Skip to content

Update V4.0.0 - Start-MESTriage and more

Choose a tag to compare

View all tags
@JoeyInvictus JoeyInvictus released this 28 Jul 07:31
· 66 commits to main since this release
V4.0.0
78d4e84
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New functions added:

  • Get-SecurityAlerts - Retrieves security alerts from Microsoft Graph, choosing between Get-MgSecurityAlert and
    Get-MgSecurityAlertV2 based on the authentication type used.

  • Get-PIMAssignments - Generates an overview of all Entra ID PIM role assignments.

  • Get-AllRoleActivity - Exports all directory role memberships with last login information.

  • Start-MesTriage - The Start-MESTriage function performs a quick security triage for specific users across Azure, Entra ID and Microsoft 365 environments. It executes multiple data collection tasks based on customizable templates, making it ideal for incident response and security investigations.

Get-MFAStatus:

  • As suggested by Bloggzy, added phone numbers to MFA output when using the -IncludePhoneNumbers flag.

Other:

  • Due to the deprecation of the AzureAD module, we removed the related commands Get-EntraSignInLogs and Get-EntraAuditLogs.

Added the following fields to the Get-AdminUsers output:

  • LastInteractiveSignIn
  • LastNonInteractiveSignIn
  • DaysSinceLastSignIn

Pull Requests:
Accepted pull request by FlorianGross: added JSONL as an output format.
Accepted pull request by TheDFIRJournal: added SOF-ELK output support for Get-UALGraph.
Accepted pull request by Get-UAL Optimization, only uses ReturnLargeSet when needed.
Accepted pull request by Matthijsy: Added -LogLevel Debug support for detailed logging for all scripts
Accepted pull request by Matthijsy: Fix UAL interval calculation for small collections
Accepted pull request by evild3ad: Show-TransportRules and Get-TransportRules automatically convert the WhenChanged timestamp to UTC.

Bug Fixes:

  • Sign-in Graph: Fixed issue where service principals and managed identities were incorrectly included when using the UserIds filter.
  • Message Trace Logs: Fixed error during connection check caused by legacy Get-MessageTrace.
  • Mailbox Rules: Fixed bug in get-mailboxrules where an empty $UserIds value caused the script to fail.
Assets 2
Loading