<#
Author: Damien VAN ROBAEYS
Website: https://www.systanddeploy.com
Twitter: @syst_and_deploy
Mail: damien.vanrobaeys@gmail.com
#>

#*****************************************************************
# Info to fill

# Info about your Log Analytics workspace
$CustomerId = "" # Log Analytics Workspace ID
$SharedKey = '' # Log Analytics Workspace Primary Key
$TimeStampField = ""

<#
Specify if you want to get BSOD log info
For this you need to configure a Proactive Remediation, see below:
https://www.systanddeploy.com/2022/03/proactive-remediation-detect-devices.html
#>

$Use_SharePoint_Logs = $False # $True or $False
# If $True, configure SharePoint app info
$ClientID = ""
$Secret = ''            
$Site_URL = ""
$Folder_Location = ""
$Log_File_Path = "" 

# Info to fill
#*****************************************************************

# Log analytics functions
# More info there: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api
Function Build-Signature ($customerId, $sharedKey, $date, $contentLength, $method, $contentType, $resource)
{
	$xHeaders = "x-ms-date:" + $date
	$stringToHash = $method + "`n" + $contentLength + "`n" + $contentType + "`n" + $xHeaders + "`n" + $resource

	$bytesToHash = [Text.Encoding]::UTF8.GetBytes($stringToHash)
	$keyBytes = [Convert]::FromBase64String($sharedKey)

	$sha256 = New-Object System.Security.Cryptography.HMACSHA256
	$sha256.Key = $keyBytes
	$calculatedHash = $sha256.ComputeHash($bytesToHash)
	$encodedHash = [Convert]::ToBase64String($calculatedHash)
	$authorization = 'SharedKey {0}:{1}' -f $customerId,$encodedHash
	return $authorization
}

# Create the function to create and post the request
# More info there: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api
Function Post-LogAnalyticsData($customerId, $sharedKey, $body, $logType)
{
	$method = "POST"
	$contentType = "application/json"
	$resource = "/api/logs"
	$rfc1123date = [DateTime]::UtcNow.ToString("r")
	$contentLength = $body.Length
	$signature = Build-Signature `
		-customerId $customerId `
		-sharedKey $sharedKey `
		-date $rfc1123date `
		-contentLength $contentLength `
		-method $method `
		-contentType $contentType `
		-resource $resource
	$uri = "https://" + $customerId + ".ods.opinsights.azure.com" + $resource + "?api-version=2016-04-01"

	$headers = @{
		"Authorization" = $signature;
		"Log-Type" = $logType;
		"x-ms-date" = $rfc1123date;
		"time-generated-field" = $TimeStampField;
	}

	$response = Invoke-WebRequest -Uri $uri -Method $method -ContentType $contentType -Headers $headers -Body $body -UseBasicParsing
	return $response.StatusCode
}

# Getting a token and authenticating to your tenant using the managed identity
$url = $env:IDENTITY_ENDPOINT  
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" 
$headers.Add("X-IDENTITY-HEADER", $env:IDENTITY_HEADER) 
$headers.Add("Metadata", "True") 
$body = @{resource='https://graph.microsoft.com/' } 
$script:accessToken = (Invoke-RestMethod $url -Method 'POST' -Headers $headers -ContentType 'application/x-www-form-urlencoded' -Body $body ).access_token
Connect-AzAccount -Identity
$headers = @{'Authorization'="Bearer " + $accessToken}

# Connexion to SharePoint (if variable $Use_SharePoint_Logs equals True)
If($Use_SharePoint_Logs -eq $True)
    {
        Connect-PnPOnline -Url $Site_URL -ClientId $ClientID -ClientSecret $Secret -WarningAction Ignore
    }

# Getting all Lenovo models info
# There we will convert models provided from Lenovo as MTM to friendly name
# more info here: https://www.systanddeploy.com/2023/01/get-list-uptodate-of-all-lenovo-models.html
# $URL = "https://download.lenovo.com/bsco/schemas/list.conf.txt"
# $Get_Web_Content = Invoke-RestMethod -Uri $URL -Method GET
# $Get_Models = $Get_Web_Content -split "`r`n"

$URL = "https://download.lenovo.com/bsco/public/allModels.json"
$Get_Models = Invoke-RestMethod -Uri $URL -Method GET

