Fixing error around Get-UALSpecifivcActivity

invictus-ir · Sep 13, 2024 · bbaae2d · bbaae2d
1 parent cd5a077
commit bbaae2d
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/Scripts/Get-UAL.ps1 b/Scripts/Get-UAL.ps1
@@ -824,7 +824,6 @@ function Get-UALSpecificActivity
 	}
 	catch {
 		write-logFile -Message "[INFO] Ensure you are connected to M365 by running the Connect-M365 command before executing this script" -Color "Yellow"
-		Write-logFile -Message "[ERROR] An error occurred: $($_.Exception.Message)" -Color "Red"
 		throw
 	}
 
@@ -856,7 +855,7 @@ function Get-UALSpecificActivity
 		[DateTime]$currentStart = $script:StartDate
 		[DateTime]$currentEnd = $script:EndDate
 
-		$specificResult = Search-UnifiedAuditLog -StartDate $script:StartDate -EndDate $script:EndDate -Operations $record -UserIds $UserIds @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
+		$specificResult = Search-UnifiedAuditLog -StartDate $script:StartDate -EndDate $script:EndDate -Operations $record -UserIds $UserIds -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
 
 		if (($null -ne $specificResult) -and ($specificResult -ne 0)) {
 			if ($OutputDir -eq "" ){
@@ -883,7 +882,7 @@ function Get-UALSpecificActivity
 
 			while ($currentStart -lt $script:EndDate) {	
 				$currentEnd = $currentStart.AddMinutes($Interval)
-				$amountResults = Search-UnifiedAuditLog -UserIds $UserIds -StartDate $currentStart -EndDate $currentEnd -Operations $record @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
+				$amountResults = Search-UnifiedAuditLog -UserIds $UserIds -StartDate $currentStart -EndDate $currentEnd -Operations $record -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
 
 
 				if ($null -eq $amountResults) {
@@ -893,7 +892,7 @@ function Get-UALSpecificActivity
 
 				elseif ($amountResults -gt 5000) {
 					while ($amountResults -gt 5000) {
-						$amountResults = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
+						$amountResults = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount
 						if ($amountResults -lt 5000) {
 							if ($Interval -eq 0) {
 								Exit
@@ -920,7 +919,7 @@ function Get-UALSpecificActivity
 					$sessionID = $currentStart.ToString("yyyyMMddHHmmss")
 
 					while ($true) {					
-						[Array]$results = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record @baseSearchQuery -SessionCommand ReturnLargeSet -ResultSize $ResultSize
+						[Array]$results = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record -SessionCommand ReturnLargeSet -ResultSize $ResultSize
 						$CurrentCount = 0
 
 						if ($null -eq $results -or $results.Count -eq 0) {