sc‐200_powershell - itnett/FTD02H-N GitHub Wiki

# Import necessary modules
Import-Module Az
Import-Module Az.Sentinel
Import-Module Az.Security
Import-Module Microsoft.Graph

# Authenticate to Azure
Connect-AzAccount

# Define the resource group and workspace for Sentinel
$resourceGroupName = "YourResourceGroupName"
$workspaceName = "YourWorkspaceName"

# Function to get Sentinel incidents
function Get-SentinelIncidents {
    Write-Output "Fetching Sentinel Incidents..."
    $incidents = Get-AzSentinelIncident -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName
    return $incidents
}

# Function to get Defender for Cloud security alerts
function Get-DefenderSecurityAlerts {
    Write-Output "Fetching Defender for Cloud Security Alerts..."
    $alerts = Get-AzSecurityAlert
    return $alerts
}

# Function to get Microsoft 365 Defender incidents
function Get-M365DefenderIncidents {
    Write-Output "Fetching Microsoft 365 Defender Incidents..."
    # Connect to Microsoft Graph
    Connect-MgGraph -Scopes "SecurityEvents.Read.All"

    $incidents = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/incidents"
    return $incidents.value
}

# Get the incidents and alerts
$sentinelIncidents = Get-SentinelIncidents
$defenderAlerts = Get-DefenderSecurityAlerts
$m365DefenderIncidents = Get-M365DefenderIncidents

# Output the results
Write-Output "=== Sentinel Incidents ==="
$sentinelIncidents | Format-Table

Write-Output "=== Defender for Cloud Security Alerts ==="
$defenderAlerts | Format-Table

Write-Output "=== Microsoft 365 Defender Incidents ==="
$m365DefenderIncidents | Format-Table

# Function to export incidents to a CSV file
function Export-IncidentsToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [string]$FilePath
    )

    $combinedIncidents = @()
    $combinedIncidents += $sentinelIncidents
    $combinedIncidents += $defenderAlerts
    $combinedIncidents += $m365DefenderIncidents

    $combinedIncidents | Export-Csv -Path $FilePath -NoTypeInformation
    Write-Output "Incidents exported to $FilePath"
}

# Export all incidents to a CSV file
Export-IncidentsToCSV -FilePath "C:\SecurityIncidentsReport.csv"

# Load necessary modules
Import-Module Az
Import-Module Az.Security
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Graph
function Connect-MicrosoftGraph {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All, Policy.ReadWrite.All"
        Write-Output "Successfully authenticated to Microsoft Graph."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Graph. Please check your credentials and network connection."
        exit
    }
}

# Function to get current XDR/Defender policies and rules
function Get-CurrentDefenderPolicies {
    Write-Output "Fetching current Defender policies and rules..."
    try {
        $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/attackSimulation/policies"
        return $policies.value
    } catch {
        Write-Error "Failed to fetch Defender policies. Please check your permissions and network connection."
        return $null
    }
}

# Function to save policies and rules snapshot with a timestamp
function Save-PoliciesSnapshot {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SnapshotDirectory
    )

    $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
    $snapshotFile = "$SnapshotDirectory\DefenderPolicies_$timestamp.json"

    $policies = Get-CurrentDefenderPolicies
    if ($policies -ne $null) {
        $policies | ConvertTo-Json -Depth 10 | Out-File -FilePath $snapshotFile
        Write-Output "Snapshot saved: $snapshotFile"
    } else {
        Write-Error "Snapshot not saved due to previous errors."
    }
}

# Function to list all snapshots
function List-PoliciesSnapshots {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SnapshotDirectory
    )

    try {
        $snapshots = Get-ChildItem -Path $SnapshotDirectory -Filter "DefenderPolicies_*.json"
        return $snapshots
    } catch {
        Write-Error "Failed to list snapshots. Please check the snapshot directory path."
        return $null
    }
}

# Function to compare current policies with a snapshot
function Compare-PoliciesWithSnapshot {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SnapshotFile
    )

    $currentPolicies = Get-CurrentDefenderPolicies
    if ($currentPolicies -eq $null) {
        Write-Error "Cannot compare policies due to errors fetching current policies."
        return
    }

    try {
        $snapshotPolicies = Get-Content -Path $SnapshotFile | ConvertFrom-Json
        $comparisonResult = Compare-Object -ReferenceObject $snapshotPolicies -DifferenceObject $currentPolicies -Property id, displayName, description
        return $comparisonResult
    } catch {
        Write-Error "Failed to compare policies with snapshot. Please check the snapshot file."
        return $null
    }
}

# Function to rollback to a specific snapshot
function Rollback-ToSnapshot {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SnapshotFile,
        [Parameter(Mandatory = $true)]
        [switch]$DryRun
    )

    try {
        $snapshotPolicies = Get-Content -Path $SnapshotFile | ConvertFrom-Json
    } catch {
        Write-Error "Failed to read the snapshot file. Please check the file path and format."
        return
    }

    if ($DryRun) {
        Write-Output "Dry run enabled. The following changes would be applied:"
        $currentPolicies = Get-CurrentDefenderPolicies
        if ($currentPolicies -eq $null) {
            Write-Error "Cannot perform dry run due to errors fetching current policies."
            return
        }
        $comparisonResult = Compare-Object -ReferenceObject $snapshotPolicies -DifferenceObject $currentPolicies -Property id, displayName, description
        $comparisonResult | Format-Table
    } else {
        Write-Output "Applying changes from snapshot: $SnapshotFile"
        foreach ($policy in $snapshotPolicies) {
            try {
                # Update policy logic here
                # For example:
                # Update-MgSecurityAttackSimulationPolicy -PolicyId $policy.id -BodyParameter $policy
                Write-Output "Updated policy: $($policy.displayName)"
            } catch {
                Write-Error "Failed to update policy: $($policy.displayName). Please check your permissions and network connection."
            }
        }
        Write-Output "Policies rolled back to snapshot: $SnapshotFile"
    }
}

# Set the snapshot directory
$snapshotDirectory = "C:\DefenderPoliciesSnapshots"
if (-not (Test-Path -Path $snapshotDirectory)) {
    New-Item -ItemType Directory -Path $snapshotDirectory
}

