management-scripts/Create-NewTicketFromBSODAnalysis.ps1

$BlueScreenView = $Global:MSPToolsDirectory + '\BlueScreenView.exe'
$BSODReport = $Global:OutputDirectory + '\BSODReport.txt'

# Remove existing BSOD report
If ( Test-Path $BSODReport ) { Remove-Item $BSODReport -Force -ErrorAction SilentlyContinue }

# Download BlueScreenView
If ( -not (Test-Path $BlueScreenView) ) {
    If ( Is64Bit ) { $URL = 'https://www.emberkom.com/tools/BlueScreenView-x64.exe' } Else { $URL = 'https://www.emberkom.com/tools/BlueScreenView-x86.exe' }
    Download-File -URL $URL -File $BlueScreenView
    If ( -not (Test-Path $BlueScreenView) ) { Return }
}

# Run BlueScreenView
Start-Process $BlueScreenView -ArgumentList "/stext $BSODReport /sort ~1" -Wait

# Wait for BSOD report
For ($i = 0; $i -lt 300; $i++) {
    If ( Test-Path $BSODReport ) { Break }
    Start-Sleep -Seconds 1
}

# Exit if the BSOD report was not created
If ( -not (Test-Path $BSODReport) ) { Write-Output "BSOD report was not found: ${BSODReport}" ; Return }

# Create ticket
Import-Module $env:SyncroModule -WarningAction SilentlyContinue
$BSODReportContent = Get-Content -Path $BSODReport
$TicketSubject = 'System Crash on ' + $Env:COMPUTERNAME
$TicketIssueType = 'Remote Support'
$TicketStatus = 'New'
Try {
    $TicketComment = $BSODReportContent -join "`n"
    $TicketData = Create-Syncro-Ticket -Subject $TicketSubject -IssueType $TicketIssueType -Status $TicketStatus
    $TicketID = $TicketData.ticket.id
    Create-Syncro-Ticket-Comment -TicketIdOrNumber $TicketID -Subject "Issue" -Body $TicketComment -Hidden $true -DoNotEmail $true
}
Catch { Write-Error "Error creating ticket" ; Return }

# Update the ticket
Create-Syncro-Ticket-Comment -TicketIdOrNumber $TicketID -Subject "Update" -Body "It looks like your computer crashed. I'll get this resolved as soon as possible." -Hidden $false -DoNotEmail $false

# Wait a bit
Start-Sleep -Seconds 120

# Setup providers for matching BSOD report content
$ProviderMicrosoft = 'Microsoft|Windows'

# Get the provider data from the most recent BSOD
$CulpritProvider = $BSODReportContent[12..13] -join '`n'

# Set the billable time
$BillableTimeInMinutes = 15
$StartAt = (Get-Date).AddMinutes(-$BillableTimeInMinutes).ToString("o")

Switch ( $CulpritProvider ) {
    { $_ -match $ProviderMicrosoft } {
        $TicketComment = "I've analyzed the crash report and it indicates a problem with a Windows component. I'll repair the system now."
        $TimeEntryNote = "Analysis indicates crash caused by Windows component(s). Scanning and repairing corruption in the system."
        Create-Syncro-Ticket-Comment -TicketIdOrNumber $TicketID -Subject "Update" -Body $TicketComment -Hidden $false -DoNotEmail $false
        Create-Syncro-Ticket-TimerEntry -TicketIdOrNumber $TicketID -StartTime $StartAt -DurationMinutes $BillableTimeInMinutes -Notes $TimeEntryNote -UserIdOrEmail $TimeAttributedToUser -ChargeTime "true"
        $FixWindowsHealth = Download-File -URL 'https://dev.emberkom.com/emberkom/management-scripts/raw/branch/master/Fix-WindowsHealth.ps1'
        Start-Sleep -Seconds 120
        . $FixWindowsHealth
        If ( Test-Path $FixWindowsHealth ) { Remove-Item $FixWindowsHealth -Force -ErrorAction SilentlyContinue }
    }

}