Skip to content

Commit 8fbe26f

Browse files
silverhacksilverhack
committed
updated collectors
1 parent a1860c9 commit 8fbe26f

File tree

108 files changed

+2175
-118
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+2175
-118
lines changed

‎collectors/entraid/entraidportal/authentication/Get-MonkeyADPasswordResetPolicy.ps1‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ function Get-MonkeyADPasswordResetPolicy {
7070

7171
);
7272
enabled = $true;
73-
supportClientCredential = $true
73+
supportClientCredential = $false
7474
}
7575
#Get Azure Active Directory Auth
7676
$AADAuth = $O365Object.auth_tokens.AzurePortal
@@ -80,14 +80,14 @@ function Get-MonkeyADPasswordResetPolicy {
8080
MessageData = ($message.MonkeyGenericTaskMessage -f $collectorId,"Microsoft Entra ID password reset policy",$O365Object.TenantID);
8181
callStack = (Get-PSCallStack | Select-Object -First 1);
8282
logLevel = 'info';
83-
InformationAction = $InformationAction;
83+
InformationAction = $O365Object.InformationAction;
8484
Tags = @('AzurePortalSSPRPolicy');
8585
}
8686
Write-Information @msg
8787
#Query
8888
$params = @{
8989
Authentication = $AADAuth;
90-
Query = 'PasswordReset/PasswordResetPolicies';
90+
Query = 'PasswordReset/PasswordResetPolicies?getPasswordResetEnabledGroup=true';
9191
Environment = $Environment;
9292
ContentType = 'application/json';
9393
Method = "GET";

‎collectors/entraid/msgraph/audit/Get-MonkeyAADAudit.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ function Get-MonkeyAADAudit {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADAudit";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraAuditLog';
56+
immutableProperties = @(
57+
'id'
58+
);
5559
description = "Collector to get audit logs from Microsoft Entra ID";
5660
Group = @(
5761
"EntraID"

‎collectors/entraid/msgraph/directoryroles/Get-MonkeyAADDirectoryRole.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ function Get-MonkeyAADDirectoryRole {
5353
resourceName = $null;
5454
collectorName = "Get-MonkeyAADDirectoryRole";
5555
ApiType = "MSGraph";
56+
objectType = 'EntraDirectoryRole';
57+
immutableProperties = @(
58+
'id',
59+
'displayName'
60+
);
5661
description = "Collector to get Directoryroles from Microsoft Entra ID";
5762
Group = @(
5863
"EntraID"

‎collectors/entraid/msgraph/domain/Get-MonkeyAADDomain.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ function Get-MonkeyAADDomain {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADDomain";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraDomain';
56+
immutableProperties = @(
57+
'id'
58+
);
5559
description = "Collector to get information about domain from Microsoft Entra ID";
5660
Group = @(
5761
"EntraID"

‎collectors/entraid/msgraph/externalCollaboration/Get-MonkeyAADExternalCollaboration.ps1‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ function Get-MonkeyAADExternalCollaboration {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADExternalCollaboration";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraExternalCollaborationSettings';
56+
immutableProperties = @(
57+
'id',
58+
'displayName'
59+
);
5560
description = "Collector to get information about external collaboration from Microsoft Entra ID";
5661
Group = @(
5762
"EntraID"
@@ -63,7 +68,8 @@ function Get-MonkeyAADExternalCollaboration {
6368
"https://silverhack.github.io/monkey365/"
6469
);
6570
ruleSuffixes = @(
66-
"aad_domains"
71+
"aad_cross_tenant_accessPolicy",
72+
"aad_external_collaboration_settings"
6773
);
6874
dependsOn = @(
6975

