VirtualMetricExamples.ps1

$apiuser = "APIUSER"
$key = "APIKEY"
$server = "http://SERVERFQDN:8080"

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/x-www-form-urlencoded")

$body = "username=$apiuser&password=$key&grant_type=password"

$response = Invoke-RestMethod $server/token -Method 'POST' -Headers $headers -Body $body
$token = $response.access_token | Out-String

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", "Bearer $token")

#Defender Check and Fix
$defenderstatus = Invoke-RestMethod -Headers $headers -uri "$server/API/Query/Read?columns=[title=%3Cl%3Ehostname%3C/l%3E]inventory:host:name,inventory:hostwindowsdefender:amengineversion,inventory:hostwindowsdefender:amproductversion,inventory:hostwindowsdefender:amserviceversion,inventory:hostwindowsdefender:antispywareenabled,inventory:hostwindowsdefender:antivirusenabled,inventory:hostwindowsdefender:realtimeprotectionenabled,inventory:host:pendingreboot&groupBy=object&output=datatable&link=yes&singleRecord=yes&title=Windows%20Defender&icon=fa%20fa-exclamation-circle&export=json&liveMode=1&tablemode=1&liveupdate=1"
$defenderoff = $defenderstatus  | where-object {$_.hostwindowsdefenderrealtimeprotectionenabled -eq "False"}
if($defenderoff){
    foreach($machine in $defenderoff){
        $MachineName = $Machine.hostname
        write-host "The Windows Defender is turned off on $MachineName"
        write-host "Turning on Windows Defender on host $MachineName"
        Invoke-Command -ComputerName $MachineName -ScriptBlock {Set-MpPreference -DisableRealtimeMonitoring $false}
    }
}

#Disk Check and Cleanup
$diskTreshHold = "75%"
$disks = Invoke-RestMethod -Headers $Headers -uri "$server/API/Query/Read?columns=inventory:hostdisk:volumename,inventory:hostdisk:label,[title=%3Cl%3Ehostname%3C/l%3E]inventory:host:name,counter:hoststorage:436,counter:hoststorage:175,counter:hoststorage:173,counter:hoststorage:176&groupBy=object&output=datatable&link=yes&singleRecord=yes&title=Storage%20Capacity&icon=fa%20fa-hdd&export=json&liveMode=1&tablemode=0&liveupdate=1"
$fulldisks = $disks | where-object {$_.hoststorage436 -gt $diskTreshHold}

if($fulldisks){
    foreach($machine in $fulldisks){
        $MachineName = $Machine.hostname
        write-host "Disk is full on $MachineName"
        write-host "Cleaning disk on $MachineName"
        Invoke-Command -ComputerName $MachineName -ScriptBlock {Get-ChildItem -Path "C:\Temp" | remove-item -Recurse -Force -Confirm:$false}
    }
}