PowerShell

Elastio.psm1 is a single-file reference module for Windows PowerShell 5.1 and PowerShell 7+. It stores your tenant and token for the session, turns gateway errors into readable exceptions, retries transient failures and streams paginated lists to the pipeline.

Install

Download Elastio.psm1:

Invoke-WebRequest -Uri https://developer.elastio.com/downloads/Elastio.psm1 -OutFile ./Elastio.psm1

Import it into your session:
Terminal window
```
Import-Module ./Elastio.psm1
Get-Command -Module Elastio
```
On Windows, if your execution policy blocks downloaded scripts, review the file and then run Unblock-File ./Elastio.psm1.

To load it automatically, copy it to a folder named Elastio under one of the paths in $env:PSModulePath and use Import-Module Elastio.

Connect

Connect-Elastio takes your console subdomain and a personal access token as a SecureString. Without -Token it reads $env:ELASTIO_TOKEN.

# Prompt for the token
Connect-Elastio -Tenant acme -Token (Read-Host -AsSecureString 'Elastio token')

# Or use the environment variable
$env:ELASTIO_TOKEN = '…'
Connect-Elastio -Tenant acme

Parameter	Default	What it does
`-Tenant`	None	Console subdomain. `acme` → `https://acme.app.elastio.com`.
`-BaseUrl`	None	Use instead of `-Tenant` to point at another host, for example a proxy.
`-Token`	`$env:ELASTIO_TOKEN`	Personal access token as a `SecureString`.
`-TimeoutSec`	`30`	Per-request timeout.
`-MaxRetries`	`3`	Retries for `GET`, `PUT` and `DELETE` after a 5xx response or connection error. `POST` and `PATCH` are never retried.

Run Disconnect-Elastio to clear the stored token.

Make requests

Invoke-ElastioRequest takes -Method (default GET), -Path, an optional -Query hashtable and an optional -Body. Hashtables and objects are sent as JSON. It returns the parsed response.

GET

/gateway/api/v2/incidentsList retained incident episodes

Try it

$page = Invoke-ElastioRequest -Path /gateway/api/v2/incidents -Query @{ status = 'open'; severity = 'critical,high'; limit = 50 }
"$($page.total) open incidents"
$page.data | Select-Object handle, status, opened_at, @{ n = 'severity'; e = { $_.finding.severity } }

GET

/gateway/integration/v1/slack/{slack_id}/channelsList the workspace's channels

Try it

$slackId = '3f8d2a6c-1b4e-4c7a-9e2d-7a5b1c9f0e43'
Invoke-ElastioRequest -Path "/gateway/integration/v1/slack/$slackId/channels" |
    Select-Object -ExpandProperty channels |
    Where-Object can_post |
    Format-Table name, id, type

Stream paginated lists

Get-ElastioPage follows pagination.next_page_token until it is empty and writes each item to the pipeline. By default it sends page_size and next_page_token and reads items from data.

GET

/gateway/api/v1/scanjobs/{scanJobId}/threatsList what a hunt found

Try it

$scanJobId = '9b2f4c1e-6d7a-4e8b-a1c3-5f0e2d4b6a71'
Get-ElastioPage -Path "/gateway/api/v1/scanjobs/$scanJobId/threats" -PageSize 100 |
    Select-Object name, kind, status, file_name, sha256 |
    Export-Csv -Path findings.csv -NoTypeInformation

For operations that nest results or name their parameters differently, set -ItemsKey, -TokenParam and -SizeParam. Unified asset search uses page_token and returns data.assets:

GET

/gateway/api/v1/search/assetsSearch unified assets across all platforms and types

Try it

Get-ElastioPage -Path /gateway/api/v1/search/assets -Query @{ health = 'infected' } `
    -ItemsKey data.assets -TokenParam page_token |
    Select-Object asset_name, asset_type, platform, region

Operations that use limit / offset are not covered by Get-ElastioPage; loop over -Query @{ limit = …; offset = … } until you have total items. See Pagination.

Handle errors

Non-2xx responses throw a terminating error whose message carries the gateway envelope (status, error, message). The parsed values are on Exception.Data:

try {
    Invoke-ElastioRequest -Path /gateway/api/v2/incidents/00000000-0000-0000-0000-000000000000
} catch {
    $_.Exception.Message               # Elastio API GET … failed: 404 Not Found: …
    $_.Exception.Data['Status']        # 404
    $_.Exception.Data['Message']
}

See Errors for what each status means.