# Main menu
while ($true) {
    Write-Host "Defender Policies and Rules Management" -ForegroundColor Cyan
    Write-Host "1. Save current policies and rules snapshot"
    Write-Host "2. List all snapshots"
    Write-Host "3. Compare current policies with a snapshot"
    Write-Host "4. Rollback to a specific snapshot"
    Write-Host "5. Exit"

    $choice = Read-Host "Enter your choice"

    switch ($choice) {
        "1" {
            Save-PoliciesSnapshot -SnapshotDirectory $snapshotDirectory
        }
        "2" {
            $snapshots = List-PoliciesSnapshots -SnapshotDirectory $snapshotDirectory
            if ($snapshots -ne $null) {
                $snapshots | Format-Table
            }
        }
        "3" {
            $snapshots = List-PoliciesSnapshots -SnapshotDirectory $snapshotDirectory
            if ($snapshots -ne $null) {
                $snapshots | Format-Table
                $snapshotFile = Read-Host "Enter the full path of the snapshot file to compare"
                $comparison = Compare-PoliciesWithSnapshot -SnapshotFile $snapshotFile
                if ($comparison -ne $null) {
                    $comparison | Format-Table
                }
            }
        }
        "4" {
            $snapshots = List-PoliciesSnapshots -SnapshotDirectory $snapshotDirectory
            if ($snapshots -ne $null) {
                $snapshots | Format-Table
                $snapshotFile = Read-Host "Enter the full path of the snapshot file to rollback to"
                $dryRun = Read-Host "Enable dry run? (yes/no)"
                Rollback-ToSnapshot -SnapshotFile $snapshotFile -DryRun:($dryRun -eq "yes")
            }
        }
        "5" {
            break
        }
        default {
            Write-Host "Invalid choice. Please try again." -ForegroundColor Red
        }
    }
}

function Connect-MicrosoftGraph {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All, Policy.ReadWrite.All"
        Write-Output "Successfully authenticated to Microsoft Graph."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Graph. Please check your credentials and network connection."
        exit
    }
}

# Import common functions
. ..\Common\Connect-MicrosoftGraph.ps1

# Authenticate to Microsoft Graph
Connect-MicrosoftGraph

# Function to get Sentinel incidents
function Get-SentinelIncidents {
    param (
        [string]$ResourceGroupName,
        [string]$WorkspaceName
    )

    Write-Output "Fetching Sentinel Incidents..."
    $incidents = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName
    return $incidents
}

# Example usage
$resourceGroupName = "YourResourceGroupName"
$workspaceName = "YourWorkspaceName"
$incidents = Get-SentinelIncidents -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName
$incidents | Format-Table

# Import common functions
. ..\Common\Connect-MicrosoftGraph.ps1

# Authenticate to Microsoft Graph
Connect-MicrosoftGraph

# Function to hunt for malicious IPs
function Hunt-MaliciousIPs {
    param (
        [string]$IPAddress
    )

    Write-Output "Hunting for malicious IP: $IPAddress"
    $alerts = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/alerts?\$filter=networkConnections/any(c:c/remoteAddress eq '$IPAddress')"
    return $alerts.value
}

# Example usage
$maliciousIP = "192.168.1.1"
$alerts = Hunt-MaliciousIPs -IPAddress $maliciousIP
$alerts | Format-Table

# Import common functions
. ..\Common\Connect-MicrosoftGraph.ps1

# Authenticate to Microsoft Graph
Connect-MicrosoftGraph

# Function to get vulnerabilities
function Get-Vulnerabilities {
    Write-Output "Fetching vulnerabilities..."
    $vulnerabilities = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/vulnerabilities"
    return $vulnerabilities.value
}

# Example usage
$vulnerabilities = Get-Vulnerabilities
$vulnerabilities | Format-Table

# Import common functions
. ..\Common\Connect-MicrosoftGraph.ps1

# Authenticate to Microsoft Graph
Connect-MicrosoftGraph

# Function to get current Defender policies and rules
function Get-CurrentDefenderPolicies {
    Write-Output "Fetching current Defender policies and rules..."
    try {
        $policies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/attackSimulation/policies"
        return $policies.value
    } catch {
        Write-Error "Failed to fetch Defender policies. Please check your permissions and network connection."
        return $null
    }
}

# Example usage
$policies = Get-CurrentDefenderPolicies
$policies | Format-Table

function Save-JsonToFile {
    param (
        [Parameter(Mandatory = $true)]
        [object]$Data,
        [Parameter(Mandatory = $true)]
        [string]$FilePath
    )

    try {
        $Data | ConvertTo-Json -Depth 10 | Out-File -FilePath $FilePath
        Write-Output "Data saved to $FilePath"
    } catch {
        Write-Error "Failed to save data to file: $FilePath"
    }
}

function Load-JsonFromFile {
    param (
        [Parameter(Mandatory = $true)]
        [string]$FilePath
    )

    try {
        $data = Get-Content -Path $FilePath | ConvertFrom-Json
        return $data
    } catch {
        Write-Error "Failed to load data from file: $FilePath"
        return $null
    }
}

# Import the necessary module
Import-Module Az.SecurityInsights

# Function to get open Sentinel incidents
function Get-SentinelIncidents {
    param (
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName
    )

    # Fetch incidents from Microsoft Sentinel
    $incidents = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName | Where-Object { $_.Status -eq "Active" }

    # Select and format the output
    $incidents | Select-Object -Property Name, Severity, Status, CreatedTimeUTC | Format-Table
}

# Main script
try {
    # Get input from the user
    $resourceGroupName = Read-Host "Enter the Resource Group Name"
    $workspaceName = Read-Host "Enter the Workspace Name"

    # Call the function to get incidents
    Get-SentinelIncidents -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName
} catch {
    Write-Error "An error occurred: $_"
}

# Import the necessary module
Import-Module Az.SecurityInsights

# Function to get detailed incident information
function Get-IncidentDetails {
    param (
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$IncidentId
    )

    # Fetch the incident details from Microsoft Sentinel
    $incident = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId

    if ($null -eq $incident) {
        Write-Error "Incident with ID $IncidentId not found."
        return $null
    }

