Skip to content

Commit f94dd19

Browse files
EmilienCourtEmilienCourt
EmilienCourt
authored and
EmilienCourt
committed
Files are written in .psm1 instead of calling functions. This changes case somehow
1 parent 700b70d commit f94dd19

File tree

5 files changed

+46
-50
lines changed

5 files changed

+46
-50
lines changed

‎DFIR-O365RC/DFIR-O365RC.psd1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
RootModule = '.\DFIR-O365RC.psm1'
88

99
# Version number of this module.
10-
ModuleVersion = '2.2.1'
10+
ModuleVersion = '2.2.2'
1111

1212
# Supported PSEditions
1313
CompatiblePSEditions = 'Core', 'Desktop'
@@ -110,6 +110,7 @@
110110
2.1.0 - Add Get-AADUsers
111111
2.2.0 - Get Purview results using Graph instead of PowerShell. Use ToJsonString() to fix case. Recover deleted items
112112
2.2.1 - Fix PSGallery CI
113+
2.2.1 - Files are now written in the function where they are collected. This will change case somehow.
113114
'
114115
} # End of PSData hashtable
115116
} # End of PrivateData hashtable

‎DFIR-O365RC/DFIR-O365RC.psm1‎

Lines changed: 38 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -472,7 +472,9 @@ function Get-AzDevOpsAuditLogs {
472472
[Parameter(Mandatory = $true)]
473473
[String]$uri,
474474
[Parameter(Mandatory = $true)]
475-
[String]$logFile
475+
[String]$logFile,
476+
[Parameter(Mandatory = $true)]
477+
[String]$outputFile
476478
)
477479
try {
478480
$token = Get-AzAccessToken -ResourceUrl "499b84ac-1321-427f-aa17-267ca6975798" -AsSecureString:$false -ErrorAction Stop
@@ -562,7 +564,15 @@ function Get-AzDevOpsAuditLogs {
562564
else {
563565
"No events to dump from Azure DevOps URI $($uri)" | Write-Log -LogPath $logFile
564566
}
565-
return $APIresults
567+
568+
if ($APIresults){
569+
$nbAPIresults = ($APIresults | Measure-Object).Count
570+
"Dumping $($nbAPIresults) Azure DevOps activity logs events to $($outputFile)" | Write-Log -LogPath $logFile
571+
$APIresults | ConvertTo-Json -Depth 99 | Out-File $outputFile -Encoding UTF8
572+
}
573+
else {
574+
"No Azure DevOps activity logs event to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
575+
}
566576
}
567577

568578
function Get-MgPurviewAuditLog {
@@ -780,7 +790,9 @@ function Get-MicrosoftGraphLogs {
780790
[Parameter(Mandatory = $true)]
781791
[String]$tenant,
782792
[Parameter(Mandatory = $true)]
783-
[String]$logFile
793+
[String]$logFile,
794+
[Parameter(Mandatory = $true)]
795+
[String]$outputFile
784796
)
785797
$stopLoop = $false
786798
[Int]$retryCount = "0"
@@ -817,7 +829,14 @@ function Get-MicrosoftGraphLogs {
817829
}
818830
}
819831
} while ($stopLoop -eq $false)
820-
return $AzureADEvents
832+
if ($AzureADEvents -ne $null){
833+
$AzureADEventsCount = ($AzureADEvents | Measure-Object).Count
834+
"Dumping $($AzureADEventsCount) Entra ID $($type) events to $($outputFile)" | Write-Log -LogPath $logFile
835+
$AzureADEvents | ConvertTo-Json -Depth 99 | Out-File $outputFile -Encoding UTF8
836+
}
837+
else {
838+
"No Entra ID $($type) events to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
839+
}
821840
}
822841

