0

I have worked out how to retrieve data from our API using the following:

Invoke-RestMethod -Uri "https://mcafee-epo.domain.local:8448/remote/system.find?searchText=$(94422)&searchNameOnly=true&:output=json" -Credential $Cred

I can see that I get data back immediately in Powershell and if I Out-File this I get a result similar to this (shows up all as one line in VS CODE):

OK:
[ { "EPOComputerProperties.ParentID" : 13988, "EPOComputerProperties.ComputerName" : "94422", "EPOComputerProperties.Description" : null, "EPOComputerProperties.ComputerDescription" : "N\u002fA", "EPOComputerProperties.TimeZone" : "AUS Eastern Standard Time", "EPOComputerProperties.DefaultLangID" : "0c09", "EPOComputerProperties.UserName" : "jamesk", "EPOComputerProperties.DomainName" : "DOMAIN.local", "EPOComputerProperties.IPHostName" : "94422.DOMAIN.local", "EPOComputerProperties.IPV6" : "0:0:0:0:0:FFFF:A3F:C40", "EPOComputerProperties.IPAddress" : "10.42.1.80", "EPOComputerProperties.IPSubnet" : "0:0:0:0:0:FFFF:A4D:900", "EPOComputerProperties.IPSubnetMask" : "0:0:0:0:0:FFFF:FFFF:F800", "EPOComputerProperties.IPV4x" : -1975710640, "EPOComputerProperties.IPXAddress" : "N\u002fA", "EPOComputerProperties.SubnetAddress" : "10.42.3.44", "EPOComputerProperties.SubnetMask" : "255.255.248.0", "EPOComputerProperties.NetAddress" : "00057A00", "EPOComputerProperties.OSType" : "Windows 10", "EPOComputerProperties.OSVersion" : "10.0", "EPOComputerProperties.OSCsdVersion" : "", "EPOComputerProperties.OSBuildNum" : 19045, "EPOComputerProperties.OSPlatform" : "Workstation", "EPOComputerProperties.OSOEMID" : "00329-00000-00003-A4459", "EPOComputerProperties.CPUType" : "AMD Ryzen 5 PRO 5650U with Radeon Graphics     ", "EPOComputerProperties.CPUSpeed" : 2296, "EPOComputerProperties.NumOfCPU" : 12, "EPOComputerProperties.CPUSerialNumber" : "N\u002fA", "EPOComputerProperties.TotalPhysicalMemory" : 16442781696, "EPOComputerProperties.FreeMemory" : 5206036480, "EPOComputerProperties.FreeDiskSpace" : 221685, "EPOComputerProperties.TotalDiskSpace" : 482875, "EPOComputerProperties.IsPortable" : 1, "EPOComputerProperties.Vdi" : 0, "EPOComputerProperties.OSBitMode" : 1, "EPOComputerProperties.LastAgentHandler" : 1, "EPOComputerProperties.UserProperty1" : "James Kiss", "EPOComputerProperties.UserProperty2" : "Test", "EPOComputerProperties.UserProperty3" : "Melbourne", "EPOComputerProperties.UserProperty4" : "In use", "EPOComputerProperties.UserProperty5" : "Unspecified", "EPOComputerProperties.UserProperty6" : null, "EPOComputerProperties.UserProperty7" : "Profile: unspecified", "EPOComputerProperties.UserProperty8" : null, "EPOComputerProperties.Free_Space_of_Drive_C" : 221685, "EPOComputerProperties.Total_Space_of_Drive_C" : 482875, "EPOLeafNode.Tags" : "Workstation", "EPOLeafNode.ExcludedTags" : "", "EPOLeafNode.LastUpdate" : "2023-08-14T12:18:07+10:00", "EPOLeafNode.ManagedState" : 1, "EPOLeafNode.AgentGUID" : "634545454-300E-11ED-04417-5C60435345435", "EPOLeafNode.AgentVersion" : "5.7.6.251", "EPOBranchNode.AutoID" : 21 } ]

If I try and select-object one of the properties

$result = Invoke-RestMethod -Uri "https://mcafee-epo.domain.local:8448/remote/system.find?searchText=$(94422)&searchNameOnly=true&:output=json" -Credential $Cred
$result | Select-Object EPOComputerProperties.ParentID

I just get a blank table.

