functionality already and I have been using it successfully for most of the year.

Check out the project on GitHub and take a look at the readme.md contents below:

PowerShell Deployment Automation Toolkit

• Author: Brent Henderson
• Release Date: 12/28/2020
• Version: 0.0.1

Introduction

Toolkit Overview

The PowerShell Deployment Automation Toolkit provides a way to deliver automated deployments through the Tanium Endpoint Management platform.

Features

This script manages the import and deployment of Software Gallery packages for the Tanium Endpoint Management platform. The tool currently provides the following functionality:

• Automated API session creation mechanism with manual fallback
• Catalog-driven for ease of customization
• Support for multiple environments with minimal administrative overhead
• Automated Tanium Package Gallery package imports
• Automated deployment creation to deployment rings designated in catalog items
• Patch Tuesday offset configuration for deployments
• CMTrace/OneTrace-compatible logging

Dependencies

The TanREST PowerShell module is required and cannot currently be distributed by anyone other than Tanium. Please contact your Technical Account Manager to acquire and install the latest version of TanREST.

License

PowerShell Deployment Automation Framework – Provides a way to deliver automated deployments through the Tanium Endpoint Management platform.

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with this program. If not, see http://www.gnu.org/licenses/.

Usage

powershell.exe -File '\\pathToFile\DeploymentAutomationToolkit.ps1'

powershell.exe -File '\\pathToFile\DeploymentAutomationToolkit.ps1' -Environment < Alt | DEV | QA | PROD >

powershell.exe -File 'c:\pathToFile\DeploymentAutomationToolkit.ps1' -Environment 'Alt' -QuickTest $true -StartToday $true

Quick Start

1. Configure reference file(s) for environment(s) under scriptRoot\core\config
2. Encrypted credentials may be stored in scriptRoot\core\config as taniumENVCred.txt (Not recommended for Production, Example 1 below)
3. Configure json catalog files under scriptRoot\core\catalog\repo
4. Promote configured json catalog items to scriptRoot\core\catalog
5. Call script with desired environmental target

Example 1: The ConvertFrom-SecureString cmdlet converts a secure string into an encrypted standard string.

(Get-Credential).password | ConvertFrom-SecureString | Out-File "$scriptDirectory\core\config\tanium__ENV__Cred.txt"

Script Parameters

JSON Catalog Keys | Tanium Package Deployments

Reference

Directory Overview

root/
├─ core/
│  ├─ catalog/
│  │  ├─ repo/
│  │  │  ├─ googlellc-chrome-x64.json 
│  │  │  ├─ igorpavlov-7-zip-x64.json
│  ├─ config/
│  │  │  ├─ alt-reference.json
│  │  │  ├─ dev-reference.json
│  │  │  ├─ prod-reference.json
│  │  │  ├─ qa-reference.json
│  ├─ functions/
│  │  ├─ Get-PatchTuesday.ps1
│  │  ├─ New-CredentialObject.ps1
│  │  ├─ New-Session.ps1
│  │  ├─ Send-HTMLEmail.ps1
│  │  ├─ Set-JSONProperty.ps1
│  │  ├─ Write-Log.ps1
├─ jobqueue/
│  ├─ decommissioned/
│  ├─ hold/
├─ logs/
├─ .gitignore
├─ readme.md

Directory Structure

File Structure

Upcoming Functionality

• Catalog-driven Tanium Patch deployments
• Sub-function for building more dynamic deployments with an understanding of parameter set grouping
• Transition to direct API calls to reduce dependencies and error opportunities.

Disclaimer: Any code made available on this site is free to use at your own discretion but it is provided without any explicit or implied guarantees of support, reliability, or functionality. I accept no responsibility in the event that the code, in its original form or any derivative versions thereafter, malfunctions or causes problems . Anything from this site that you decide to work with should be tested thoroughly in development environments in collaboration with your Technical Account Manager (TAM) until such time that you, the responsible party, decides that you are satisfied with its outcomes.