Skip to content

Commit 67f1bb7

Browse files
EmilienCourtEmilienCourt
EmilienCourt
authored and
EmilienCourt
committed
version 2.0.0. Reworking of the authentication and major refactoring of the code.
1 parent 69acb1f commit 67f1bb7

17 files changed

+3989
-2923
lines changed

‎DFIR-O365RC/DFIR-O365RC.psd1

+94-76
Original file line numberDiff line numberDiff line change
@@ -3,89 +3,107 @@
33
#
44

55
@{
6-
7-
# Script module or binary module file associated with this manifest.
8-
RootModule = '.\DFIR-O365RC.psm1'
9-
10-
# Version number of this module.
11-
ModuleVersion = '1.2.0'
12-
13-
# Supported PSEditions
14-
CompatiblePSEditions = 'Core', 'Desktop'
15-
16-
# ID used to uniquely identify this module
17-
GUID = '84b1ed98-447f-4d4e-aa52-fd9339cf7cca'
18-
19-
# Author of this module
20-
Author = '[email protected]'
21-
22-
# Company or vendor of this module
23-
CompanyName = 'CERT-FR'
24-
25-
# Description of the functionality provided by this module
26-
Description = 'The DFIR-O365RC module will extract logs from O365 Unified audit logs, Azure AD signin logs, Azure AD audit logs, Azure RM and DevOps activity logs'
27-
28-
29-
# Minimum version of the Windows PowerShell engine required by this module
30-
PowerShellVersion = '5.0'
31-
32-
33-
34-
# Modules that must be imported into the global environment prior to importing this module
35-
RequiredModules = @(
36-
@{ModuleName = 'PoshRSJob'; ModuleVersion = '1.7.4.4'; },
37-
@{ModuleName = 'MSAL.PS'; ModuleVersion = '4.37.0.0'; }
38-
@{ModuleName = 'ExchangeOnlineManagement'; ModuleVersion = '3.1.0'; }
6+
# Script module or binary module file associated with this manifest.
7+
RootModule = '.\DFIR-O365RC.psm1'
8+
9+
# Version number of this module.
10+
ModuleVersion = '2.0.0'
11+
12+
# Supported PSEditions
13+
CompatiblePSEditions = 'Core', 'Desktop'
14+
15+
# ID used to uniquely identify this module
16+
GUID = '84b1ed98-447f-4d4e-aa52-fd9339cf7cca'
17+
18+
# Author of this module
19+
Author = '[email protected]'
20+
21+
# Company or vendor of this module
22+
CompanyName = 'CERT-FR'
23+
24+
# Description of the functionality provided by this module
25+
Description = 'The DFIR-O365RC module will extract logs from the unified audit log (using Exchange Online and Purview), Entra ID Sign In logs, Entra ID Audit Logs, Azure Monitor and Azure DevOps activity logs'
26+
27+
# Minimum version of the Windows PowerShell engine required by this module
28+
PowerShellVersion = '5.0'
29+
30+
# Modules that must be imported into the global environment prior to importing this module
31+
RequiredModules = @(
32+
@{ModuleName = 'Az.Accounts'; ModuleVersion = '3.0.2'; }
33+
@{ModuleName = 'Az.Monitor'; ModuleVersion = '5.2.1'; }
34+
@{ModuleName = 'Az.Resources'; ModuleVersion = '7.2.0'; }
35+
@{ModuleName = 'ExchangeOnlineManagement'; ModuleVersion = '3.5.1'; }
36+
@{ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.20.0'; }
37+
@{ModuleName = 'Microsoft.Graph.Applications'; ModuleVersion = '2.20.0'; }
38+
@{ModuleName = 'Microsoft.Graph.Beta.Reports'; ModuleVersion = '2.20.0'; }
39+
@{ModuleName = 'Microsoft.Graph.Beta.Security'; ModuleVersion = '2.20.0'; }
40+
@{ModuleName = 'Microsoft.Graph.Identity.DirectoryManagement'; ModuleVersion = '2.20.0'; }
41+
@{ModuleName = 'PoshRSJob'; ModuleVersion = '1.7.4.4'; }
3942
)
4043

44+
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
45+
NestedModules = @(
46+
'Get-AADApps.ps1',
47+
'Get-AADDevices.ps1',
48+
'Get-AADLogs.ps1',
49+
'Get-AzDevOpsActivityLogs.ps1',
50+
'Get-AzRMActivityLogs.ps1',
51+
'Get-O365.ps1',
52+
'Manage-Applications.ps1'
53+
)
4154