    # Fetch related alerts and entities
    $alerts = Get-AzSentinelIncidentAlert -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId
    $entities = Get-AzSentinelIncidentEntity -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId

    # Prepare incident details
    $incidentDetails = [PSCustomObject]@{
        IncidentId        = $incident.IncidentId
        Title             = $incident.Title
        Description       = $incident.Description
        Severity          = $incident.Severity
        Status            = $incident.Status
        CreatedTimeUTC    = $incident.CreatedTimeUTC
        LastModifiedTimeUTC = $incident.LastModifiedTimeUTC
        Alerts            = ($alerts | ForEach-Object { $_.AlertDisplayName }) -join "; "
        Entities          = ($entities | ForEach-Object { $_.EntityType }) -join "; "
    }

    return $incidentDetails
}

# Function to export incident details to CSV
function Export-IncidentDetailsToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [PSObject]$IncidentDetails,

        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $IncidentDetails | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Incident details exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export incident details to CSV: $_"
    }
}

# Main script
try {
    # Get input from the user
    $resourceGroupName = Read-Host "Enter the Resource Group Name"
    $workspaceName = Read-Host "Enter the Workspace Name"
    $incidentId = Read-Host "Enter the Incident ID"
    $csvFilePath = Read-Host "Enter the path to save the CSV file"

    # Get incident details
    $incidentDetails = Get-IncidentDetails -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName -IncidentId $incidentId

    if ($null -ne $incidentDetails) {
        # Export incident details to CSV
        Export-IncidentDetailsToCSV -IncidentDetails $incidentDetails -CsvFilePath $csvFilePath
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Import the necessary module
Import-Module Az.SecurityInsights

# Function to close a Sentinel incident
function Close-SentinelIncident {
    param (
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$IncidentId,
        
        [string]$Classification = "FalsePositive",
        [string]$ClassificationComment = ""
    )

    try {
        # Fetch the incident
        $incident = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId
        if ($null -eq $incident) {
            Write-Error "Incident with ID $IncidentId not found."
            return
        }

        # Prepare update parameters
        $updateParams = @{
            Status                   = "Closed"
            Classification           = $Classification
            ClassificationComment    = $ClassificationComment
        }

        # Update the incident
        Set-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId @updateParams

        Write-Output "Incident $IncidentId has been successfully closed."
    } catch {
        Write-Error "Failed to close incident $IncidentId. Error: $_"
    }
}

# Main script
try {
    # Get input from the user
    $resourceGroupName = Read-Host "Enter the Resource Group Name"
    $workspaceName = Read-Host "Enter the Workspace Name"
    $incidentId = Read-Host "Enter the Incident ID to close"
    $classification = Read-Host "Enter the closing classification (default: FalsePositive)" -DefaultValue "FalsePositive"
    $classificationComment = Read-Host "Enter the closing comment (optional)"

    # Close the incident
    Close-SentinelIncident -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName -IncidentId $incidentId -Classification $classification -ClassificationComment $classificationComment
} catch {
    Write-Error "An error occurred: $_"
}

# Import necessary modules
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Defender for Endpoint
function Connect-MicrosoftDefender {
    try {
        Connect-MgGraph -Scopes "ThreatIndicators.Read.All, SecurityEvents.Read.All"
        Write-Output "Successfully authenticated to Microsoft Defender for Endpoint."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Defender for Endpoint. Please check your credentials and network connection."
        exit
    }
}

# Function to get endpoints that communicated with malicious IPs
function Get-EndpointsByMaliciousIPs {
    param (
        [Parameter(Mandatory = $true)]
        [string]$MaliciousIPsFilePath
    )

    try {
        $maliciousIPs = Get-Content -Path $MaliciousIPsFilePath
    } catch {
        Write-Error "Failed to read malicious IPs file: $MaliciousIPsFilePath"
        exit
    }

    $results = @()
    
    foreach ($ip in $maliciousIPs) {
        Write-Output "Searching for endpoints communicating with $ip"
        
        $queryUri = "https://graph.microsoft.com/v1.0/security/alerts?\$filter=networkConnections/any(c:c/remoteAddress eq '$ip')"
        $alerts = Invoke-MgGraphRequest -Method GET -Uri $queryUri
        
        foreach ($alert in $alerts.value) {
            foreach ($networkConnection in $alert.networkConnections) {
                if ($networkConnection.remoteAddress -eq $ip) {
                    $endpointInfo = [PSCustomObject]@{
                        Endpoint          = $alert.deviceName
                        IP                = $ip
                        LastCommunication = $networkConnection.timestamp
                        ProcessName       = $networkConnection.processName
                    }
                    $results += $endpointInfo
                }
            }
        }
    }
    
    return $results
}

# Function to export the results to a CSV file
function Export-ResultsToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [array]$Results,
        
        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $Results | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Results exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export results to CSV: $CsvFilePath"
    }
}

# Main script
try {
    # Authenticate to Microsoft Defender for Endpoint
    Connect-MicrosoftDefender

    # Get input from the user
    $maliciousIPsFilePath = Read-Host "Enter the path to the text file containing malicious IPs"
    $csvFilePath = Read-Host "Enter the path to save the CSV report"

    # Get endpoints that communicated with malicious IPs
    $results = Get-EndpointsByMaliciousIPs -MaliciousIPsFilePath $maliciousIPsFilePath

    if ($results.Count -gt 0) {
        # Export results to CSV
        Export-ResultsToCSV -Results $results -CsvFilePath $csvFilePath
    } else {
        Write-Output "No endpoints found communicating with the specified malicious IPs."
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Function to get suspicious logon events from a system
function Get-SuspiciousLogons {
    param (
        [Parameter(Mandatory = $true)]
        [string[]]$ComputerNames,
        
        [Parameter(Mandatory = $true)]
        [datetime]$StartTime,
        
        [Parameter(Mandatory = $true)]
        [datetime]$EndTime,
        
        [string]$UserName,
        
        [string[]]$SuspiciousLocations,
        
        [string[]]$OddHours
    )

    $logName = "Security"
    $eventID = 4624

    $suspiciousLogons = @()

    foreach ($computerName in $ComputerNames) {
        Write-Output "Checking logon events on $computerName..."

