Improvements
- Accepted pull request from @angry-bender updating the date format in
Get-UALGraph
for improved readability and consistency. - Corrected a typo in the $filePath variable when using the
-Download
flag inGet-MessageIDs
. - Implemented suggestions from @Calvindd2f to add additional parameters for connection scripts. Users can now connect using an access token.
- Reworked the
$areYouConnected
functionality for the UAL scripts. - Introduced the
-All
parameter toGet-ADAuditLogsGraph
. By default, filtering with the UserIds field retrieves only actions directly performed by the specified user. With the new-All
flag, the command now includes all related events involving the user, such as events where an MFA device was added for them. - Fixed an issue where the merge output would throw "out of memory" errors. Now, while merging the output files, each file is written directly to the merged output file instead of reading everything into memory first and then saving it.
As suggested by @evild3ad:
- Updated the import command:
Import-Module .\Microsoft-Extractor-Suite.psm1 -ArgumentList $true
to suppress the logo output, optimizing it for automation scenarios. - Replaced remaining
Write-Host
commands inGet-Rules.ps1
with the customWrite-LogFile
function for consistent logging. - Fixed an issue in
Get-MailboxRules
where using the-UserIDs
flag with no rules found would incorrectly display the total inbox rules. - Added support for the
-UserIds
flag to Risky Users and Detections. - Added support for the
-UserIds
flag to the Get-MFA functionality.