823842
function Get-AzureRMActivityLog {
@@ -838,7 +857,9 @@ function Get-AzureRMActivityLog {
838857
[Parameter(Mandatory = $true)]
839858
[String]$tenant,
840859
[Parameter(Mandatory = $true)]
841-
[String]$logFile
860+
[String]$logFile,
861+
[Parameter(Mandatory = $true)]
862+
[String]$outputFile
842863
)
843864
$stopLoop = $false
844865
[Int]$retryCount = "0"
@@ -862,7 +883,18 @@ function Get-AzureRMActivityLog {
862883
}
863884
}
864885
} while ($stopLoop -eq $false)
865-
return $azureRMActivityEvents
886+
if ($azureRMActivityEvents){
887+
$nbAzureRMActivityEvents = ($azureRMActivityEvents | Measure-Object).Count
888+
"Dumping $($nbAzureRMActivityEvents) Azure Resource Manager activity logs events to $($outputFile)" | Write-Log -LogPath $logFile
889+
for ($i=0; $i -lt $nbAzureRMActivityEvents; $i++){
890+
# we can't use ConvertTo-Json, cf. https://github.com/Azure/azure-powershell/issues/11353
891+
$azureRMActivityEvents[$i] = [Newtonsoft.Json.JsonConvert]::SerializeObject($azureRMActivityEvents[$i])
892+
}
893+
$azureRMActivityEvents | Out-File $outputFile -Encoding UTF8
894+
}
895+
else {
896+
"No Azure Resource Manager activity logs event to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
897+
}
866898
}
867899

868900
function Get-UnifiedAuditLogPurview {

‎DFIR-O365RC/Get-AADLogs.ps1‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -94,15 +94,7 @@ function Get-AADLogs {
9494
$outputFile = $AzureADAuditFolder + "\AADAuditLog_" + $tenant + "_" + $outputdate + ".json"
9595
$auditStart = "{0:s}" -f $newStartDate + "Z"
9696
$auditEnd = "{0:s}" -f $newEndDate + "Z"
97-
$AzureADAuditEvents = Get-MicrosoftGraphLogs -type "AuditLogs" -dateStart $auditStart -dateEnd $auditEnd -certificate $cert -appId $appId -tenant $tenant -logFile $logFile
98-
if ($AzureADAuditEvents){
99-
$nbAzureADAuditEvents = ($AzureADAuditEvents | Measure-Object).Count
100-
"Dumping $($nbAzureADAuditEvents) Entra ID audit events to $($outputFile)" | Write-Log -LogPath $logFile
101-
$AzureADAuditEvents | ConvertTo-Json -Depth 99 | Out-File $outputFile -Encoding UTF8
102-
}
103-
else {
104-
"No Entra ID audit event to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
105-
}
97+
Get-MicrosoftGraphLogs -type "AuditLogs" -dateStart $auditStart -dateEnd $auditEnd -certificate $cert -appId $appId -tenant $tenant -logFile $logFile -outputFile $outputFile
10698
}
10799

108100
# Get Entra ID sign in logs
@@ -136,20 +128,13 @@ function Get-AADLogs {
136128

137129
$signInsStart = "{0:s}" -f $newStartHour + "Z"
138130
$signInsEnd = "{0:s}" -f $newEndHour + "Z"
139-
$AzureADSignInEvents = Get-MicrosoftGraphLogs -type "SignIns" -tenantSize $tenantSize -dateStart $signInsStart -dateEnd $signInsEnd -certificate $cert -appId $appId -tenant $tenant -logFile $logFile
140131
$folderToProcess = $AzureADSignInsFolder + "\" + $dateToProcess
141132
if ((Test-Path $folderToProcess) -eq $false){
142133
New-Item $folderToProcess -Type Directory
143134
}
144135
$outputFile = $folderToProcess + "\AADSigninLog_" + $tenant + "_" + $outputdate + ".json"
145-
if ($AzureADSignInEvents){
146-
$nbADSigninEvents = ($AzureADSignInEvents | Measure-Object).Count
147-
"Dumping $($nbADSigninEvents) Entra ID sign in events to $($outputFile)" | Write-Log -LogPath $logFile
148-
$AzureADSignInEvents | ConvertTo-Json -Depth 99 | Out-File $outputFile -Encoding UTF8
149-
}
150-
else {
151-
"No Entra ID sign in events to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
152-
}
136+
137+
Get-MicrosoftGraphLogs -type "SignIns" -tenantSize $tenantSize -dateStart $signInsStart -dateEnd $signInsEnd -certificate $cert -appId $appId -tenant $tenant -logFile $logFile -outputFile $outputFile
153138
}
154139
}
155140
else {