        $query = @"
        <QueryList>
            <Query Id="0" Path="$logName">
                <Select Path="$logName">
                    *[System[(EventID=$eventID) and TimeCreated[@SystemTime>='$($StartTime.ToUniversalTime().ToString("o"))' and @SystemTime<='$($EndTime.ToUniversalTime().ToString("o"))']]]
                </Select>
            </Query>
        </QueryList>
"@

        try {
            $events = Get-WinEvent -ComputerName $computerName -FilterXml $query -ErrorAction Stop
        } catch {
            Write-Error "Failed to retrieve events from $computerName: $_"
            continue
        }

        foreach ($event in $events) {
            $logonTime = $event.TimeCreated
            $accountName = $event.Properties[5].Value
            $ipAddress = $event.Properties[18].Value

            $isSuspicious = $false

            if ($null -ne $UserName -and $accountName -ne $UserName) {
                continue
            }

            if ($SuspiciousLocations -contains $ipAddress) {
                $isSuspicious = $true
            }

            if ($OddHours -contains $logonTime.Hour) {
                $isSuspicious = $true
            }

            if ($isSuspicious) {
                $suspiciousLogons += [PSCustomObject]@{
                    ComputerName = $computerName
                    LogonTime    = $logonTime
                    UserName     = $accountName
                    IPAddress    = $ipAddress
                }
            }
        }
    }

    return $suspiciousLogons
}

# Main script
try {
    # Get input from the user
    $computerNames = Read-Host "Enter the computer names (comma-separated)" -split ","
    $startTime = [datetime]::Parse(Read-Host "Enter the start time (e.g., 2023-01-01T00:00:00)")
    $endTime = [datetime]::Parse(Read-Host "Enter the end time (e.g., 2023-01-02T00:00:00)")
    $userName = Read-Host "Enter the user name to filter (optional, press Enter to skip)"
    $suspiciousLocations = Read-Host "Enter the suspicious IP locations (comma-separated, optional, press Enter to skip)" -split ","
    $oddHours = Read-Host "Enter the odd hours (comma-separated, 0-23, optional, press Enter to skip)" -split ","

    if ($oddHours) {
        $oddHours = $oddHours | ForEach-Object { [int]$_ }
    }

    # Get suspicious logons
    $suspiciousLogons = Get-SuspiciousLogons -ComputerNames $computerNames -StartTime $startTime -EndTime $endTime -UserName $userName -SuspiciousLocations $suspiciousLocations -OddHours $oddHours

    if ($suspiciousLogons.Count -gt 0) {
        $suspiciousLogons | Format-Table
    } else {
        Write-Output "No suspicious logon events found."
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Import necessary modules
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Defender for Endpoint
function Connect-MicrosoftDefender {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All"
        Write-Output "Successfully authenticated to Microsoft Defender for Endpoint."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Defender for Endpoint. Please check your credentials and network connection."
        exit
    }
}

# Function to get alerts from Microsoft Defender for Endpoint
function Get-DefenderAlerts {
    Write-Output "Fetching alerts from Microsoft Defender for Endpoint..."
    try {
        $alerts = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/alerts"
        return $alerts.value
    } catch {
        Write-Error "Failed to retrieve alerts from Microsoft Defender for Endpoint. Please check your permissions and network connection."
        return $null
    }
}

# Function to analyze alerts
function Analyze-DefenderAlerts {
    param (
        [Parameter(Mandatory = $true)]
        [array]$Alerts
    )

    $groupedBySeverity = $Alerts | Group-Object -Property severity
    $groupedByAlertType = $Alerts | Group-Object -Property alertType
    $groupedByMachine = $Alerts | Group-Object -Property deviceName

    return [PSCustomObject]@{
        GroupedBySeverity = $groupedBySeverity
        GroupedByAlertType = $groupedByAlertType
        GroupedByMachine = $groupedByMachine
    }
}

# Function to export analysis results to CSV
function Export-AnalysisToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [PSCustomObject]$AnalysisResults,
        
        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $csvData = @()
        foreach ($group in $AnalysisResults.GroupedBySeverity) {
            $csvData += [PSCustomObject]@{
                GroupType = "Severity"
                GroupName = $group.Name
                Count = $group.Count
            }
        }
        foreach ($group in $AnalysisResults.GroupedByAlertType) {
            $csvData += [PSCustomObject]@{
                GroupType = "Alert Type"
                GroupName = $group.Name
                Count = $group.Count
            }
        }
        foreach ($group in $AnalysisResults.GroupedByMachine) {
            $csvData += [PSCustomObject]@{
                GroupType = "Machine"
                GroupName = $group.Name
                Count = $group.Count
            }
        }

        $csvData | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Analysis results exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export analysis results to CSV: $CsvFilePath"
    }
}

# Main script
try {
    # Authenticate to Microsoft Defender for Endpoint
    Connect-MicrosoftDefender

    # Get alerts from Microsoft Defender for Endpoint
    $alerts = Get-DefenderAlerts

    if ($null -ne $alerts -and $alerts.Count -gt 0) {
        # Analyze alerts
        $analysisResults = Analyze-DefenderAlerts -Alerts $alerts

        # Output summary statistics
        Write-Output "Summary Statistics:"
        Write-Output "Alerts grouped by severity:"
        $analysisResults.GroupedBySeverity | Format-Table Name, Count
        Write-Output "Alerts grouped by alert type:"
        $analysisResults.GroupedByAlertType | Format-Table Name, Count
        Write-Output "Alerts grouped by machine:"
        $analysisResults.GroupedByMachine | Format-Table Name, Count

        # Export results to CSV
        $csvFilePath = Read-Host "Enter the path to save the CSV report"
        Export-AnalysisToCSV -AnalysisResults $analysisResults -CsvFilePath $csvFilePath
    } else {
        Write-Output "No alerts found."
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Import necessary modules
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Graph
function Connect-MicrosoftGraph {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All"
        Write-Output "Successfully authenticated to Microsoft Graph."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Graph. Please check your credentials and network connection."
        exit
    }
}

# Function to get vulnerabilities from Microsoft Graph
function Get-Vulnerabilities {
    param (
        [string]$Severity,
        [string]$VulnerabilityType,
        [string]$DeviceName
    )

    Write-Output "Fetching vulnerabilities from Microsoft Graph..."
    