# Convert BSOD code to a description
# There we will convert BSOD codes to something more understanble, a bit more
$BugCheck_Reference = @{}
$BugCheck_Reference = @{
    "0x00000001" = "APC_INDEX_MISMATCH"
    "0x00000002" = "DEVICE_QUEUE_NOT_BUSY"
    "0x00000003" = "INVALID_AFFINITY_SET"
    "0x00000004" = "INVALID_DATA_ACCESS_TRAP"
    "0x00000005" = "INVALID_PROCESS_ATTACH_ATTEMPT"	
    "0x00000006" = "INVALID_PROCESS_DETACH_ATTEMPT"		
    "0x00000007" = "INVALID_SOFTWARE_INTERRUPT"		
    "0x00000008" = "IRQL_NOT_DISPATCH_LEVEL"			
	"0x00000009" = "IRQL_NOT_GREATER_OR_EQUAL"
	"0x0000000A" = "IRQL_NOT_LESS_OR_EQUAL"
	"0x0000000B" = "NO_EXCEPTION_HANDLING_SUPPORT"
	"0x0000000C" = "MAXIMUM_WAIT_OBJECTS_EXCEEDED"
	"0x0000000D" = "MUTEX_LEVEL_NUMBER_VIOLATION"
	"0x0000000E" = "NO_USER_MODE_CONTEXT"
	"0x0000000F" = "SPIN_LOCK_ALREADY_OWNED"
	"0x00000010" = "SPIN_LOCK_NOT_OWNED"
	"0x00000011" = "THREAD_NOT_MUTEX_OWNER"
	"0x00000012" = "TRAP_CAUSE_UNKNOWN"
	"0x00000013" = "EMPTY_THREAD_REAPER_LIST"
	"0x00000014" = "CREATE_DELETE_LOCK_NOT_LOCKED"
	"0x00000015" = "LAST_CHANCE_CALLED_FROM_KMODE"
	"0x00000016" = "CID_HANDLE_CREATION"
	"0x00000017" = "CID_HANDLE_DELETION"
	"0x00000018" = "REFERENCE_BY_POINTER"
	"0x00000019" = "BAD_POOL_HEADER"
	"0x0000001A" = "MEMORY_MANAGEMENT"
	"0x0000001B" = "PFN_SHARE_COUNT"
	"0x0000001C" = "PFN_REFERENCE_COUNT"
	"0x0000001D" = "NO_SPIN_LOCK_AVAILABLE"
	"0x0000001E" = "KMODE_EXCEPTION_NOT_HANDLED"
	"0x0000001F" = "SHARED_RESOURCE_CONV_ERROR"
	"0x00000020" = "KERNEL_APC_PENDING_DURING_EXIT"
	"0x00000021" = "QUOTA_UNDERFLOW"
	"0x00000022" = "FILE_SYSTEM"
	"0x00000023" = "FAT_FILE_SYSTEM"
	"0x00000024" = "NTFS_FILE_SYSTEM"
	"0x00000025" = "NPFS_FILE_SYSTEM"
	"0x00000026" = "CDFS_FILE_SYSTEM"
	"0x00000027" = "RDR_FILE_SYSTEM"
	"0x00000028" = "CORRUPT_ACCESS_TOKEN"
	"0x00000029" = "SECURITY_SYSTEM"
	"0x0000002A" = "INCONSISTENT_IRP"
	"0x0000002B" = "PANIC_STACK_SWITCH"
	"0x0000002C" = "PORT_DRIVER_INTERNAL"
	"0x0000002D" = "SCSI_DISK_DRIVER_INTERNAL"
	"0x0000002E" = "DATA_BUS_ERROR"
	"0x0000002F" = "INSTRUCTION_BUS_ERROR"
	"0x00000030" = "SET_OF_INVALID_CONTEXT"
	"0x00000031" = "PHASE0_INITIALIZATION_FAILED"
	"0x00000032" = "PHASE1_INITIALIZATION_FAILED"
	"0x00000033" = "UNEXPECTED_INITIALIZATION_CALL"
	"0x00000034" = "CACHE_MANAGER"
	"0x00000035" = "NO_MORE_IRP_STACK_LOCATIONS"
	"0x00000036" = "DEVICE_REFERENCE_COUNT_NOT_ZERO"
	"0x00000037" = "FLOPPY_INTERNAL_ERROR"
	"0x00000038" = "SERIAL_DRIVER_INTERNAL"
	"0x00000039" = "SYSTEM_EXIT_OWNED_MUTEX"
	"0x0000003A" = "SYSTEM_UNWIND_PREVIOUS_USER"
	"0x0000003B" = "SYSTEM_SERVICE_EXCEPTION"
	"0x0000003C" = "INTERRUPT_UNWIND_ATTEMPTED"
	"0x0000003D" = "INTERRUPT_EXCEPTION_NOT_HANDLED"
	"0x0000003E" = "MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED"
	"0x0000003F" = "NO_MORE_SYSTEM_PTES"
	"0x00000040" = "TARGET_MDL_TOO_SMALL"
	"0x00000041" = "MUST_SUCCEED_POOL_EMPTY"
	"0x00000042" = "ATDISK_DRIVER_INTERNAL"
	"0x00000043" = "NO_SUCH_PARTITION"
	"0x00000044" = "MULTIPLE_IRP_COMPLETE_REQUESTS"
	"0x00000045" = "INSUFFICIENT_SYSTEM_MAP_REGS"
	"0x00000046" = "DEREF_UNKNOWN_LOGON_SESSION"
	"0x00000047" = "REF_UNKNOWN_LOGON_SESSION"
	"0x00000048" = "CANCEL_STATE_IN_COMPLETED_IRP"
	"0x00000049" = "PAGE_FAULT_WITH_INTERRUPTS_OFF"
	"0x0000004A" = "IRQL_GT_ZERO_AT_SYSTEM_SERVICE"
	"0x0000004B" = "STREAMS_INTERNAL_ERROR"
	"0x0000004C" = "FATAL_UNHANDLED_HARD_ERROR"
	"0x0000004D" = "NO_PAGES_AVAILABLE"
	"0x0000004E" = "PFN_LIST_CORRUPT"
	"0x0000004F" = "NDIS_INTERNAL_ERROR"
	"0x00000050" = "PAGE_FAULT_IN_NONPAGED_AREA"
	"0x00000051" = "REGISTRY_ERROR"
	"0x00000052" = "MAILSLOT_FILE_SYSTEM"
	"0x00000053" = "NO_BOOT_DEVICE"
	"0x00000054" = "LM_SERVER_INTERNAL_ERROR"
	"0x00000055" = "DATA_COHERENCY_EXCEPTION"
	"0x00000056" = "INSTRUCTION_COHERENCY_EXCEPTION"
	"0x00000057" = "XNS_INTERNAL_ERROR"
	"0x00000058" = "FTDISK_INTERNAL_ERROR"
	"0x00000059" = "PINBALL_FILE_SYSTEM"
	"0x0000005A" = "CRITICAL_SERVICE_FAILED"
	"0x0000005B" = "SET_ENV_VAR_FAILED"
	"0x0000005C" = "HAL_INITIALIZATION_FAILED"
	"0x0000005D" = "UNSUPPORTED_PROCESSOR"
	"0x0000005E" = "OBJECT_INITIALIZATION_FAILED"
	"0x0000005F" = "SECURITY_INITIALIZATION_FAILED"
	"0x00000060" = "PROCESS_INITIALIZATION_FAILED"
