-
Notifications
You must be signed in to change notification settings - Fork 120
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #158 from T0pCyber/bugfix/157-bug-multiple-failed-…
…tests-after-fixing-workflow Bugfix/157 bug multiple failed tests after fixing workflow
- Loading branch information
Showing
14 changed files
with
254 additions
and
183 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| Function Get-HawkTenantEDiscoveryLog { | ||
| <# | ||
| .SYNOPSIS | ||
| Gets Unified Audit Logs (UAL) data for eDiscovery | ||
| .DESCRIPTION | ||
| Searches the Unified Audit Log (UAL) for eDiscovery events and activities. | ||
| This includes searches, exports, and management activities related to | ||
| eDiscovery cases. The function checks for any eDiscovery activities within | ||
| the timeframe specified in the Hawk global configuration object. | ||
| The results can help identify: | ||
| * When eDiscovery searches were performed | ||
| * Who performed eDiscovery activities | ||
| * Which cases were accessed or modified | ||
| * What operations were performed | ||
| .EXAMPLE | ||
| Get-HawkTenantEDiscoveryLog | ||
| This will search for all eDiscovery-related activities in the Unified Audit Log | ||
| for the configured time period and export the results to CSV format. | ||
| .EXAMPLE | ||
| $logs = Get-HawkTenantEDiscoveryLog | ||
| $logs | Where-Object {$_.Operation -eq "SearchCreated"} | ||
| This example shows how to retrieve eDiscovery logs and filter for specific | ||
| operations like new search creation. | ||
| .OUTPUTS | ||
| File: eDiscoveryLogs.csv | ||
| Path: \Tenant | ||
| Description: Contains all eDiscovery activities found in the UAL with fields for: | ||
| - CreationTime: When the activity occurred | ||
| - Id: Unique identifier for the activity | ||
| - Operation: Type of eDiscovery action performed | ||
| - Workload: The workload where the activity occurred | ||
| - UserID: User who performed the action | ||
| - Case: eDiscovery case name | ||
| - CaseId: Unique identifier for the eDiscovery case | ||
| - Cmdlet: Command that was executed (if applicable) | ||
| #> | ||
| # Search UAL audit logs for any Domain configuration changes | ||
| Test-EXOConnection | ||
| Send-AIEvent -Event "CmdRun" | ||
|
|
||
| Out-LogFile "Gathering any eDiscovery logs" -action | ||
|
|
||
| # Search UAL audit logs for any Domain configuration changes | ||
| $eDiscoveryLogs = Get-AllUnifiedAuditLogEntry -UnifiedSearch ("Search-UnifiedAuditLog -RecordType 'Discovery'") | ||
| # If null we found no changes to nothing to do here | ||
| if ($null -eq $eDiscoveryLogs) { | ||
| Out-LogFile "No eDiscovery Logs found" | ||
| } | ||
|
|
||
| # If not null then we must have found some events so flag them | ||
| else { | ||
| Out-LogFile "eDiscovery Log have been found." -Notice | ||
| Out-LogFile "Please review these eDiscoveryLogs.csv to validate the activity is legitimate." -Notice | ||
| # Go thru each even and prepare it to output to CSV | ||
| Foreach ($log in $eDiscoveryLogs) { | ||
| $log1 = $log.auditdata | ConvertFrom-Json | ||
| $report = $log1 | Select-Object -Property CreationTime, | ||
| Id, | ||
| Operation, | ||
| Workload, | ||
| UserID, | ||
| Case, | ||
| @{Name = 'CaseID'; Expression = { ($_.ExtendedProperties | Where-Object { $_.Name -eq 'CaseId' }).value } }, | ||
| @{Name = 'Cmdlet'; Expression = { ($_.Parameters | Where-Object { $_.Name -eq 'Cmdlet' }).value } } | ||
|
|
||
| $report | Out-MultipleFileType -fileprefix "eDiscoveryLogs" -csv -append | ||
| } | ||
|
|
||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
117 changes: 78 additions & 39 deletions
117
Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,64 +1,103 @@ | ||
| Function Start-HawkTenantInvestigation { | ||
| <# | ||
| <# | ||
| .SYNOPSIS | ||
| Gathers common data about a tenant. | ||
| Gathers common data about a tenant. | ||
| .DESCRIPTION | ||
| Runs all Hawk Basic tenant related cmdlets and gathers the data. | ||
| Cmdlet Information Gathered | ||
| ------------------------- ------------------------- | ||
| Get-HawkTenantConfigurationn Basic Tenant information | ||
| Get-HawkTenantEDiscoveryConfiguration Looks for changes to ediscovery configuration | ||
| Search-HawkTenantEXOAuditLog Searches the EXO audit log for activity | ||
| Get-HawkTenantRBACChanges Looks for changes to Roles Based Access Control | ||
| .OUTPUTS | ||
| See help from individual cmdlets for output list. | ||
| All outputs are placed in the $Hawk.FilePath directory | ||
| Runs all Hawk Basic tenant related cmdlets and gathers data about the tenant's configuration, | ||
| security settings, and audit logs. This comprehensive investigation helps identify potential | ||
| security issues and configuration changes. | ||
| .PARAMETER Confirm | ||
| Prompts for confirmation before running operations that could modify system state. | ||