‎collectors/entraid/msgraph/general/Get-MonkeyAADAppAndService.ps1‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# Monkey365 - the PowerShell Cloud Security Tool for Azure and Microsoft 365 (copyright 2022) by Juan Garrido
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
16+
function Get-MonkeyAADAppAndService {
17+
<#
18+
.SYNOPSIS
19+
Collector to get properties and relationships of a adminAppsAndServices object
20+
21+
.DESCRIPTION
22+
Collector to get properties and relationships of a adminAppsAndServices object
23+
24+
.INPUTS
25+
26+
.OUTPUTS
27+
28+
.EXAMPLE
29+
30+
.NOTES
31+
Author : Juan Garrido
32+
Twitter : @tr1ana
33+
File Name : Get-MonkeyAADAppAndService
34+
Version : 1.0
35+
36+
.LINK
37+
https://github.com/silverhack/monkey365
38+
#>
39+
40+
[CmdletBinding()]
41+
param(
42+
[Parameter(Mandatory = $false,HelpMessage = "Background Collector ID")]
43+
[string]$collectorId
44+
)
45+
begin {
46+
#Collector metadata
47+
$monkey_metadata = @{
48+
Id = "aad0046";
49+
Provider = "EntraID";
50+
Resource = "EntraID";
51+
ResourceType = $null;
52+
resourceName = $null;
53+
collectorName = "Get-MonkeyAADAppAndService";
54+
ApiType = "MSGraph";
55+
objectType = 'EntraAppAndService';
56+
immutableProperties = @(
57+
'@odata.context'
58+
);
59+
description = "Collector to get properties and relationships of a adminAppsAndServices object";
60+
Group = @(
61+
"EntraID"
62+
);
63+
Tags = @(
64+
65+
);
66+
references = @(
67+
"https://silverhack.github.io/monkey365/"
68+
);
69+
ruleSuffixes = @(
70+
"aad_app_and_services"
71+
);
72+
dependsOn = @(
73+
74+
);
75+
enabled = $true;
76+
supportClientCredential = $true
77+
}
78+
$settings = $null
79+
}
80+
process {
81+
$msg = @{
82+
MessageData = ($message.MonkeyGenericTaskMessage -f $collectorId,"Microsoft Entra ID App And Services",$O365Object.TenantID);
83+
callStack = (Get-PSCallStack | Select-Object -First 1);
84+
logLevel = 'info';
85+
InformationAction = $O365Object.InformationAction;
86+
Tags = @('EntraIDInfo');
87+
}
88+
Write-Information @msg
89+
$p = @{
90+
APIVersion = 'beta';
91+
InformationAction = $O365Object.InformationAction;
92+
Verbose = $O365Object.Verbose;
93+
Debug = $O365Object.Debug;
94+
}
95+
$settings = Get-MonkeyMSGraphAppAndService @p
96+
}
97+
End {
98+
If ($null -ne $settings) {
99+
$settings.PSObject.TypeNames.Insert(0,'Monkey365.EntraID.AppServices')
100+
[pscustomobject]$obj = @{
101+
Data = $settings;
102+
Metadata = $monkey_metadata;
103+
}
104+
$returnData.aad_app_and_services = $obj;
105+
}
106+
Else {
107+
$msg = @{
108+
MessageData = ($message.MonkeyEmptyResponseMessage -f "Microsoft Entra ID App And Services",$O365Object.TenantID);
109+
callStack = (Get-PSCallStack | Select-Object -First 1);
110+
logLevel = "verbose";
111+
InformationAction = $O365Object.InformationAction;
112+
Verbose = $O365Object.Verbose;
113+
Tags = @('EntraIDEmptyResponse')
114+
}
115+
Write-Verbose @msg
116+
}
117+
}
118+
}
119+
120+
121+
122+
123+
124+
125+
126+
127+

‎collectors/entraid/msgraph/general/Get-MonkeyAADSetting.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ function Get-MonkeyAADSetting {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADSetting";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraSettings';
56+
immutableProperties = @(
57+
'id',
58+
'displayName'
59+
);
5560
description = "Collector to get settings from Microsoft Entra ID";
5661
Group = @(
5762
"EntraID"

‎collectors/entraid/msgraph/groups/Get-MonkeyAADGroup.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ function Get-MonkeyAADGroup {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADGroup";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraGroup';
56+
immutableProperties = @(
57+
'id'
58+
);
5559
description = "Collector to get information about groups from Microsoft Entra ID";
5660
Group = @(
5761
"EntraID"