	"0x00000061" = "HAL1_INITIALIZATION_FAILED"
	"0x00000062" = "OBJECT1_INITIALIZATION_FAILED"
	"0x00000063" = "SECURITY1_INITIALIZATION_FAILED"
	"0x00000064" = "SYMBOLIC_INITIALIZATION_FAILED"
	"0x00000065" = "MEMORY1_INITIALIZATION_FAILED"
	"0x00000066" = "CACHE_INITIALIZATION_FAILED"
	"0x00000067" = "CONFIG_INITIALIZATION_FAILED"
	"0x00000068" = "FILE_INITIALIZATION_FAILED"
	"0x00000069" = "IO1_INITIALIZATION_FAILED"
	"0x0000006A" = "LPC_INITIALIZATION_FAILED"
	"0x0000006B" = "PROCESS1_INITIALIZATION_FAILED"
	"0x0000006C" = "REFMON_INITIALIZATION_FAILED"
	"0x0000006D" = "SESSION1_INITIALIZATION_FAILED"
	"0x0000006E" = "SESSION2_INITIALIZATION_FAILED"
	"0x0000006F" = "SESSION3_INITIALIZATION_FAILED"
	"0x00000070" = "SESSION4_INITIALIZATION_FAILED"
	"0x00000071" = "SESSION5_INITIALIZATION_FAILED"
	"0x00000072" = "ASSIGN_DRIVE_LETTERS_FAILED"
	"0x00000073" = "CONFIG_LIST_FAILED"
	"0x00000074" = "BAD_SYSTEM_CONFIG_INFO"
	"0x00000075" = "CANNOT_WRITE_CONFIGURATION"
	"0x00000076" = "PROCESS_HAS_LOCKED_PAGES"
	"0x00000077" = "KERNEL_STACK_INPAGE_ERROR"
	"0x00000078" = "PHASE0_EXCEPTION"
	"0x00000079" = "MISMATCHED_HAL"
	"0x0000007A" = "KERNEL_DATA_INPAGE_ERROR"
	"0x0000007B" = "INACCESSIBLE_BOOT_DEVICE"
	"0x0000007C" = "BUGCODE_NDIS_DRIVER"
	"0x0000007D" = "INSTALL_MORE_MEMORY"
	"0x0000007E" = "SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
	"0x0000007F" = "UNEXPECTED_KERNEL_MODE_TRAP"
	"0x00000080" = "NMI_HARDWARE_FAILURE"
	"0x00000081" = "SPIN_LOCK_INIT_FAILURE"
	"0x00000082" = "DFS_FILE_SYSTEM"
	"0x00000085" = "SETUP_FAILURE"
	"0x0000008B" = "MBR_CHECKSUM_MISMATCH"
	"0x0000008E" = "KERNEL_MODE_EXCEPTION_NOT_HANDLED"
	"0x0000008F" = "PP0_INITIALIZATION_FAILED"
	"0x00000090" = "PP1_INITIALIZATION_FAILED"
	"0x00000092" = "UP_DRIVER_ON_MP_SYSTEM"
	"0x00000093" = "INVALID_KERNEL_HANDLE"
	"0x00000094" = "KERNEL_STACK_LOCKED_AT_EXIT"
	"0x00000096" = "INVALID_WORK_QUEUE_ITEM"
	"0x00000097" = "BOUND_IMAGE_UNSUPPORTED"
	"0x00000098" = "END_OF_NT_EVALUATION_PERIOD"
	"0x00000099" = "INVALID_REGION_OR_SEGMENT"
	"0x0000009A" = "SYSTEM_LICENSE_VIOLATION"
	"0x0000009B" = "UDFS_FILE_SYSTEM"
	"0x0000009C" = "MACHINE_CHECK_EXCEPTION"
	"0x0000009E" = "USER_MODE_HEALTH_MONITOR"
	"0x0000009F" = "DRIVER_POWER_STATE_FAILURE"
	"0x000000A0" = "INTERNAL_POWER_ERROR"
	"0x000000A1" = "PCI_BUS_DRIVER_INTERNAL"
	"0x000000A2" = "MEMORY_IMAGE_CORRUPT"
	"0x000000A3" = "ACPI_DRIVER_INTERNAL"
	"0x000000A4" = "CNSS_FILE_SYSTEM_FILTER"
	"0x000000A5" = "ACPI_BIOS_ERROR"
	"0x000000A7" = "BAD_EXHANDLE"
	"0x000000AC" = "HAL_MEMORY_ALLOCATION"
	"0x000000AD" = "VIDEO_DRIVER_DEBUG_REPORT_REQUEST"
	"0x000000B1" = "BGI_DETECTED_VIOLATION"
	"0x000000B4" = "VIDEO_DRIVER_INIT_FAILURE"
	"0x000000B8" = "ATTEMPTED_SWITCH_FROM_DPC"
	"0x000000B9" = "CHIPSET_DETECTED_ERROR"
	"0x000000BA" = "SESSION_HAS_VALID_VIEWS_ON_EXIT"
	"0x000000BB" = "NETWORK_BOOT_INITIALIZATION_FAILED"
	"0x000000BC" = "NETWORK_BOOT_DUPLICATE_ADDRESS"
	"0x000000BD" = "INVALID_HIBERNATED_STATE"
	"0x000000BE" = "ATTEMPTED_WRITE_TO_READONLY_MEMORY"
	"0x000000BF" = "MUTEX_ALREADY_OWNED"
	"0x000000C1" = "SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION"
	"0x000000C2" = "BAD_POOL_CALLER"
	"0x000000C4" = "DRIVER_VERIFIER_DETECTED_VIOLATION"
	"0x000000C5" = "DRIVER_CORRUPTED_EXPOOL"
	"0x000000C6" = "DRIVER_CAUGHT_MODIFYING_FREED_POOL"
	"0x000000C7" = "TIMER_OR_DPC_INVALID"
	"0x000000C8" = "IRQL_UNEXPECTED_VALUE"
	"0x000000C9" = "DRIVER_VERIFIER_IOMANAGER_VIOLATION"
	"0x000000CA" = "PNP_DETECTED_FATAL_ERROR"
	"0x000000CB" = "DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS"
	"0x000000CC" = "PAGE_FAULT_IN_FREED_SPECIAL_POOL"
	"0x000000CD" = "PAGE_FAULT_BEYOND_END_OF_ALLOCATION"
	"0x000000CE" = "DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
	"0x000000CF" = "TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE"
	"0x000000D0" = "DRIVER_CORRUPTED_MMPOOL"
	"0x000000D1" = "DRIVER_IRQL_NOT_LESS_OR_EQUAL"
	"0x000000D2" = "BUGCODE_ID_DRIVER"
	"0x000000D3" = "DRIVER_PORTION_MUST_BE_NONPAGED"
	"0x000000D4" = "SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD"
	"0x000000D5" = "DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL"
	"0x000000D6" = "DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION"
	"0x000000D7" = "DRIVER_UNMAPPING_INVALID_VIEW"
