Mass export script output

Hey @dynasec! In short - no. But I've run into this so many times. Most of the time I just deal with not being able to do this, but in one instance I did develop a solution that works well enough.

In my case, I needed to gather all Windows event data from all customers where the event itself had a severity level of 1, 2, or 3. This was so I can compile the data and run my own analysis.

My solution to mass data collection was to have each endpoint upload its own output to an SFTP server. To achieve this, you first need to have a functioning SFTP server (obviously). In your data collection script you can paste in this to get the Posh-SSH module installed:

# Install Posh-SSH module
If ( !(Get-Module -ListAvailable -Name Posh-SSH) ) {
    Write-Output "Installing Posh-SSH module"
    Install-Module -Name Posh-SSH -Force
}

Create the following variables to connect to your SFTP host:

# Host
$SFTPHost = 'sftphost.example.com' 

# Port number
$SFTPPort = 22

# Username
$SFTPUser = 'sftp-username'

# Password
$SFTPPass = ConvertTo-SecureString '<secure-sftp-password-here>' -AsPlainTex

Now have your script do whatever it's going to do and gather the data into a file. You'll upload that file to your SFTP host like this:

# Create a credential object to pass to Posh-SSH
$SFTPCred = New-Object System.Management.Automation.PSCredential($SFTPUser,$SFTPPass)

# Create the SFTP session
$SFTPSession = New-SFTPSession -ComputerName $SFTPHost -Credential $SFTPCred -AcceptKey -Port $SFTPPort

# Upload the file
Set-SFTPItem -SessionId $SFTPSession.SessionId -Path 'path/to/file' -Destination '/remote/dir' -Force

# Close the SFTP session after uploading the file
Remove-SFTPSession -SessionId $SFTPSession.SessionId

Where 'path/to/file' is the path to the file you'll upload, and '/remote/dir' is the directory on the SFTP server to upload to; if you'll upload the file to the root of the SFTP host, use the following instead: -Destination . -Force

Now you'll just need to download all the results to your local computer, and tabulate/analyze the data however you need to. This works for me and it is pretty effective. The only drawback is that since this functionality isn't natively supported by Atera, if you have endpoints running Windows 7 or Windows Server 2008 you'll have issues.