‎DFIR-O365RC/Get-AzDevOpsActivityLogs.ps1‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -143,22 +143,13 @@ function Get-AzDevOpsActivityLogs {
143143
$auditStart = "{0:s}" -f $newStartHour + "Z"
144144
$auditEnd = "{0:s}" -f $newEndhour + "Z"
145145
$uri = "https://auditservice.dev.azure.com/$($organizationName)/_apis/audit/auditlog?startTime=$($auditStart)&endTime=$($auditEnd)&api-version=7.1-preview.1"
146-
147-
$azureDevOpsActivityEvents = Get-AzDevOpsAuditLogs -certificatePath $certificatePath -certificateSecurePassword $certificateSecurePassword -needPassword $needPassword -tenant $tenant -appId $appId -uri $uri -logFile $logFile
148-
149146
$folderToProcess = $azureDevOpsActivityFolder + "\" + $dateToProcess
150147
if ((Test-Path $folderToProcess) -eq $false){
151148
New-Item $folderToProcess -Type Directory
152149
}
153150
$outputFile = $folderToProcess + "\AzDevOps_" + $tenant + "_" + $organizationName + "_" + $outputDate + ".json"
154-
if ($azureDevOpsActivityEvents){
155-
$nbAzureDevOpsActivityEvents = ($azureDevOpsActivityEvents | Measure-Object).Count
156-
"Dumping $($nbAzureDevOpsActivityEvents) Azure DevOps activity logs events to $($outputFile)" | Write-Log -LogPath $logFile
157-
$azureDevOpsActivityEvents | ConvertTo-Json -Depth 99 | Out-File $outputFile -Encoding UTF8
158-
}
159-
else {
160-
"No Azure DevOps activity logs event to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
161-
}
151+
152+
Get-AzDevOpsAuditLogs -certificatePath $certificatePath -certificateSecurePassword $certificateSecurePassword -needPassword $needPassword -tenant $tenant -appId $appId -uri $uri -logFile $logFile -outputFile $outputFile
162153
}
163154
}
164155

‎DFIR-O365RC/Get-AzRMActivityLogs.ps1‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -122,25 +122,12 @@ function Get-AzRMActivityLogs {
122122
$dateStart = "{0:s}" -f $newStartHour + "Z"
123123
$dateEnd = "{0:s}" -f $newEndHour + "Z"
124124

125-
$azureRMActivityEvents = Get-AzureRMActivityLog -dateStart $dateStart -dateEnd $dateEnd -certificatePath $certificatePath -certificateSecurePassword $certificateSecurePassword -needPassword $needPassword -appId $appId -tenant $tenant -logFile $logFile
126-
127125
$folderToProcess = $azureRMActivityFolder + "\" + $dateToProcess
128126
if ((Test-Path $folderToProcess) -eq $false){
129127
New-Item $folderToProcess -Type Directory
130128
}
131129
$outputFile = $folderToProcess + "\AzRM_" + $tenant + "_" + $subscriptionId + "_" + $outputDate + ".json"
132-
if ($azureRMActivityEvents){
133-
$nbAzureRMActivityEvents = ($azureRMActivityEvents | Measure-Object).Count
134-
"Dumping $($nbAzureRMActivityEvents) Azure Resource Manager activity logs events to $($outputFile)" | Write-Log -LogPath $logFile
135-
for ($i=0; $i -lt $nbAzureRMActivityEvents; $i++){
136-
# we can't use ConvertTo-Json, cf. https://github.com/Azure/azure-powershell/issues/11353
137-
$azureRMActivityEvents[$i] = [Newtonsoft.Json.JsonConvert]::SerializeObject($azureRMActivityEvents[$i])
138-
}
139-
$azureRMActivityEvents | Out-File $outputFile -Encoding UTF8
140-
}
141-
else {
142-
"No Azure Resource Manager activity logs event to dump to $($outputFile)" | Write-Log -LogPath $logFile -LogLevel "Warning"
143-
}
130+
Get-AzureRMActivityLog -dateStart $dateStart -dateEnd $dateEnd -certificatePath $certificatePath -certificateSecurePassword $certificateSecurePassword -needPassword $needPassword -appId $appId -tenant $tenant -logFile $logFile -outputFile $outputFile
144131
}
145132
}
146133

0 commit comments

Comments
 (0)