-
Notifications
You must be signed in to change notification settings - Fork 120
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: Add ShouldProcess support to Start-HawkTenantInvestigation
- Added CmdletBinding attribute with SupportsShouldProcess - Wrapped operations in ShouldProcess checks with descriptive messages - Added WhatIf example to help documentation - Fixed typos and inconsistent function names in comments - Fixed parameter placement in EDiscoveryLogs call - Addresses PSScriptAnalyzer warning about state-changing verbs Required for PowerShell standard practices when using Start verb.
- Loading branch information
1 parent
648aaff
commit e12627c
Showing
10 changed files
with
191 additions
and
115 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| Function Get-HawkTenantEDiscoveryLog { | ||
| <# | ||
| .SYNOPSIS | ||
| Gets Unified Audit Logs (UAL) data for eDiscovery | ||
| .DESCRIPTION | ||
| Searches the Unified Audit Log (UAL) for eDiscovery events and activities. | ||
| This includes searches, exports, and management activities related to | ||
| eDiscovery cases. The function checks for any eDiscovery activities within | ||
| the timeframe specified in the Hawk global configuration object. | ||
| The results can help identify: | ||
| * When eDiscovery searches were performed | ||
| * Who performed eDiscovery activities | ||
| * Which cases were accessed or modified | ||
| * What operations were performed | ||
| .EXAMPLE | ||
| Get-HawkTenantEDiscoveryLog | ||
| This will search for all eDiscovery-related activities in the Unified Audit Log | ||
| for the configured time period and export the results to CSV format. | ||
| .EXAMPLE | ||
| $logs = Get-HawkTenantEDiscoveryLog | ||
| $logs | Where-Object {$_.Operation -eq "SearchCreated"} | ||
| This example shows how to retrieve eDiscovery logs and filter for specific | ||
| operations like new search creation. | ||
| .OUTPUTS | ||
| File: eDiscoveryLogs.csv | ||
| Path: \Tenant | ||
| Description: Contains all eDiscovery activities found in the UAL with fields for: | ||
| - CreationTime: When the activity occurred | ||
| - Id: Unique identifier for the activity | ||
| - Operation: Type of eDiscovery action performed | ||
| - Workload: The workload where the activity occurred | ||
| - UserID: User who performed the action | ||
| - Case: eDiscovery case name | ||
| - CaseId: Unique identifier for the eDiscovery case | ||
| - Cmdlet: Command that was executed (if applicable) | ||
| #> | ||
| # Search UAL audit logs for any Domain configuration changes | ||
| Test-EXOConnection | ||
| Send-AIEvent -Event "CmdRun" | ||
|
|
||
| Out-LogFile "Gathering any eDiscovery logs" -action | ||
|
|
||
| # Search UAL audit logs for any Domain configuration changes | ||
| $eDiscoveryLogs = Get-AllUnifiedAuditLogEntry -UnifiedSearch ("Search-UnifiedAuditLog -RecordType 'Discovery'") | ||
| # If null we found no changes to nothing to do here | ||
| if ($null -eq $eDiscoveryLogs) { | ||
| Out-LogFile "No eDiscovery Logs found" | ||
| } | ||
|
|
||
| # If not null then we must have found some events so flag them | ||
| else { | ||
| Out-LogFile "eDiscovery Log have been found." -Notice | ||
| Out-LogFile "Please review these eDiscoveryLogs.csv to validate the activity is legitimate." -Notice | ||
| # Go thru each even and prepare it to output to CSV | ||
| Foreach ($log in $eDiscoveryLogs) { | ||
| $log1 = $log.auditdata | ConvertFrom-Json | ||
| $report = $log1 | Select-Object -Property CreationTime, | ||
| Id, | ||
| Operation, | ||
| Workload, | ||
| UserID, | ||
| Case, | ||
| @{Name = 'CaseID'; Expression = { ($_.ExtendedProperties | Where-Object { $_.Name -eq 'CaseId' }).value } }, | ||
| @{Name = 'Cmdlet'; Expression = { ($_.Parameters | Where-Object { $_.Name -eq 'Cmdlet' }).value } } | ||
|
|
||
| $report | Out-MultipleFileType -fileprefix "eDiscoveryLogs" -csv -append | ||
| } | ||
|
|
||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
121 changes: 77 additions & 44 deletions
121
Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,64 +1,97 @@ | ||
| Function Start-HawkTenantInvestigation { | ||
| <# | ||
| .SYNOPSIS | ||
| Gathers common data about a tenant. | ||
| .DESCRIPTION | ||
| Runs all Hawk Basic tenant related cmdlets and gathers the data. | ||
| Cmdlet Information Gathered | ||
| ------------------------- ------------------------- | ||
| Get-HawkTenantConfigurationn Basic Tenant information | ||
| Get-HawkTenantEDiscoveryConfiguration Looks for changes to ediscovery configuration | ||
| Search-HawkTenantEXOAuditLog Searches the EXO audit log for activity | ||
| Get-HawkTenantRBACChanges Looks for changes to Roles Based Access Control | ||
| .OUTPUTS | ||
| See help from individual cmdlets for output list. | ||
| All outputs are placed in the $Hawk.FilePath directory | ||
| .EXAMPLE | ||
| Start-HawkTenantInvestigation | ||
| R uns all of the tenant investigation cmdlets. | ||
| #> | ||