55+
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
56+
FunctionsToExport = @(
57+
'Connect-AzApplication',
58+
'Connect-AzUser',
59+
'Connect-ExchangeOnlineApplication',
60+
'Connect-ExchangeOnlineUser',
61+
'Connect-MicrosoftGraphApplication',
62+
'Connect-MicrosoftGraphUser',
63+
'Get-AADApps',
64+
'Get-AADDevices',
65+
'Get-AADLogs',
66+
'Get-AzDevOpsActivityLogs',
67+
'Get-AzDevOpsAuditLogs',
68+
'Get-AzDevOpsRestAPIResponseUser',
69+
'Get-AzRMActivityLogs',
70+
'Get-AzureRMActivityLog',
71+
'Get-LargeUnifiedAuditLog',
72+
'Get-MailboxAuditLog',
73+
'Get-MicrosoftGraphLogs',
74+
'Get-O365Defender',
75+
'Get-O365Full',
76+
'Get-O365Light',
77+
'Get-UnifiedAuditLogPurview',
78+
'New-Application',
79+
'Remove-Application',
80+
'Import-Certificate',
81+
'Search-O365',
82+
'Update-Application',
83+
'Write-Log'
84+
)
4285

43-
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
44-
45-
NestedModules = @(
46-
'Get-O365Full.ps1',
47-
'Get-O365Light.ps1',
48-
'Get-AADApps.ps1',
49-
'Get-DefenderforO365.ps1',
50-
'Search-O365.ps1',
51-
'Get-AADDevices.ps1',
52-
'Get-AzRMActivityLogs.ps1',
53-
'Get-AzDevOpsActivityLogs.ps1',
54-
'Get-AADLogs.ps1'
55-
)
56-
57-
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
58-
FunctionsToExport = 'Get-OAuthToken', 'Get-RestAPIResponse', 'Connect-EXOPsearchUnified', 'Get-LargeUnifiedAuditLog', 'Get-MailboxAuditLog', 'Get-AADApps', 'Get-AADLogs', 'Get-O365Full', 'Get-O365Light', 'Get-DefenderforO365', 'Search-O365', 'Get-AADDevices', 'Get-AzRMActivityLogs', 'Write-Log', 'Get-AzDevOpsActivityLogs'
59-
60-
61-
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
62-
CmdletsToExport = @()
63-
64-
# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
65-
AliasesToExport = @()
66-
67-
68-
# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
69-
PrivateData = @{
70-
71-
PSData = @{
72-
73-
# Tags applied to this module. These help with module discovery in online galleries.
74-
Tags = @("O365","Security","Forensics","DFIR","Exchange","Defender","AzureAD","MSGraph","Azure", "DevOps")
75-
76-
77-
# ReleaseNotes of this module
78-
ReleaseNotes ='
79-
1.0.0 - Initial release
80-
1.1.0 - Added Get-AADDevices and Get-AzRMActivityLogs functions
81-
1.2.0 - Added Get-AzDevOpsActivityLogs function and added mailobx audit logs retrieval to the Search-o365 function
82-
'
83-
86+
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
87+
CmdletsToExport = @()
8488

85-
} # End of PSData hashtable
89+
# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
90+
AliasesToExport = @()
8691

87-
} # End of PrivateData hashtable
92+
# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
93+
PrivateData = @{
8894

95+
PSData = @{
8996

97+
# Tags applied to this module. These help with module discovery in online galleries.
98+
Tags = @("O365", "Security", "Forensics", "DFIR", "Exchange", "Defender", "AzureAD", "MSGraph", "Azure", "DevOps", "Purview", "Entra ID", "Logs")
9099

100+
# ReleaseNotes of this module
101+
ReleaseNotes = '
102+
1.0.0 - Initial release
103+
1.1.0 - Added Get-AADDevices and Get-AzRMActivityLogs functions
104+
1.2.0 - Added Get-AzDevOpsActivityLogs function and added mailobx audit logs retrieval to the Search-O365 function
105+
2.0.0 - Rework of the project: use of an application to do the log collection, instead of an authenticated user. Add Purview
106+
'
107+
} # End of PSData hashtable
108+
} # End of PrivateData hashtable
91109
}

0 commit comments

Comments
 (0)