From 0c41e1a652bf916e5e1d68dc9b108c1d4730f6c1 Mon Sep 17 00:00:00 2001
From: Jonathan Butler <xxbutler86xx@gmail.com>
Date: Mon, 13 Jan 2025 15:42:20 -0500
Subject: [PATCH] Create convert-hawkdaystodates function.

---
 .../functions/Convert-HawkDaysToDate.ps1      | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 Hawk/internal/functions/Convert-HawkDaysToDate.ps1

diff --git a/Hawk/internal/functions/Convert-HawkDaysToDate.ps1 b/Hawk/internal/functions/Convert-HawkDaysToDate.ps1
new file mode 100644
index 0000000..f4bd57c
--- /dev/null
+++ b/Hawk/internal/functions/Convert-HawkDaysToDate.ps1
@@ -0,0 +1,44 @@
+Function Convert-HawkDaysToDate {
+    <#
+    .SYNOPSIS
+        Converts the DaysToLookBack parameter into a StartDate and EndDate for use in Hawk investigations.
+
+    .DESCRIPTION
+        This function takes the number of days to look back from the current date and calculates the corresponding
+        StartDate and EndDate in UTC format. The StartDate is calculated by subtracting the specified number of days
+        from the current date, and the EndDate is set to one day in the future (to include the entire current day).
+
+    .PARAMETER DaysToLookBack
+        The number of days to look back from the current date. Must be between 1 and 365.
+
+    .OUTPUTS
+        A PSCustomObject with two properties:
+        - StartDate: The calculated start date in UTC format.
+        - EndDate: The calculated end date in UTC format (one day in the future).
+
+    .EXAMPLE
+        Convert-HawkDaysToDates -DaysToLookBack 30
+        Returns a StartDate of 30 days ago and an EndDate of tomorrow in UTC format.
+
+    .NOTES
+        This function ensures that the date range does not exceed 365 days and that the dates are properly formatted
+        for use with Hawk investigation functions.
+    #>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [ValidateRange(1, 365)]
+        [int]$DaysToLookBack
+    )
+
+    # Calculate the dates
+    $startDate = (Get-Date).ToUniversalTime().AddDays(-$DaysToLookBack).Date
+    $endDate = (Get-Date).ToUniversalTime().AddDays(1).Date
+
+    # Return the dates as a PSCustomObject
+    [PSCustomObject]@{
+        StartDate = $startDate
+        EndDate   = $endDate
+    }
+}