	"0x000000D8" = "DRIVER_USED_EXCESSIVE_PTES"
	"0x000000D9" = "LOCKED_PAGES_TRACKER_CORRUPTION"
	"0x000000DA" = "SYSTEM_PTE_MISUSE"
	"0x000000DB" = "DRIVER_CORRUPTED_SYSPTES"
	"0x000000DC" = "DRIVER_INVALID_STACK_ACCESS"
	"0x000000DE" = "POOL_CORRUPTION_IN_FILE_AREA"
	"0x000000DF" = "IMPERSONATING_WORKER_THREAD"
	"0x000000E0" = "ACPI_BIOS_FATAL_ERROR"
	"0x000000E1" = "WORKER_THREAD_RETURNED_AT_BAD_IRQL"
	"0x000000E2" = "MANUALLY_INITIATED_CRASH"
	"0x000000E3" = "RESOURCE_NOT_OWNED"
	"0x000000E4" = "WORKER_INVALID"
	"0x000000E6" = "DRIVER_VERIFIER_DMA_VIOLATION"
	"0x000000E7" = "INVALID_FLOATING_POINT_STATE"
	"0x000000E8" = "INVALID_CANCEL_OF_FILE_OPEN"
	"0x000000E9" = "ACTIVE_EX_WORKER_THREAD_TERMINATION"
	"0x000000EA" = "THREAD_STUCK_IN_DEVICE_DRIVER"
	"0x000000EB" = "DIRTY_MAPPED_PAGES_CONGESTION"
	"0x000000EC" = "SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT"
	"0x000000ED" = "UNMOUNTABLE_BOOT_VOLUME"
	"0x000000EF" = "CRITICAL_PROCESS_DIED"
	"0x000000F0" = "STORAGE_MINIPORT_ERROR"
	"0x000000F1" = "SCSI_VERIFIER_DETECTED_VIOLATION"
	"0x000000F2" = "HARDWARE_INTERRUPT_STORM"
	"0x000000F3" = "DISORDERLY_SHUTDOWN"
	"0x000000F4" = "CRITICAL_OBJECT_TERMINATION"
	"0x000000F5" = "FLTMGR_FILE_SYSTEM"
	"0x000000F6" = "PCI_VERIFIER_DETECTED_VIOLATION"
	"0x000000F7" = "DRIVER_OVERRAN_STACK_BUFFER"
	"0x000000F8" = "RAMDISK_BOOT_INITIALIZATION_FAILED"
	"0x000000F9" = "DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN"
	"0x000000FA" = "HTTP_DRIVER_CORRUPTED"
	"0x000000FC" = "ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY"
	"0x000000FD" = "DIRTY_NOWRITE_PAGES_CONGESTION"
	"0x000000FE" = "BUGCODE_USB_DRIVER"
	"0x000000FF" = "RESERVE_QUEUE_OVERFLOW"
	"0x00000100" = "LOADER_BLOCK_MISMATCH"
	"0x00000101" = "CLOCK_WATCHDOG_TIMEOUT"
	"0x00000102" = "DPC_WATCHDOG_TIMEOUT"
	"0x00000103" = "MUP_FILE_SYSTEM"
	"0x00000104" = "AGP_INVALID_ACCESS"
	"0x00000105" = "AGP_GART_CORRUPTION"
	"0x00000106" = "AGP_ILLEGALLY_REPROGRAMMED"
	"0x00000108" = "THIRD_PARTY_FILE_SYSTEM_FAILURE"
	"0x00000109" = "CRITICAL_STRUCTURE_CORRUPTION"
	"0x0000010A" = "APP_TAGGING_INITIALIZATION_FAILED"
	"0x0000010C" = "FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION"
	"0x0000010D" = "WDF_VIOLATION"
	"0x0000010E" = "VIDEO_MEMORY_MANAGEMENT_INTERNAL"
	"0x0000010F" = "RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED"
	"0x00000111" = "RECURSIVE_NMI"
	"0x00000112" = "MSRPC_STATE_VIOLATION"
	"0x00000113" = "VIDEO_DXGKRNL_FATAL_ERROR"
	"0x00000114" = "VIDEO_SHADOW_DRIVER_FATAL_ERROR"
	"0x00000115" = "AGP_INTERNAL"
	"0x00000116" = "VIDEO_TDR_FAILURE"
	"0x00000117" = "VIDEO_TDR_TIMEOUT_DETECTED"
	"0x00000119" = "VIDEO_SCHEDULER_INTERNAL_ERROR"
	"0x0000011A" = "EM_INITIALIZATION_FAILURE"
	"0x0000011B" = "DRIVER_RETURNED_HOLDING_CANCEL_LOCK"
	"0x0000011C" = "ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE"
	"0x0000011D" = "EVENT_TRACING_FATAL_ERROR"
	"0x0000011E" = "TOO_MANY_RECURSIVE_FAULTS"
	"0x0000011F" = "INVALID_DRIVER_HANDLE"
	"0x00000120" = "BITLOCKER_FATAL_ERROR"
	"0x00000121" = "DRIVER_VIOLATION"
	"0x00000122" = "WHEA_INTERNAL_ERROR"
	"0x00000123" = "CRYPTO_SELF_TEST_FAILURE"
	"0x00000125" = "NMR_INVALID_STATE"
	"0x00000126" = "NETIO_INVALID_POOL_CALLER"
	"0x00000127" = "PAGE_NOT_ZERO"
	"0x00000128" = "WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY"
	"0x00000129" = "WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY"
	"0x0000012A" = "MUI_NO_VALID_SYSTEM_LANGUAGE"
	"0x0000012B" = "FAULTY_HARDWARE_CORRUPTED_PAGE"
	"0x0000012C" = "EXFAT_FILE_SYSTEM"
	"0x0000012D" = "VOLSNAP_OVERLAPPED_TABLE_ACCESS"
	"0x0000012E" = "INVALID_MDL_RANGE"
	"0x0000012F" = "VHD_BOOT_INITIALIZATION_FAILED"
	"0x00000130" = "DYNAMIC_ADD_PROCESSOR_MISMATCH"
	"0x00000131" = "INVALID_EXTENDED_PROCESSOR_STATE"
	"0x00000132" = "RESOURCE_OWNER_POINTER_INVALID"
	"0x00000133" = "DPC_WATCHDOG_VIOLATION"
	"0x00000134" = "DRIVE_EXTENDER"
	"0x00000135" = "REGISTRY_FILTER_DRIVER_EXCEPTION"
	"0x00000136" = "VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE"
	"0x00000137" = "WIN32K_HANDLE_MANAGER"
	"0x00000138" = "GPIO_CONTROLLER_DRIVER_ERROR"
	"0x00000139" = "KERNEL_SECURITY_CHECK_FAILURE"
	"0x0000013A" = "KERNEL_MODE_HEAP_CORRUPTION"
	"0x0000013B" = "PASSIVE_INTERRUPT_ERROR"