    $filter = @()
    if ($Severity) {
        $filter += "severity eq '$Severity'"
    }
    if ($VulnerabilityType) {
        $filter += "vulnerabilityType eq '$VulnerabilityType'"
    }
    if ($DeviceName) {
        $filter += "deviceName eq '$DeviceName'"
    }
    $filterQuery = $filter -join " and "

    $queryUri = "https://graph.microsoft.com/v1.0/security/vulnerabilities"
    if ($filterQuery) {
        $queryUri += "?\$filter=$filterQuery"
    }

    try {
        $vulnerabilities = Invoke-MgGraphRequest -Method GET -Uri $queryUri
        return $vulnerabilities.value
    } catch {
        Write-Error "Failed to retrieve vulnerabilities from Microsoft Graph. Please check your permissions and network connection."
        return $null
    }
}

# Function to export vulnerabilities to a CSV file
function Export-VulnerabilitiesToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [array]$Vulnerabilities,
        
        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $Vulnerabilities | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Vulnerabilities exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export vulnerabilities to CSV: $CsvFilePath"
    }
}

# Main script
try {
    # Authenticate to Microsoft Graph
    Connect-MicrosoftGraph

    # Get input from the user
    $severity = Read-Host "Enter the severity to filter (e.g., High, Medium, Low) (optional, press Enter to skip)"
    $vulnerabilityType = Read-Host "Enter the vulnerability type to filter (optional, press Enter to skip)"
    $deviceName = Read-Host "Enter the device name to filter (optional, press Enter to skip)"
    $outputFormat = Read-Host "Enter the output format (Table or CSV)"
    $csvFilePath = if ($outputFormat -eq "CSV") { Read-Host "Enter the path to save the CSV file" } else { $null }

    # Get vulnerabilities
    $vulnerabilities = Get-Vulnerabilities -Severity $severity -VulnerabilityType $vulnerabilityType -DeviceName $deviceName

    if ($null -ne $vulnerabilities -and $vulnerabilities.Count -gt 0) {
        if ($outputFormat -eq "CSV" -and $csvFilePath) {
            # Export vulnerabilities to CSV
            Export-VulnerabilitiesToCSV -Vulnerabilities $vulnerabilities -CsvFilePath $csvFilePath
        } else {
            # Display vulnerabilities in a table format
            $vulnerabilities | Format-Table
        }
    } else {
        Write-Output "No vulnerabilities found."
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Import necessary modules
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Graph
function Connect-MicrosoftGraph {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All"
        Write-Output "Successfully authenticated to Microsoft Graph."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Graph. Please check your credentials and network connection."
        exit
    }
}

# Function to get vulnerabilities from Microsoft Graph
function Get-Vulnerabilities {
    param (
        [string]$Severity,
        [string]$VulnerabilityType,
        [string]$DeviceName
    )

    Write-Output "Fetching vulnerabilities from Microsoft Graph..."
    
    $filter = @()
    if ($Severity) {
        $filter += "severity eq '$Severity'"
    }
    if ($VulnerabilityType) {
        $filter += "vulnerabilityType eq '$VulnerabilityType'"
    }
    if ($DeviceName) {
        $filter += "deviceName eq '$DeviceName'"
    }
    $filterQuery = $filter -join " and "

    $queryUri = "https://graph.microsoft.com/v1.0/security/vulnerabilities"
    if ($filterQuery) {
        $queryUri += "?\$filter=$filterQuery"
    }

    try {
        $vulnerabilities = Invoke-MgGraphRequest -Method GET -Uri $queryUri
        return $vulnerabilities.value
    } catch {
        Write-Error "Failed to retrieve vulnerabilities from Microsoft Graph. Please check your permissions and network connection."
        return $null
    }
}

# Function to generate the report data
function Generate-ReportData {
    param (
        [array]$Vulnerabilities
    )

    $reportData = @()
    
    foreach ($vuln in $Vulnerabilities) {
        $reportData += [PSCustomObject]@{
            DeviceName        = $vuln.deviceName
            VulnerabilityType = $vuln.vulnerabilityType
            Severity          = $vuln.severity
            CVEID             = $vuln.cveId
            CVSSScore         = $vuln.cvssScore
            Remediation       = $vuln.remediation
        }
    }

    return $reportData
}

# Function to export report data to CSV
function Export-ReportToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [array]$ReportData,
        
        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $ReportData | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Report exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export report to CSV: $CsvFilePath"
    }
}

# Function to export report data to HTML
function Export-ReportToHTML {
    param (
        [Parameter(Mandatory = $true)]
        [array]$ReportData,
        
        [Parameter(Mandatory = $true)]
        [string]$HtmlFilePath
    )

    try {
        $html = $ReportData | ConvertTo-Html -Property DeviceName, VulnerabilityType, Severity, CVEID, CVSSScore, Remediation -Head "<style>table { border-collapse: collapse; width: 100%; } th, td { border: 1px solid black; padding: 8px; text-align: left; } th { background-color: #f2f2f2; }</style>"
        $html | Set-Content -Path $HtmlFilePath
        Write-Output "Report exported to $HtmlFilePath"
    } catch {
        Write-Error "Failed to export report to HTML: $HtmlFilePath"
    }
}

# Main script
try {
    # Authenticate to Microsoft Graph
    Connect-MicrosoftGraph

    # Get input from the user
    $severity = Read-Host "Enter the severity to filter (e.g., High, Medium, Low) (optional, press Enter to skip)"
    $vulnerabilityType = Read-Host "Enter the vulnerability type to filter (optional, press Enter to skip)"
    $deviceName = Read-Host "Enter the device name to filter (optional, press Enter to skip)"
    $reportFormat = Read-Host "Enter the report format (CSV, HTML)"
    $filePath = Read-Host "Enter the path to save the report file"

    # Get vulnerabilities
    $vulnerabilities = Get-Vulnerabilities -Severity $severity -VulnerabilityType $vulnerabilityType -DeviceName $deviceName

    if ($null -ne $vulnerabilities -and $vulnerabilities.Count -gt 0) {
        # Generate report data
        $reportData = Generate-ReportData -Vulnerabilities $vulnerabilities

