-
-
Notifications
You must be signed in to change notification settings - Fork 82
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge Output Option: Introduced a merge output flag for Azure AD Graph logs and AD logs. File Naming Correction: Corrected an issue where the .json extension was missing from the filename for AD sign-in logs, ensuring files are correctly recognized and processed by tools expecting JSON format. Option Renaming: The MergecsvOutput option has been renamed to MergeOutput to better reflect its functionality and to accommodate both CSV and JSON file formats. - Fixed bug with wrong version number in the version check.
- Loading branch information
1 parent
544efb8
commit b37a171
Showing
8 changed files
with
101 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,8 +34,8 @@ function Get-UALAll | |
| OutputDir is the parameter specifying the output directory. | ||
| Default: Output\UnifiedAuditLog | ||
| .PARAMETER MergeCSVOutput | ||
| MergeCSVOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| .PARAMETER MergeOutput | ||
| MergeOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| Default: No | ||
| .PARAMETER Encoding | ||
|
|
@@ -63,7 +63,7 @@ function Get-UALAll | |
| Gets all the unified audit log entries with a time interval of 720. | ||
| .EXAMPLE | ||
| Get-UALAll -UserIds [email protected] -MergeCSVOutput | ||
| Get-UALAll -UserIds [email protected] -MergeOutput | ||
| Gets all the unified audit log entries for the user [email protected] and adds a combined output csv file at the end of acquisition | ||
| .EXAMPLE | ||
|
|
@@ -78,7 +78,7 @@ function Get-UALAll | |
| [string]$UserIds, | ||
| [string]$Interval, | ||
| [string]$Output, | ||
| [switch]$MergeCSVOutput, | ||
| [switch]$MergeOutput, | ||
| [string]$OutputDir, | ||
| [string]$Encoding | ||
| ) | ||
|
|
@@ -228,17 +228,16 @@ function Get-UALAll | |
| } | ||
| } | ||
|
|
||
| if ($Output -eq "CSV" -and ($MergeCSVOutput.IsPresent)) | ||
| if ($Output -eq "CSV" -and ($MergeOutput.IsPresent)) | ||
| { | ||
| Write-LogFile -Message "[INFO] MergeCSVOutput set to y" | ||
| Write-LogFile -Message "[INFO] Merging output files into one file" | ||
| $outputDirMerged = "$OutputDir\Merged\" | ||
| If (!(test-path $outputDirMerged)) { | ||
| Write-LogFile -Message "[INFO] Creating the following directory: $outputDirMerged" | ||
| New-Item -ItemType Directory -Force -Path $outputDirMerged | Out-Null | ||
| } | ||
|
|
||
| Get-ChildItem $OutputDir -Filter *.csv | Select-Object -ExpandProperty FullName | Import-Csv | Export-Csv "$outputDirMerged/UAL-Combined.csv" -NoTypeInformation -Append | ||
| Write-LogFile -Message "[INFO] Merging UAL Files" -Color "Green" | ||
| } | ||
|
|
||
| Write-LogFile -Message "[INFO] Acquisition complete, check the Output directory for your files.." -Color "Green" | ||
|
|
@@ -282,8 +281,8 @@ function Get-UALGroup | |
| OutputDir is the parameter specifying the output directory. | ||
| Default: Output\UnifiedAuditLog | ||
| .PARAMETER MergeCSVOutput | ||
| MergeCSVOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| .PARAMETER MergeOutput | ||
| MergeOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| Default: No | ||
| .PARAMETER Encoding | ||
|
|
@@ -311,7 +310,7 @@ function Get-UALGroup | |
| Gets all the Defender related unified audit log entries for the user [email protected] in JSON format with a time interval of 720. | ||
| .EXAMPLE | ||
| Get-UALGroup -Group Exchange -MergeCSVOutput | ||
| Get-UALGroup -Group Exchange -MergeOutput | ||
