anssi-fr / dfir-o365rc Goto Github PK

PS /mnt/host/output> Get-O365Light -StartDate $startdate -Enddate $enddate -Debug                                                                           

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code DF[...]VZ to authenticate.
Get-O365Light: [email protected] does not have the required permissions to get Office 365 Unified Audit Logs : doees not have the 'View-Only Audit Logs' role on https://admin.exchange.microsoft.com/. See https://learn.microsoft.com/en-us/purview/audit-log-search?view=o365-worldwide#before-you-search-the-audit-log. Cannot continue                                                                                               

2024-04-18 13:02:50, INFO, Asking Oauth token for EXO
2024-04-18 13:03:37, INFO, Fetching all operations from the subset, this is the default configuration
2024-04-18 13:03:37, INFO, Asking Oauth silent token renewal for EXO
2024-04-18 13:03:37, INFO, Checking permissions for [email protected]
2024-04-18 13:03:37, WARNING, Failed to create EXO session EXO_0f3b[...]834c - sleeping and retrying  - Unexpected character encountered while parsing value: F. Path '', line 1, position 1.
2024-04-18 13:04:37, WARNING, Failed to create EXO session EXO_0f3b[...]834c - sleeping and retrying  - Unexpected character encountered while parsing value: F. Path '', line 1, position 1.
2024-04-18 13:06:37, WARNING, Failed to create EXO session EXO_0f3b[...]834c - sleeping and retrying  - Unexpected character encountered while parsing value: F. Path '', line 1, position 1.
2024-04-18 13:09:38, WARNING, Failed to create EXO session EXO_0f3b[...]834c - sleeping and retrying  - Unexpected character encountered while parsing value: F. Path '', line 1, position 1.
2024-04-18 13:13:38, ERROR, Failed to create EXO session EXO_0f3b[...]834c 4 times - aborting
2024-04-18 13:13:38, ERROR, [email protected] does not have the required permissions to get Office 365 Unified Audit Logs : doees not have the 'View-Only Audit Logs' role on https://admin.exchange.microsoft.com/. See https://learn.microsoft.com/en-us/purview/audit-log-search?view=o365-worldwide#before-you-search-the-audit-log. Cannot continue

PS> Connect-ExchangeOnline -UserPrincipalName [email protected]
(success)
PS> $sessionName  = [guid]::NewGuid().ToString() 
PS> $Alloperations= @() 
PS> $myObject = [PSCustomObject]@{    
>>         GroupName= "Exchange";                                                                                                                                                                                                                                                                                           
>>         Operations = '"Add-MailboxPermission", "AddFolderPermissions", "Add-RecipientPermission", "Remove-RecipientPermission", "New-InboxRule", "Set-InboxRule", "Set-TransportRule", "New-TransportRule", "Hard Delete user", "Remove-MailboxPermission", "RemoveFolderPermissions", "UpdateInboxRules", "Set-CASMailbox", "Set-Mailbox","SearchCreated", "SearchExported","MailboxLogin"'                                                                                                                                                                                                                                                         
>>         }
PS> $Alloperations += $myObject   
[do this for all the other objects]
PS> foreach ($operationsset in $Alloperations) {                                                                                                                                                                                                                                                                          
>>     Get-LargeUnifiedAuditLog -StartDate $startdate -EndDate $enddate -outputfile test2.txt -requesttype "Operations" -sessionName $sessionName -logfile test2.log -Operations $operationsset.Operations                                                                                                                      
>> } 
[this generates the correct output]