‎collectors/entraid/msgraph/groups/Get-MonkeyAADGroupSetting.ps1‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
# Monkey365 - the PowerShell Cloud Security Tool for Azure and Microsoft 365 (copyright 2022) by Juan Garrido
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
16+
function Get-MonkeyAADGroupSetting {
17+
<#
18+
.SYNOPSIS
19+
Collector to get information about group settings from Microsoft Entra ID
20+
21+
.DESCRIPTION
22+
Collector to get information about group settings from Microsoft Entra ID
23+
24+
.INPUTS
25+
26+
.OUTPUTS
27+
28+
.EXAMPLE
29+
30+
.NOTES
31+
Author : Juan Garrido
32+
Twitter : @tr1ana
33+
File Name : Get-MonkeyAADGroupSetting
34+
Version : 1.0
35+
36+
.LINK
37+
https://github.com/silverhack/monkey365
38+
#>
39+
40+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseDeclaredVarsMoreThanAssignments","",Scope = "Function")]
41+
[CmdletBinding()]
42+
param(
43+
[Parameter(Mandatory = $false,HelpMessage = "Background Collector ID")]
44+
[string]$collectorId
45+
)
46+
begin {
47+
#Collector metadata
48+
$monkey_metadata = @{
49+
Id = "aad0003";
50+
Provider = "EntraID";
51+
Resource = "EntraID";
52+
ResourceType = $null;
53+
resourceName = $null;
54+
collectorName = "Get-MonkeyAADGroupSetting";
55+
ApiType = "MSGraph";
56+
objectType = 'EntraGroup';
57+
immutableProperties = @(
58+
'id'
59+
);
60+
description = "Collector to get information about group settings from Microsoft Entra ID";
61+
Group = @(
62+
"EntraID"
63+
);
64+
Tags = @(
65+
66+
);
67+
references = @(
68+
"https://silverhack.github.io/monkey365/"
69+
);
70+
ruleSuffixes = @(
71+
"aad_group_settings"
72+
);
73+
dependsOn = @(
74+
75+
);
76+
enabled = $true;
77+
supportClientCredential = $true
78+
}
79+
#Get Config
80+
try {
81+
$aadConf = $O365Object.internal_config.entraId.Provider.msgraph
82+
}
83+
catch {
84+
$msg = @{
85+
MessageData = ($message.MonkeyInternalConfigError);
86+
callStack = (Get-PSCallStack | Select-Object -First 1);
87+
logLevel = 'verbose';
88+
InformationAction = $O365Object.InformationAction;
89+
Tags = @('Monkey365ConfigError');
90+
}
91+
Write-Verbose @msg
92+
break
93+
}
94+
$group_settings = $null
95+
}
96+
process {
97+
$msg = @{
98+
MessageData = ($message.MonkeyGenericTaskMessage -f $collectorId,"Microsoft Entra ID Group settings",$O365Object.TenantID);
99+
callStack = (Get-PSCallStack | Select-Object -First 1);
100+
logLevel = 'info';
101+
InformationAction = $O365Object.InformationAction;
102+
Tags = @('EntraIDGroupSettings');
103+
}
104+
Write-Information @msg
105+
# Resource is not found in beta version
106+
$p = @{
107+
APIVersion = 'v1.0';
108+
InformationAction = $O365Object.InformationAction;
109+
Verbose = $O365Object.Verbose;
110+
Debug = $O365Object.Debug;
111+
}
112+
$group_settings = Get-MonkeyMSGraphGroupSetting @p
113+
}
114+
end {
115+
if ($null -ne $group_settings) {
116+
$group_settings.PSObject.TypeNames.Insert(0,'Monkey365.EntraID.GroupSettings')
117+
[pscustomobject]$obj = @{
118+
Data = $group_settings;
119+
Metadata = $monkey_metadata;
120+
}
121+
$returnData.aad_group_settings = $obj;
122+
}
123+
else {
124+
$msg = @{
125+
MessageData = ($message.MonkeyEmptyResponseMessage -f "Microsoft Entra ID Group settings",$O365Object.TenantID);
126+
callStack = (Get-PSCallStack | Select-Object -First 1);
127+
logLevel = "verbose";
128+
InformationAction = $O365Object.InformationAction;
129+
Verbose = $O365Object.Verbose;
130+
Tags = @('EntraIDGroupSettingsEmptyResponse')
131+
}
132+
Write-Verbose @msg
133+
}
134+
}
135+
}
136+
137+
138+
139+
140+
141+
142+
143+
144+

‎collectors/entraid/msgraph/identity/Get-MonkeyAADIdentityProtectionNotification.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ function Get-MonkeyAADIdentityProtectionNotification {
5252
resourceName = $null;
5353
collectorName = "Get-MonkeyAADIdentityProtectionNotification";
5454
ApiType = "MSGraph";
55+
objectType = 'EntraIdentityProtectionNotification';
56+
immutableProperties = @(
57+
'@odata.context'
58+
);
5559
description = "Collector to get notification settings for Entra ID Identity Protection";
5660
Group = @(
5761
"EntraID"

0 commit comments

Comments
 (0)