Help with Processing Raw Data from Intune Proactive Remediation Using PowerShell

Swahela Mulla 95 Reputation points
2024-02-13T15:11:44.7866667+00:00

Hi Everyone, I'm currently working with raw data obtained from Intune proactive remediation, and I'm seeking assistance in processing it dynamically without hardcoding specific properties. The raw data I'm working with looks like this:

ServiceName: CcmExec, Status: Not Installed, ServiceName: IntuneManagementExtension, DisplayName: Microsoft Intune Management Extension, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess, ServiceName: Nexthink Service, DisplayName: Nexthink Collector Service, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess, ServiceName: Nanoheal Client, Status: Not Installed

It represents service entries with various properties such as ServiceName, DisplayName, Status, CanPauseAndContinue, CanShutdown, CanStop, and ServiceType. My goal is to process this data dynamically, considering that not all entries may have all properties, and some properties may be blank. Could someone please guide me on how to effectively parse and process this data in a dynamic manner without relying on hardcoded values for properties because everytime we need to deal with different data so don’t hardcode it?
I wanted to achieve this with PowerShell

Please refer attached image to understand my output requirement.
image (1)

Any assistance or pointers to relevant documentation would be greatly appreciated.   Thank you! Swahela Mulla

Windows for business Windows Server User experience PowerShell
Microsoft Security Intune Other
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Rich Matheisen 47,901 Reputation points
    2024-02-13T16:56:24.09+00:00

    The data you provided is an unorganized string. It's no YAML, or JSON. It's just a comma separated series of Name/Value pairs. If the data are separated into individual components (assuming "ServiceName" to be the beginning of each set), you could try this:

    $data = "ServiceName: CcmExec, Status: Not Installed", 
            "ServiceName: IntuneManagementExtension, DisplayName: Microsoft Intune Management Extension, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess", 
            "ServiceName: Nexthink Service, DisplayName: Nexthink Collector Service, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess",
            "ServiceName: Nanoheal Client, Status: Not Installed",
            "ServiceName: CcmExec, Status: Not Installed",
            "ServiceName: IntuneManagementExtension, DisplayName: Microsoft Intune Management Extension, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess",
            "ServiceName: Nexthink Service, DisplayName: Nexthink Collector Service, Status: Running, CanPauseAndContinue: False, CanShutdown: True, CanStop: True, ServiceType: Win32OwnProcess",
            "ServiceName: Nanoheal Client, Status: Not Installed"
    
    # get all possible property names from the data
    $template = @{}
    $data -split "," |
        ForEach-Object {
            [array]$NameValue = $_ -split ":"
            $template[$NameValue[0].Trim()] = ""
        }
    
    $data |
        ForEach-Object {
            $props = $template.Clone()          # get a set of property names without values
            $_ -split "," |
                ForEach-Object{
                    [array]$NameValue = $_ -split ":"
                    $props.($NameValue[0].Trim()) = $NameValue[1].Trim()
                }
            [PSCustomObject]$props
        }
    
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.