What am I doing wrong? It feels like Powershell is maybe not parsing the result or I'm not understanding something here.

Any guidance would be really appreciated.

Brian Tompsett - 汤莱恩
  • 5,753
  • 72
  • 57
  • 129
George
  • 143
  • 1
  • 1
  • 7
  • 1
    Are you sure `$result` is an object and not just a Json string ? If it really is an object then try `$result | Write-Output | Select-Object EPOComputerProperties.ParentID` (could be related to Json deserializer in powershell 5.1 not enumerating its output) – Santiago Squarzon Aug 14 '23 at 03:19
  • @SantiagoSquarzon I am using Powershell 5.1. How would i resolve this enumerating issue? All I want to do is run the invoke-restmethod , get a result and only select one particular property. With your suggestion I did exactly as you suggested and there is still no result. – George Aug 14 '23 at 03:39
  • 1
    What does `$result.GetType()` give you? Is that `OK:` part of the output? – Santiago Squarzon Aug 14 '23 at 03:50
  • @SantiagoSquarzon $result.GetType() produces a table with no info other than Is public true, is serial true, name is string, basetype is system.object. When i run just $result yes the OK: does appear to be a part of the results – George Aug 14 '23 at 05:27
  • Hi Santiago You led me to some useful information. I installed Powershell 7. Once I removed the OK: from the output I was able to select objects appropriately. thanks for your assistance. – George Aug 14 '23 at 06:43

1 Answers1

1

The website you are calling may not be returning back a proper json encoding.

To troubleshoot this sort of thing use Invoke-WebRequest instead of Invoke-RestMethod. Invoke-WebRequest will not attempt to convert the result and will let you see the exact return value.

$result = Invoke-WebRequest -Uri "https://mcafee-epo.domain.local:8448/remote/system.find?searchText=$(94422)&searchNameOnly=true&:output=json" -Credential $Cred
$result.Content

The above will let you see the raw value returned.

You can then try to convert the value to json yourself:

$result = Invoke-WebRequest -Uri "https://mcafee-epo.domain.local:8448/remote/system.find?searchText=$(94422)&searchNameOnly=true&:output=json" -Credential $Cred
$result.Content | ConvertFrom-Json | Select-Object EPOComputerProperties.ParentID

If that doesn't work, maybe they are sending the text "OK:" as a part of the result body which would throw off the conversion to json, so try removing it:

$result = Invoke-WebRequest -Uri "https://mcafee-epo.domain.local:8448/remote/system.find?searchText=$(94422)&searchNameOnly=true&:output=json" -Credential $Cred
$result.Content -replace 'OK:', '' | ConvertFrom-Json | Select-Object EPOComputerProperties.ParentID
Tolga
  • 2,643
  • 1
  • 27
  • 18
  • Hi Tolga - thank you for your guidance. So when I do Invoke-webrequest -URI.... i can see the raw results as you suggested. In the content I do see the OK: however using the above methods to replace the OKAY and select the object EPOComputerProperties.ParentID does not appear to yield any results. The table comes back as blank (no errors). Any other suggestions for me to try? – George Aug 14 '23 at 05:36
  • Tolga I wanted to provide an update. Actually the above suggestion from you does work. However I was only able to get that to work with the latest version of powershell. Powershell 5.1 was not able to select the object. Thanks for your assistance. I believe this is enough to mark this as resolved.. At least ofr my purpose anyway. I would love to ideally be able to use the restmethod to achieve this but this is more than good enough. Thanks again! – George Aug 14 '23 at 06:36