| Gets the Azure related unified audit log entries and adds a combined output csv file at the end of acquisition | ||
| #> | ||
| [CmdletBinding()] | ||
|
|
@@ -322,7 +321,7 @@ function Get-UALGroup | |
| [string]$Interval, | ||
| [string]$Group, | ||
| [string]$Output, | ||
| [string]$MergeCSVOutput, | ||
| [string]$MergeOutput, | ||
| [string]$OutputDir, | ||
| [string]$Encoding | ||
| ) | ||
|
|
@@ -511,16 +510,16 @@ function Get-UALGroup | |
| Write-LogFile -message "[INFO] No Records found for $Record" | ||
| } | ||
| } | ||
| if ($Output -eq "CSV" -and ($MergeCSVOutput.IsPresent)) | ||
| if ($Output -eq "CSV" -and ($MergeOutput.IsPresent)) | ||
| { | ||
| Write-LogFile -Message "[INFO] Merging output files into one file" | ||
| $outputDirMerged = "$OutputDir\Merged\" | ||
| If (!(test-path $outputDirMerged)) { | ||
| Write-LogFile -Message "[INFO] Creating the following directory: $outputDirMerged" | ||
| New-Item -ItemType Directory -Force -Path $outputDirMerged | Out-Null | ||
| } | ||
|
|
||
| Get-ChildItem $OutputDir -Filter *.csv | Select-Object -ExpandProperty FullName | Import-Csv | Export-Csv "$outputDirMerged/UAL-Combined.csv" -NoTypeInformation -Append | ||
| Write-LogFile -Message "[INFO] Merging UAL Files" -Color "Green" | ||
| } | ||
|
|
||
| Write-LogFile -Message "[INFO] Acquisition complete, check the Output directory for your files.." -Color "Green" | ||
|
|
@@ -568,8 +567,8 @@ function Get-UALSpecific | |
| Encoding is the parameter specifying the encoding of the CSV/JSON output file. | ||
| Default: UTF8 | ||
| .PARAMETER MergeCSVOutput | ||
| MergeCSVOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| .PARAMETER MergeOutput | ||
| MergeOutput is the parameter specifying if you wish to merge CSV outputs to a single file | ||
| Default: No | ||
| .EXAMPLE | ||
|
|
@@ -593,7 +592,7 @@ function Get-UALSpecific | |
| Gets all the MicrosoftFlow logging from the unified audit log for the user [email protected] in JSON format with a time interval of 720. | ||
| .EXAMPLE | ||
| Get-UALSpecific -RecordType MipAutoLabelExchangeItem -MergeCSVOutput | ||
| Get-UALSpecific -RecordType MipAutoLabelExchangeItem -MergeOutput | ||
| Gets the ExchangeItem logging from the unified audit log and adds a combined output csv file at the end of acquisition | ||
| #> | ||
| [CmdletBinding()] | ||
|
|
@@ -604,7 +603,7 @@ function Get-UALSpecific | |
| [string]$Interval, | ||
| [Parameter(Mandatory=$true)]$RecordType, | ||
| [string]$Output, | ||
| [string]$MergeCSVOutput, | ||
| [string]$MergeOutput, | ||
| [string]$OutputDir, | ||
| [string]$Encoding | ||
| ) | ||
|
|
@@ -769,8 +768,9 @@ function Get-UALSpecific | |
| } | ||
| } | ||
|
|
||
| if ($Output -eq "CSV" -and ($MergeCSVOutput.IsPresent)) | ||
| if ($Output -eq "CSV" -and ($MergeOutput.IsPresent)) | ||
| { | ||
| Write-LogFile -Message "[INFO] Merging output files into one file" | ||
| $outputDirMerged = "$OutputDir\Merged\" | ||
| write-host $outputDirMerged | ||
| If (!(test-path $outputDirMerged)) { | ||
|
|
@@ -779,7 +779,6 @@ function Get-UALSpecific | |
| } | ||
|
|
||
| Get-ChildItem $OutputDir -Filter *.csv | Select-Object -ExpandProperty FullName | Import-Csv | Export-Csv "$outputDirMerged/UAL-Combined.csv" -NoTypeInformation -Append | ||
| Write-LogFile -Message "[INFO] Merging UAL Files" -Color "Green" | ||
| } | ||
|
|
||
| Write-LogFile -Message "[INFO] Acquisition complete, check the Output directory for your files.." -Color "Green" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.