        # Export report based on chosen format
        if ($reportFormat -eq "CSV") {
            Export-ReportToCSV -ReportData $reportData -CsvFilePath $filePath
        } elseif ($reportFormat -eq "HTML") {
            Export-ReportToHTML -ReportData $reportData -HtmlFilePath $filePath
        } else {
            Write-Error "Unsupported report format: $reportFormat"
        }
    } else {
        Write-Output "No vulnerabilities found."
    }
} catch {
    Write-Error "An error occurred: $_"
}

# Import necessary modules
Import-Module Microsoft.Graph

# Function to authenticate to Microsoft Defender for Endpoint
function Connect-MicrosoftDefender {
    try {
        Connect-MgGraph -Scopes "SecurityEvents.Read.All"
        Write-Output "Successfully authenticated to Microsoft Defender for Endpoint."
    } catch {
        Write-Error "Failed to authenticate to Microsoft Defender for Endpoint. Please check your credentials and network connection."
        exit
    }
}

# Function to get alerts from Microsoft Defender for Endpoint
function Get-DefenderAlerts {
    Write-Output "Fetching alerts from Microsoft Defender for Endpoint..."
    try {
        $alerts = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/security/alerts"
        return $alerts.value
    } catch {
        Write-Error "Failed to retrieve alerts from Microsoft Defender for Endpoint. Please check your permissions and network connection."
        return $null
    }
}

# Function to analyze alerts
function Analyze-DefenderAlerts {
    param (
        [Parameter(Mandatory = $true)]
        [array]$Alerts
    )

    $groupedBySeverity = $Alerts | Group-Object -Property severity
    $groupedByAlertType = $Alerts | Group-Object -Property alertType
    $groupedByMachine = $Alerts | Group-Object -Property deviceName

    return [PSCustomObject]@{
        GroupedBySeverity = $groupedBySeverity
        GroupedByAlertType = $groupedByAlertType
        GroupedByMachine = $groupedByMachine
    }
}

# Function to export analysis results to CSV
function Export-AnalysisToCSV {
    param (
        [Parameter(Mandatory = $true)]
        [PSCustomObject]$AnalysisResults,
        
        [Parameter(Mandatory = $true)]
        [string]$CsvFilePath
    )

    try {
        $csvData = @()
        foreach ($group in $AnalysisResults.GroupedBySeverity) {
            $csvData += [PSCustomObject]@{
                GroupType = "Severity"
                GroupName = $group.Name
                Count = $group.Count
            }
        }
        foreach ($group in $AnalysisResults.GroupedByAlertType) {
            $csvData += [PSCustomObject]@{
                GroupType = "Alert Type"
                GroupName = $group.Name
                Count = $group.Count
            }
        }
        foreach ($group in $AnalysisResults.GroupedByMachine) {
            $csvData += [PSCustomObject]@{
                GroupType = "Machine"
                GroupName = $group.Name
                Count = $group.Count
            }
        }

        $csvData | Export-Csv -Path $CsvFilePath -NoTypeInformation
        Write-Output "Analysis results exported to $CsvFilePath"
    } catch {
        Write-Error "Failed to export analysis results to CSV: $CsvFilePath"
    }
}

# Main script
try {
    # Authenticate to Microsoft Defender for Endpoint
    Connect-MicrosoftDefender

    # Get alerts from Microsoft Defender for Endpoint
    $alerts = Get-DefenderAlerts

    if ($null -ne $alerts -and $alerts.Count -gt 0) {
        # Analyze alerts
        $analysisResults = Analyze-DefenderAlerts -Alerts $alerts

        # Output summary statistics
        Write-Output "Summary Statistics:"
        Write-Output "Alerts grouped by severity:"
        $analysisResults.GroupedBySeverity | Format-Table Name, Count
        Write-Output "Alerts grouped by alert type:"
        $analysisResults.GroupedByAlertType | Format-Table Name, Count
        Write-Output "Alerts grouped by machine:"
        $analysisResults.GroupedByMachine | Format-Table Name, Count

        # Prompt user for export to CSV
        $exportToCsv = Read-Host "Would you like to export the results to a CSV file? (yes/no)"
        if ($exportToCsv -eq "yes") {
            $csvFilePath = Read-Host "Enter the path to save the CSV report"
            Export-AnalysisToCSV -AnalysisResults $analysisResults -CsvFilePath $csvFilePath
        }
    } else {
        Write-Output "No alerts found."
    }
} catch {
    Write-Error "An error occurred: $_"
}

Get-AzADUser -UserPrincipalName <UserPrincipalName> | Get-AzADGroupMember | Select-Object DisplayName

Get-AzSubscription | Select-Object SubscriptionName, SubscriptionId

Get-AzResourceHealth -ResourceId "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/virtualMachines/<VMName>"

Get-AzSecurityTask -ResourceId "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/virtualMachines/<VMName>" | Select-Object DisplayName, Severity, State

New-AzADUser -DisplayName "John Doe" -UserPrincipalName "[email protected]" -Password "P@ssw0rd!" -MailNickname "johndoe" -AccountEnabled $true

Search-AzSentinel -WorkspaceName <WorkspaceName> -ResourceGroupName <ResourceGroupName> -Query "search * | where EventID == '<EventID>' or Message contains '<StringPattern>'"

Get-AzSentinelIncident -ResourceGroupName <ResourceGroupName> -WorkspaceName <WorkspaceName> -IncidentId <IncidentId>

Invoke-AzOperationalInsightsQuery -WorkspaceName <WorkspaceName> -ResourceGroupName <ResourceGroupName> -Query "SecurityEvent | where TimeGenerated >= datetime(<StartDate>) and TimeGenerated <= datetime(<EndDate>)" | Export-Csv -Path "C:\Path\To\Export\SecurityEvents.csv" -NoTypeInformation

# Variables
$ResourceGroupName = "<ResourceGroupName>"
$NetworkSecurityGroupName = "<NSGName>"
$VMName = "<VMName>"

# Get the Network Interface associated with the VM
$networkInterface = Get-AzNetworkInterface -ResourceGroupName $ResourceGroupName | Where-Object { $_.VirtualMachine -ne $null -and $_.VirtualMachine.Id.EndsWith($VMName) }

# Create a new Network Security Group rule to block all traffic
$nsgRule = New-AzNetworkSecurityRuleConfig -Name "DenyAll" -Description "Isolate VM" -Access Deny -Protocol * -Direction Inbound -Priority 100 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange *

# Apply the new rule to the Network Security Group
$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName -Name $NetworkSecurityGroupName
$nsg.SecurityRules.Add($nsgRule)
$nsg | Set-AzNetworkSecurityGroup

# Associate the NSG with the Network Interface
$networkInterface.NetworkSecurityGroup = $nsg
$networkInterface | Set-AzNetworkInterface

Write-Output "VM $VMName has been isolated from the network."

Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '<MaliciousIPAddress>' } | ForEach-Object { Get-Process -Id $_.OwningProcess } | Select-Object Id, ProcessName, Path

# Define the time range for scanning
$startTime = (Get-Date).AddDays(-7)
$endTime = Get-Date

# Query Windows Event Logs for suspicious PowerShell activity
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; StartTime=$startTime; EndTime=$endTime; Id=4104} |
    Where-Object { $_.Message -match 'encodedCommand|Invoke-Expression|IEX|base64' } |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-Table -AutoSize

Invoke-Command -ComputerName <RemoteComputerName> -ScriptBlock { Get-Service | Where-Object { $_.Status -eq 'Running' } | Select-Object Name, DisplayName, Status }

Get-AzSecurityTask -ResourceId "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/virtualMachines/<VMName>" | Where-Object { $_.TaskType -eq 'Vulnerability' } | Select-Object DisplayName, Severity, State, CreationTime

Get-WmiObject -Class Win32_Product | Select-Object Name, Version, InstallDate | Format-Table -AutoSize

# Ensure the Update-Module is installed
if (-not (Get-Module -ListAvailable -Name PSWindowsUpdate)) {
    Install-Module -Name PSWindowsUpdate -Force -SkipPublisherCheck
}

# Import the PSWindowsUpdate module
Import-Module PSWindowsUpdate

# Check for missing security updates
$updates = Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot -Install -NotCategory 'Driver' -NotTitle 'Preview' -NotKBArticleID 'KB5005698'
$missingUpdates = $updates | Where-Object { $_.Categories -contains 'Security Updates' }

# Output the missing security updates
if ($missingUpdates) {
    $missingUpdates | Select-Object -ExpandProperty KBArticleID
} else {
    Write-Output "No missing security updates found."
}

Get-AzPolicyState -PolicyDefinitionName '<PolicyDefinitionName>' | Select-Object ResourceId, ComplianceState, Timestamp

Remove-AzPolicyAssignment -Name '<PolicyAssignmentName>' -Scope '/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>'

Search-AzGraph -Query "Resources | where type == 'microsoft.authorization/policyassignments' | project id, name, properties.displayName, properties.policyDefinitionId, properties.scope, properties.parameters, properties.provisioningState, properties.createdOn, properties.updatedOn"

Get-AzPolicyState -PolicyDefinitionName '<PolicyDefinitionName>' | Select-Object ResourceId, ComplianceState, Timestamp | Format-Table -AutoSize

param (
    [string]$PolicyAssignmentName,
    [string]$Scope
)

try {
    Remove-AzPolicyAssignment -Name $PolicyAssignmentName -Scope $Scope -ErrorAction Stop
    Write-Output "Policy assignment '$PolicyAssignmentName' has been successfully removed from scope '$Scope'."
} catch {
    Write-Error "Failed to remove policy assignment '$PolicyAssignmentName' from scope '$Scope'. Error: $_"
}

param (
    [string]$SubscriptionId
)

try {
    Search-AzGraph -Query "Resources | where type == 'microsoft.authorization/policyassignments' and subscriptionId == '$SubscriptionId' | project id, name, properties.displayName, properties.policyDefinitionId, properties.scope, properties.parameters, properties.provisioningState, properties.createdOn, properties.updatedOn" | Format-Table -AutoSize
} catch {
    Write-Error "Failed to retrieve policy assignment changes for subscription '$SubscriptionId'. Error: $_"
}

# Example: Get a list of VMs and their power states, and filter out the ones that are running.
Get-AzVM | Select-Object Name, PowerState | Where-Object { $_.PowerState -eq 'VM running' } | Format-Table -AutoSize

param (
    [string]$ResourceGroupName,
    [string]$VMName
)

Get-AzVM -ResourceGroupName $ResourceGroupName -Name $VMName | Select-Object Name, PowerState

param (
    [string]$ResourceGroupName,
    [string]$VMName
)

try {
    $vm = Get-AzVM -ResourceGroupName $ResourceGroupName -Name $VMName -ErrorAction Stop
    Write-Output "VM '$VMName' details:"
    $vm | Select-Object Name, PowerState
} catch {
    Write-Error "Failed to retrieve VM '$VMName' in resource group '$ResourceGroupName'. Error: $_"
}

param (
    [string]$PolicyAssignmentName,  # Name of the policy assignment to remove
    [string]$Scope                  # Scope from which to remove the policy assignment (e.g., subscription or resource group level)
)

try {
    # Attempt to remove the specified policy assignment from the given scope
    Remove-AzPolicyAssignment -Name $PolicyAssignmentName -Scope $Scope -ErrorAction Stop
    Write-Output "Policy assignment '$PolicyAssignmentName' has been successfully removed from scope '$Scope'."
} catch {
    # Handle any errors that occur during the removal process
    Write-Error "Failed to remove policy assignment '$PolicyAssignmentName' from scope '$Scope'. Error: $_"
}

# Import the module
Import-Module .\PhishingInvestigationModule\Get-PhishingEmail.psm1 

# Retrieve phishing emails
$phishingEmails = Get-PhishingEmail -Mailbox "[email protected]" -Subject "Suspicious Invoice"

# Process the results (e.g., display them, extract IoCs)
$phishingEmails | Format-Table

# SentinelIncidentToolkit Module

# Import necessary modules
Import-Module Az.SecurityInsights

# Helper function to handle MFA and multi-tenant scenarios
function Connect-Sentinel {
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    Connect-AzAccount -TenantId $TenantId -ErrorAction Stop
}

