Server.Utils.ScheduledDeletion

Schedules Server.Utils.DeleteMonitoringData to cleanup server monitoring data.

name: Server.Utils.ScheduledDeletion
author: Zane Gittins
description: |
    Schedules Server.Utils.DeleteMonitoringData to cleanup server monitoring data.

type: SERVER_EVENT

parameters:
  - name: ScheduleDayRegex
    default: .
  - name: ScheduleTimeRegex
    default: "00:00:"
  - name: ArtifactRegex
    default: "EVTX|ETW"
  - name: DaysOld
    default: 7
    type: int

sources:
  - query: |
      LET schedule = SELECT UTC.String AS Now,
      Weekday.String AS Today
      FROM clock(period=60)
      WHERE Now =~ ScheduleTimeRegex AND Today =~ ScheduleDayRegex AND
          log(message="Launching at time " + Now)
          
      SELECT * FROM foreach(row=schedule, query={
          SELECT * FROM Artifact.Server.Utils.DeleteMonitoringData(ArtifactRegex=ArtifactRegex, DateBefore=(now() - 60*60*24*DaysOld), ReallyDoIt=true)
      })