| .PARAMETER WhatIf | ||
| Shows what would happen if the command runs. The command is not run. | ||
| .EXAMPLE | ||
| PS C:\> Start-HawkTenantInvestigation | ||
| Runs a complete tenant investigation, gathering all available data. | ||
| .EXAMPLE | ||
| Start-HawkTenantInvestigation | ||
| PS C:\> Start-HawkTenantInvestigation -WhatIf | ||
| Shows what data gathering operations would be performed without executing them. | ||
| R uns all of the tenant investigation cmdlets. | ||
| .EXAMPLE | ||
| PS C:\> Start-HawkTenantInvestigation -Confirm | ||
| Prompts for confirmation before running each data gathering operation. | ||
| .OUTPUTS | ||
| Various CSV, JSON, and XML files containing investigation results. | ||
| See help from individual cmdlets for specific output details. | ||
| All outputs are placed in the $Hawk.FilePath directory. | ||
| #> | ||
| [CmdletBinding(SupportsShouldProcess)] | ||
| param() | ||
|
|
||
| if ([string]::IsNullOrEmpty($Hawk.FilePath)) { | ||
| Initialize-HawkGlobalObject | ||
| } | ||
|
|
||
| Out-LogFile "Starting Tenant Sweep" -action | ||
| Send-AIEvent -Event "CmdRun" | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantConfiguration" -action | ||
| Get-HawkTenantConfiguration | ||
| # Wrap operations in ShouldProcess checks | ||
| if ($PSCmdlet.ShouldProcess("Tenant Configuration", "Get configuration data")) { | ||
| Out-LogFile "Running Get-HawkTenantConfiguration" -action | ||
| Get-HawkTenantConfiguration | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEDiscoveryConfiguration" -action | ||
| Get-HawkTenantEDiscoveryConfiguration | ||
| if ($PSCmdlet.ShouldProcess("EDiscovery Configuration", "Get eDiscovery configuration")) { | ||
| Out-LogFile "Running Get-HawkTenantEDiscoveryConfiguration" -action | ||
| Get-HawkTenantEDiscoveryConfiguration | ||
| } | ||
|
|
||
| Out-LogFile "Running Search-HawkTenantEXOAuditLog" -action | ||
| Search-HawkTenantEXOAuditLog | ||
| if ($PSCmdlet.ShouldProcess("Exchange Audit Log", "Search audit logs")) { | ||
| Out-LogFile "Running Search-HawkTenantEXOAuditLog" -action | ||
| Search-HawkTenantEXOAuditLog | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEDiscoveryLogs" | ||
| Get-HawkTenantEDiscoveryLogs -action | ||
| if ($PSCmdlet.ShouldProcess("EDiscovery Logs", "Get eDiscovery logs")) { | ||
| Out-LogFile "Running Get-HawkTenantEDiscoveryLogs" -action | ||
| Get-HawkTenantEDiscoveryLogs | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantDomainActivity" -action | ||
| Get-HawkTenantDomainActivity | ||
| if ($PSCmdlet.ShouldProcess("Domain Activity", "Get domain activity")) { | ||
| Out-LogFile "Running Get-HawkTenantDomainActivity" -action | ||
| Get-HawkTenantDomainActivity | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantRBACChanges" -action | ||
| Get-HawkTenantRBACChanges | ||
| if ($PSCmdlet.ShouldProcess("RBAC Changes", "Get RBAC changes")) { | ||
| Out-LogFile "Running Get-HawkTenantRBACChanges" -action | ||
| Get-HawkTenantRBACChanges | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAzureAppAuditLog" -action | ||
| Get-HawkTenantAzureAppAuditLog | ||
| if ($PSCmdlet.ShouldProcess("Azure App Audit Log", "Get app audit logs")) { | ||
| Out-LogFile "Running Get-HawkTenantAzureAppAuditLog" -action | ||
| Get-HawkTenantAzureAppAuditLog | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEXOAdmins" -action | ||
| Get-HawkTenantEXOAdmins | ||
| if ($PSCmdlet.ShouldProcess("Exchange Admins", "Get Exchange admin list")) { | ||
| Out-LogFile "Running Get-HawkTenantEXOAdmins" -action | ||
| Get-HawkTenantEXOAdmins | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantConsentGrants" -action | ||
| Get-HawkTenantConsentGrants | ||
| if ($PSCmdlet.ShouldProcess("Consent Grants", "Get consent grants")) { | ||
| Out-LogFile "Running Get-HawkTenantConsentGrants" -action | ||
| Get-HawkTenantConsentGrants | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAZAdmins" -action | ||
| Get-HawkTenantAZAdmins | ||
| if ($PSCmdlet.ShouldProcess("Azure Admins", "Get Azure admin list")) { | ||
| Out-LogFile "Running Get-HawkTenantAZAdmins" -action | ||
| Get-HawkTenantAZAdmins | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAppAndSPNCredentialDetails" -action | ||
| Get-HawkTenantAppAndSPNCredentialDetails | ||
| if ($PSCmdlet.ShouldProcess("App and SPN Credentials", "Get credential details")) { | ||
| Out-LogFile "Running Get-HawkTenantAppAndSPNCredentialDetails" -action | ||
| Get-HawkTenantAppAndSPNCredentialDetails | ||
| } | ||
|
|
||
| Out-Logfile "Running Get-HawkTenantAzureADUsers" -action | ||
| Get-HawkTenantAzureADUsers | ||
| if ($PSCmdlet.ShouldProcess("Azure AD Users", "Get Azure AD user list")) { | ||
| Out-LogFile "Running Get-HawkTenantAzureADUsers" -action | ||
| Get-HawkTenantAzureADUsers | ||
| } | ||
| } |
Oops, something went wrong.