| [CmdletBinding(SupportsShouldProcess)] | ||
| param() | ||
|
|
||
| <# | ||
| .SYNOPSIS | ||
| Gathers common data about a tenant. | ||
| .DESCRIPTION | ||
| Runs all Hawk Basic tenant related cmdlets and gathers the data. | ||
| Cmdlet Information Gathered | ||
| ------------------------- ------------------------- | ||
| Get-HawkTenantConfigurationn Basic Tenant information | ||
| Get-HawkTenantEDiscoveryConfiguration Looks for changes to ediscovery configuration | ||
| Search-HawkTenantEXOAuditLog Searches the EXO audit log for activity | ||
| Get-HawkTenantRBACChanges Looks for changes to Roles Based Access Control | ||
| .OUTPUTS | ||
| See help from individual cmdlets for output list. | ||
| All outputs are placed in the $Hawk.FilePath directory | ||
| .EXAMPLE | ||
| Start-HawkTenantInvestigation | ||
| Runs all of the tenant investigation cmdlets. | ||
| .EXAMPLE | ||
| Start-HawkTenantInvestigation -WhatIf | ||
| Shows what actions would be performed without actually executing them. | ||
| #> | ||
|
|
||
| if ([string]::IsNullOrEmpty($Hawk.FilePath)) { | ||
| Initialize-HawkGlobalObject | ||
| } | ||
|
|
||
| Out-LogFile "Starting Tenant Sweep" -action | ||
| Send-AIEvent -Event "CmdRun" | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantConfiguration" -action | ||
| Get-HawkTenantConfiguration | ||
| # Wrap operations in ShouldProcess checks | ||
| if ($PSCmdlet.ShouldProcess("Tenant Configuration", "Get configuration data")) { | ||
| Out-LogFile "Running Get-HawkTenantConfiguration" -action | ||
| Get-HawkTenantConfiguration | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEDiscoveryConfiguration" -action | ||
| Get-HawkTenantEDiscoveryConfiguration | ||
| if ($PSCmdlet.ShouldProcess("EDiscovery Configuration", "Get eDiscovery configuration")) { | ||
| Out-LogFile "Running Get-HawkTenantEDiscoveryConfiguration" -action | ||
| Get-HawkTenantEDiscoveryConfiguration | ||
| } | ||
|
|
||
| Out-LogFile "Running Search-HawkTenantEXOAuditLog" -action | ||
| Search-HawkTenantEXOAuditLog | ||
| if ($PSCmdlet.ShouldProcess("Exchange Audit Log", "Search audit logs")) { | ||
| Out-LogFile "Running Search-HawkTenantEXOAuditLog" -action | ||
| Search-HawkTenantEXOAuditLog | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEDiscoveryLogs" | ||
| Get-HawkTenantEDiscoveryLogs -action | ||
| if ($PSCmdlet.ShouldProcess("EDiscovery Logs", "Get eDiscovery logs")) { | ||
| Out-LogFile "Running Get-HawkTenantEDiscoveryLogs" -action | ||
| Get-HawkTenantEDiscoveryLogs | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantDomainActivity" -action | ||
| Get-HawkTenantDomainActivity | ||
| if ($PSCmdlet.ShouldProcess("Domain Activity", "Get domain activity")) { | ||
| Out-LogFile "Running Get-HawkTenantDomainActivity" -action | ||
| Get-HawkTenantDomainActivity | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantRBACChanges" -action | ||
| Get-HawkTenantRBACChanges | ||
| if ($PSCmdlet.ShouldProcess("RBAC Changes", "Get RBAC changes")) { | ||
| Out-LogFile "Running Get-HawkTenantRBACChanges" -action | ||
| Get-HawkTenantRBACChanges | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAzureAppAuditLog" -action | ||
| Get-HawkTenantAzureAppAuditLog | ||
| if ($PSCmdlet.ShouldProcess("Azure App Audit Log", "Get app audit logs")) { | ||
| Out-LogFile "Running Get-HawkTenantAzureAppAuditLog" -action | ||
| Get-HawkTenantAzureAppAuditLog | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantEXOAdmins" -action | ||
| Get-HawkTenantEXOAdmins | ||
| if ($PSCmdlet.ShouldProcess("Exchange Admins", "Get Exchange admin list")) { | ||
| Out-LogFile "Running Get-HawkTenantEXOAdmins" -action | ||
| Get-HawkTenantEXOAdmins | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantConsentGrants" -action | ||
| Get-HawkTenantConsentGrants | ||
| if ($PSCmdlet.ShouldProcess("Consent Grants", "Get consent grants")) { | ||
| Out-LogFile "Running Get-HawkTenantConsentGrants" -action | ||
| Get-HawkTenantConsentGrants | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAZAdmins" -action | ||
| Get-HawkTenantAZAdmins | ||
| if ($PSCmdlet.ShouldProcess("Azure Admins", "Get Azure admin list")) { | ||
| Out-LogFile "Running Get-HawkTenantAZAdmins" -action | ||
| Get-HawkTenantAZAdmins | ||
| } | ||
|
|
||
| Out-LogFile "Running Get-HawkTenantAppAndSPNCredentialDetails" -action | ||
| Get-HawkTenantAppAndSPNCredentialDetails | ||
| if ($PSCmdlet.ShouldProcess("App and SPN Credentials", "Get credential details")) { | ||
| Out-LogFile "Running Get-HawkTenantAppAndSPNCredentialDetails" -action | ||
| Get-HawkTenantAppAndSPNCredentialDetails | ||
| } | ||
|
|
||
| Out-Logfile "Running Get-HawkTenantAzureADUsers" -action | ||
| Get-HawkTenantAzureADUsers | ||
| if ($PSCmdlet.ShouldProcess("Azure AD Users", "Get Azure AD user list")) { | ||
| Out-LogFile "Running Get-HawkTenantAzureADUsers" -action | ||
| Get-HawkTenantAzureADUsers | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.