	"0x0000013C" = "INVALID_IO_BOOST_STATE"
	"0x0000013D" = "CRITICAL_INITIALIZATION_FAILURE"
	"0x00000140" = "STORAGE_DEVICE_ABNORMALITY_DETECTED"
	"0x00000143" = "PROCESSOR_DRIVER_INTERNAL"
	"0x00000144" = "BUGCODE_USB3_DRIVER"
	"0x00000145" = "SECURE_BOOT_VIOLATION"
	"0x00000147" = "ABNORMAL_RESET_DETECTED"
	"0x00000149" = "REFS_FILE_SYSTEM"
	"0x0000014A" = "KERNEL_WMI_INTERNAL"
	"0x0000014B" = "SOC_SUBSYSTEM_FAILURE"
	"0x0000014C" = "FATAL_ABNORMAL_RESET_ERROR"
	"0x0000014D" = "EXCEPTION_SCOPE_INVALID"
	"0x0000014E" = "SOC_CRITICAL_DEVICE_REMOVED"
	"0x0000014F" = "PDC_WATCHDOG_TIMEOUT"
	"0x00000150" = "TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK"
	"0x00000151" = "UNSUPPORTED_INSTRUCTION_MODE"
	"0x00000152" = "INVALID_PUSH_LOCK_FLAGS"
	"0x00000153" = "KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION"
	"0x00000154" = "UNEXPECTED_STORE_EXCEPTION"
	"0x00000155" = "OS_DATA_TAMPERING"
	"0x00000157" = "KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION"
	"0x00000158" = "ILLEGAL_IOMMU_PAGE_FAULT"
	"0x00000159" = "HAL_ILLEGAL_IOMMU_PAGE_FAULT"
	"0x0000015A" = "SDBUS_INTERNAL_ERROR"
	"0x0000015B" = "WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE"
	"0x00000160" = "WIN32K_ATOMIC_CHECK_FAILURE"
	"0x00000162" = "KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE"
	"0x00000163" = "WORKER_THREAD_TEST_CONDITION"
	"0x0000016C" = "INVALID_RUNDOWN_PROTECTION_FLAGS"
	"0x0000016D" = "INVALID_SLOT_ALLOCATOR_FLAGS"
	"0x0000016E" = "ERESOURCE_INVALID_RELEASE"
	"0x00000170" = "CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG"
	"0x00000171" = "CRYPTO_LIBRARY_INTERNAL_ERROR"
	"0x00000173" = "COREMSGCALL_INTERNAL_ERROR"
	"0x00000174" = "COREMSG_INTERNAL_ERROR"
	"0x00000178" = "ELAM_DRIVER_DETECTED_FATAL_ERROR"
	"0x0000017B" = "PROFILER_CONFIGURATION_ILLEGAL"
	"0x0000017E" = "MICROCODE_REVISION_MISMATCH"
	"0x00000187" = "VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD"
	"0x00000189" = "BAD_OBJECT_HEADER"
	"0x0000018B" = "SECURE_KERNEL_ERROR"
	"0x0000018C" = "HYPERGUARD_VIOLATION"
	"0x0000018D" = "SECURE_FAULT_UNHANDLED"
	"0x0000018E" = "KERNEL_PARTITION_REFERENCE_VIOLATION"
	"0x00000191" = "PF_DETECTED_CORRUPTION"
	"0x00000192" = "KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL"
	"0x00000196" = "LOADER_ROLLBACK_DETECTED"
	"0x00000197" = "WIN32K_SECURITY_FAILURE"
	"0x00000199" = "KERNEL_STORAGE_SLOT_IN_USE"
	"0x0000019A" = "WORKER_THREAD_RETURNED_WHILE_ATTACHED_TO_SILO"
	"0x0000019B" = "TTM_FATAL_ERROR"
	"0x0000019C" = "WIN32K_POWER_WATCHDOG_TIMEOUT"
	"0x000001A0" = "TTM_WATCHDOG_TIMEOUT"
	"0x000001A2" = "WIN32K_CALLOUT_WATCHDOG_BUGCHECK"
	"0x000001C6" = "FAST_ERESOURCE_PRECONDITION_VIOLATION"
	"0x000001C7" = "STORE_DATA_STRUCTURE_CORRUPTION"
	"0x000001C8" = "MANUALLY_INITIATED_POWER_BUTTON_HOLD"
	"0x000001CA" = "SYNTHETIC_WATCHDOG_TIMEOUT"
	"0x000001CB" = "INVALID_SILO_DETACH"
	"0x000001CD" = "INVALID_CALLBACK_STACK_ADDRESS"
	"0x000001CE" = "INVALID_KERNEL_STACK_ADDRESS"
	"0x000001CF" = "HARDWARE_WATCHDOG_TIMEOUT"
	"0x000001D0" = "CPI_FIRMWARE_WATCHDOG_TIMEOUT"
	"0x000001D2" = "WORKER_THREAD_INVALID_STATE"
	"0x000001D3" = "WFP_INVALID_OPERATION"
	"0x000001D5" = "DRIVER_PNP_WATCHDOG"
	"0x000001D6" = "WORKER_THREAD_RETURNED_WITH_NON_DEFAULT_WORKLOAD_CLASS"
	"0x000001D7" = "EFS_FATAL_ERROR"
	"0x000001D8" = "UCMUCSI_FAILURE"
	"0x000001D9" = "HAL_IOMMU_INTERNAL_ERROR"
	"0x000001DA" = "HAL_BLOCKED_PROCESSOR_INTERNAL_ERROR"
	"0x000001DB" = "IPI_WATCHDOG_TIMEOUT"
	"0x000001DC" = "DMA_COMMON_BUFFER_VECTOR_ERROR"
	"0x00000356" = "XBOX_ERACTRL_CS_TIMEOUT"
	"0x00000BFE" = "BC_BLUETOOTH_VERIFIER_FAULT"
	"0x00000BFF" = "BC_BTHMINI_VERIFIER_FAULT"
	"0x00020001" = "HYPERVISOR_ERROR"
	"0x1000007E" = "SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M"
	"0x1000007F" = "UNEXPECTED_KERNEL_MODE_TRAP_M"
	"0x1000008E" = "KERNEL_MODE_EXCEPTION_NOT_HANDLED_M"
	"0x100000EA" = "THREAD_STUCK_IN_DEVICE_DRIVER_M"
	"0x4000008A" = "THREAD_TERMINATE_HELD_MUTEX"
	"0xC0000218" = "STATUS_CANNOT_LOAD_REGISTRY_FILE"
	"0xC000021A" = "WINLOGON_FATAL_ERROR"
	"0xC0000221" = "STATUS_IMAGE_CHECKSUM_MISMATCH"
	"0xDEADDEAD" = "MANUALLY_INITIATED_CRASH1"
}
$Error_code = $BugCheck_Reference.GetEnumerator() | Select-Object -Property Key,Value 


# Graph URL to use to list all BSOD
$BSOD_URL = "https://graph.microsoft.com/beta/deviceManagement/userExperienceAnalyticsDevicePerformance?dtFilter=all&`$orderBy=blueScreenCount%20desc&`$filter=blueScreenCount%20ge%201%20and%20blueScreenCount%20le%20500"
$All_BSOD = Invoke-WebRequest -Uri $BSOD_URL -Method GET -Headers $Headers -UseBasicParsing 
$All_BSOD_JsonResponse = ($All_BSOD.Content | ConvertFrom-Json)
$Get_All_BSOD = $All_BSOD_JsonResponse.value

# We will parse all pages
If($All_BSOD_JsonResponse.'@odata.nextLink')
{
    do {
        $URL = $All_BSOD_JsonResponse.'@odata.nextLink'
        $All_BSOD = Invoke-WebRequest -Uri $URL -Method GET -Headers $Headers -UseBasicParsing 
        $All_BSOD_JsonResponse = ($All_BSOD.Content | ConvertFrom-Json)
        $Get_All_BSOD += $All_BSOD_JsonResponse.value
    } until ($null -eq $All_BSOD_JsonResponse.'@odata.nextLink')
}

$BSOD_Array = @()	
$BSOD_Details_Array = @()		

ForEach($BSOD in $Get_All_BSOD)
	{
		$Device_Model = $BSOD.model
		$Device_Name = $BSOD.deviceName
		$BSOD_Count = $BSOD.blueScreenCount
		$DeviceID = $BSOD.id
        $Manufacturer = $BSOD.manufacturer
        $restartCount = $BSOD.restartCount


		# If we choose to get logs from SharePoint, we will check if there is a file on SharePoint corresponding to the device name
        If($Use_SharePoint_Logs -eq $True)
            {
                $BSOD_File_Name = "BSOD_$Device_Name.zip"
                $BSOD_Log_File = "/sites/DWP-Support/Documents partages/Windows/BSOD/$BSOD_File_Name"
                $Get_Log_File = Get-PnPFile -Url $BSOD_Log_File -ea SilentlyContinue
                If($Get_Log_File -ne $null)
                    {
                        $Log_File_Link = "$Log_File_Path/$BSOD_File_Name"   
                        $Log_File_Date = $Get_Log_File.TimeLastModified
                    }
                Else 
                    {
                        $Log_File_Link = "No logs" 
                        $Log_File_Date = ""      
                    }
            }
       
        If($Manufacturer -eq "lenovo")
            {
                # $Model_MTM = $Device_Model.Substring(0,4)                            
                # $Current_Model = $Get_Models | where-object { $_ -like "*$Model_MTM*"}
                # $Device_Model = ($Current_Model.split("("))[0]
				
                $Model_MTM = $Device_Model.Substring(0,4)                            
                $Current_Model = ($Get_Models | where-object {($_ -like "*$Model_MTM*") -and ($_ -notlike "*-UEFI Lenovo*") -and ($_ -notlike "*dTPM*") -and ($_ -notlike "*Asset*") -and ($_ -notlike "*fTPM*")})[0]
                $Device_Model = ($Current_Model.name.split("("))[0]         				
            }

		# There we will get all BSOD for all device
		$StartupHistory_url = "https://graph.microsoft.com/beta/deviceManagement/userExperienceAnalyticsDeviceStartupHistory?" + '$filter=deviceId%20eq%20%27' + "$DeviceID%27"				
        $Get_StartupHistory = Invoke-WebRequest -Uri $StartupHistory_url -Method GET -Headers $Headers -UseBasicParsing 
        $Get_BSOD_JsonResponse = ($Get_StartupHistory.Content | ConvertFrom-Json)

        $Get_last_BSOD = ($Get_BSOD_JsonResponse.value | Where {$_.restartCategory -eq "blueScreen"})[-1]           

        $Get_All_BSOD = ($Get_BSOD_JsonResponse.value | Where {$_.restartCategory -eq "blueScreen"})
        foreach($BSOD in $Get_All_BSOD) 
            {
                $Get_BSOD_Date = $BSOD.startTime
                $Get_BSOD_Code = $BSOD.restartStopCode 
                $All_BSOD_Results += "$Get_BSOD_Date ($Get_BSOD_Code)`n"
                $Get_Error_Label = ($Error_code | Where {$_.Key -eq $Get_BSOD_Code}).Value

                $BSOD_Details_Obj = New-Object PSObject
                Add-Member -InputObject $BSOD_Details_Obj -MemberType NoteProperty -Name "Device" -Value $Device_Name	
                Add-Member -InputObject $BSOD_Details_Obj -MemberType NoteProperty -Name "Model" -Value $Device_Model	
                Add-Member -InputObject $BSOD_Details_Obj -MemberType NoteProperty -Name "AllBSODDate" -Value $Get_BSOD_Date
                Add-Member -InputObject $BSOD_Details_Obj -MemberType NoteProperty -Name "AllBSODCode" -Value $Get_BSOD_Code	
                Add-Member -InputObject $BSOD_Details_Obj -MemberType NoteProperty -Name "AllBSODCodeInfo" -Value $Get_Error_Label		 
                $BSOD_Details_Array += $BSOD_Details_Obj	
            }	

        $Last_BSOD_Date = ($Get_last_BSOD.startTime)
		$Last_BSOD_Code = $Get_last_BSOD.restartStopCode
		$OS = $Get_last_BSOD.operatingSystemVersion		
		$restartFaultBucket = $Get_last_BSOD.operatingSystemVrestartFaultBucketersion		
		$isFeatureUpdate = $Get_last_BSOD.isFeatureUpdate		
		$isFirstLogin = $Get_last_BSOD.isFirstLogin		
		$Intune_ID = $Get_last_BSOD.deviceId		

        $Get_Last_Error_Label = ($Error_code | Where {$_.Key -eq $Last_BSOD_Code}).Value		
        
        $Device_URL = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$DeviceID"

        $Get_Device_Info = Invoke-WebRequest -Uri $Device_URL -Method GET -Headers $Headers -UseBasicParsing 
        $Get_Device_Info_JsonResponse = ($Get_Device_Info.Content | ConvertFrom-Json)

        $Device_enrolledDateTime = $Get_Device_Info_JsonResponse.enrolledDateTime
        $Device_lastSyncDateTime = $Get_Device_Info_JsonResponse.lastSyncDateTime
        $Device_totalStorageSpaceInBytes = $Get_Device_Info_JsonResponse.totalStorageSpaceInBytes
        $Device_freeStorageSpaceInBytes = $Get_Device_Info_JsonResponse.freeStorageSpaceInBytes
        $Device_autopilotEnrolled = $Get_Device_Info_JsonResponse.autopilotEnrolled
        $Device_physicalMemoryInBytes = $Get_Device_Info_JsonResponse.physicalMemoryInBytes
        $Device_processorArchitecture = $Get_Device_Info_JsonResponse.processorArchitecture
        $Device_skuFamily = $Get_Device_Info_JsonResponse.skuFamily
        $Device_skuNumber = $Get_Device_Info_JsonResponse.skuNumber
      
        $Hardware_info_URL = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/" + $DeviceID + "?select=hardwareinformation"                
        $Get_Hardware_Info = Invoke-WebRequest -Uri $Hardware_info_URL -Method GET -Headers $Headers -UseBasicParsing 
        $Get_Hardware_Info_JsonResponse = ($Get_Hardware_Info.Content | ConvertFrom-Json).hardwareInformation
        
        $Device_tpmSpecificationVersion = $Get_Hardware_Info_JsonResponse.tpmSpecificationVersion
        $Device_operatingSystemEdition = $Get_Hardware_Info_JsonResponse.operatingSystemEdition
        $Device_deviceFullQualifiedDomainName = $Get_Hardware_Info_JsonResponse.deviceFullQualifiedDomainName
        $Device_deviceGuardVirtualizationBasedSecurityState = $Get_Hardware_Info_JsonResponse.deviceGuardVirtualizationBasedSecurityState
        $Device_deviceGuardLocalSystemAuthorityCredentialGuardState = $Get_Hardware_Info_JsonResponse.deviceGuardLocalSystemAuthorityCredentialGuardState
        $Device_ipAddressV4 = $Get_Hardware_Info_JsonResponse.ipAddressV4
        $Device_systemManagementBIOSVersion = $Get_Hardware_Info_JsonResponse.systemManagementBIOSVersion
        $Device_tpmManufacturer = $Get_Hardware_Info_JsonResponse.tpmManufacturer
        $Device_tpmVersion = $Get_Hardware_Info_JsonResponse.tpmVersion
        
		$BSOD_Obj = New-Object PSObject
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "Device" -Value $Device_Name		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "Model" -Value $Device_Model		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "BSODCount" -Value $BSOD_Count		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "OSVersion" -Value $OS				
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "LastBSOD" -Value $Last_BSOD_Date		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "LastCode" -Value $Last_BSOD_Code
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "LastCodeInfo" -Value $Get_Last_Error_Label
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "BSODLogFile" -Value $Log_File_Link
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "BSODLogFileDate" -Value $Log_File_Date
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "AllBSOD" -Value $All_BSOD_Results
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "restartFaultBucket" -Value $restartFaultBucket
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "isFeatureUpdate" -Value $isFeatureUpdate
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "isFirstLogin" -Value $isFirstLogin
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "IntuneID" -Value $Intune_ID
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "Manufacturer" -Value $Manufacturer
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "restartCount" -Value $restartCount
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "enrolledDateTime" -Value $Device_enrolledDateTime		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "lastSyncDateTime" -Value $Device_lastSyncDateTime		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "totalStorageSpaceInBytes" -Value $Device_totalStorageSpaceInBytes		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "freeStorageSpaceInBytes" -Value $Device_freeStorageSpaceInBytes		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "autopilotEnrolled	" -Value $Device_autopilotEnrolled		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "physicalMemoryInBytes" -Value $Device_physicalMemoryInBytes		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "processorArchitecture" -Value $Device_processorArchitecture		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "skuFamily" -Value $Device_skuFamily		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "skuNumber" -Value $Device_skuNumber		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "tpmSpecificationVersion" -Value $Device_tpmSpecificationVersion		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "operatingSystemEdition" -Value $Device_operatingSystemEdition		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "deviceFullQualifiedDomainName" -Value $Device_deviceFullQualifiedDomainName		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "ipAddressV4" -Value $Device_ipAddressV4		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "FullBIOSVersion" -Value $Device_systemManagementBIOSVersion		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "tpmManufacturer" -Value $Device_tpmManufacturer		
		Add-Member -InputObject $BSOD_Obj -MemberType NoteProperty -Name "tpmVersion" -Value $Device_tpmVersion	        
		$BSOD_Array += $BSOD_Obj       
	}

# There we will send all info to Log Analytics
$BSOD_Json = $BSOD_Array | ConvertTo-Json
$params = @{
	CustomerId = $customerId
	SharedKey  = $sharedKey
	Body       = ([System.Text.Encoding]::UTF8.GetBytes($BSOD_Json))
	LogType    = "BSOD" 
}
$LogResponse = Post-LogAnalyticsData @params


$BSOD_Details_Json = $BSOD_Details_Array | ConvertTo-Json
$params = @{
	CustomerId = $customerId
	SharedKey  = $sharedKey
	Body       = ([System.Text.Encoding]::UTF8.GetBytes($BSOD_Details_Json))
	LogType    = "BSOD_Details" 
}
$LogResponse = Post-LogAnalyticsData @params