# Cmdlet to retrieve Sentinel incidents
function Get-SentinelIncident {
    param (
        [Parameter(Mandatory = $false)]
        [string]$IncidentId,
        
        [Parameter(Mandatory = $false)]
        [string]$Status,
        
        [Parameter(Mandatory = $false)]
        [string]$Severity,
        
        [Parameter(Mandatory = $false)]
        [string]$Filter,
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    try {
        Connect-Sentinel -TenantId $TenantId

        $incidents = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName

        if ($IncidentId) {
            $incidents = $incidents | Where-Object { $_.IncidentId -eq $IncidentId }
        }
        if ($Status) {
            $incidents = $incidents | Where-Object { $_.Status -eq $Status }
        }
        if ($Severity) {
            $incidents = $incidents | Where-Object { $_.Severity -eq $Severity }
        }
        if ($Filter) {
            $incidents = $incidents | Where-Object { $_.Title -like "*$Filter*" }
        }

        return $incidents
    } catch {
        Write-Error "Failed to retrieve incidents. Error: $_"
    }
}

# Cmdlet to export Sentinel incident details
function Export-SentinelIncidentDetails {
    param (
        [Parameter(Mandatory = $true)]
        [string]$IncidentId,
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $true)]
        [string]$OutputFormat,  # CSV or JSON
        
        [Parameter(Mandatory = $true)]
        [string]$OutputPath
    )

    try {
        Connect-Sentinel -TenantId $TenantId

        $incident = Get-AzSentinelIncident -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId

        $details = @{
            Incident = $incident
            Alerts = Get-AzSentinelIncidentAlert -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId
            Entities = Get-AzSentinelIncidentEntity -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId
            Comments = Get-AzSentinelIncidentComment -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId
        }

        if ($OutputFormat -eq 'CSV') {
            $details.Incident | Export-Csv -Path "$OutputPath\Incident.csv" -NoTypeInformation
            $details.Alerts | Export-Csv -Path "$OutputPath\Alerts.csv" -NoTypeInformation
            $details.Entities | Export-Csv -Path "$OutputPath\Entities.csv" -NoTypeInformation
            $details.Comments | Export-Csv -Path "$OutputPath\Comments.csv" -NoTypeInformation
        } elseif ($OutputFormat -eq 'JSON') {
            $details | ConvertTo-Json -Depth 10 | Out-File -FilePath "$OutputPath\IncidentDetails.json"
        } else {
            Write-Error "Invalid output format specified. Use 'CSV' or 'JSON'."
        }
    } catch {
        Write-Error "Failed to export incident details. Error: $_"
    }
}

# Cmdlet to find related incidents
function Find-RelatedIncidents {
    param (
        [Parameter(Mandatory = $true)]
        [string]$Entity,
        
        [Parameter(Mandatory = $true)]
        [string]$RelationshipType,  # e.g., 'sharedIP', 'sameUser'
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    try {
        Connect-Sentinel -TenantId $TenantId

        $query = ""
        switch ($RelationshipType) {
            'sharedIP' { $query = "* | where Entities contains '$Entity' and Entities type 'IP'" }
            'sameUser' { $query = "* | where Entities contains '$Entity' and Entities type 'user'" }
            default { Write-Error "Invalid relationship type specified."; return }
        }

        $relatedIncidents = Search-AzSentinel -WorkspaceName $WorkspaceName -ResourceGroupName $ResourceGroupName -Query $query
        return $relatedIncidents
    } catch {
        Write-Error "Failed to find related incidents. Error: $_"
    }
}

# Cmdlet to analyze incident entities
function Analyze-IncidentEntities {
    param (
        [Parameter(Mandatory = $true)]
        [string]$IncidentId,
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    try {
        Connect-Sentinel -TenantId $TenantId

        $entities = Get-AzSentinelIncidentEntity -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -IncidentId $IncidentId

        $entitySummary = $entities | Group-Object EntityType | Select-Object Name, Count
        $entitySummary | Format-Table -AutoSize
    } catch {
        Write-Error "Failed to analyze incident entities. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Get-SentinelIncident, Export-SentinelIncidentDetails, Find-RelatedIncidents, Analyze-IncidentEntities

Get-SentinelIncident -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -TenantId 'my-tenant-id' -Status 'Active'

Export-SentinelIncidentDetails -IncidentId 'incident-id' -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -TenantId 'my-tenant-id' -OutputFormat 'CSV' -OutputPath 'C:\IncidentDetails'

Find-RelatedIncidents -Entity 'malicious-ip' -RelationshipType 'sharedIP' -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -TenantId 'my-tenant-id'

Analyze-IncidentEntities -IncidentId 'incident-id' -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -TenantId 'my-tenant-id'

Import-Module -Name 'Path\To\SentinelIncidentToolkit.psm1'

# ThreatHuntingToolkit Module

# Import necessary modules
Import-Module Az.SecurityInsights
Import-Module Microsoft.Graph

# Helper function to handle MFA and API key integration
function Connect-SecurityAPI {
    param (
        [Parameter(Mandatory = $false)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $false)]
        [string]$ApiKey
    )

    if ($TenantId) {
        Connect-AzAccount -TenantId $TenantId -ErrorAction Stop
    }

    if ($ApiKey) {
        $global:ApiKey = $ApiKey
    }
}

# Cmdlet to fetch threat intelligence data
function Get-ThreatIntelligence {
    param (
        [Parameter(Mandatory = $true)]
        [string]$Source,  # MicrosoftGraph, VirusTotal, etc.
        
        [Parameter(Mandatory = $false)]
        [string]$IoC,
        
        [Parameter(Mandatory = $false)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $false)]
        [string]$ApiKey
    )

    Connect-SecurityAPI -TenantId $TenantId -ApiKey $ApiKey

    try {
        switch ($Source) {
            'MicrosoftGraph' {
                if ($IoC) {
                    $result = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/security/tiIndicators?\$filter=targetProduct eq 'Azure Sentinel' and displayName eq '$IoC'" -Method GET
                } else {
                    $result = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/security/tiIndicators" -Method GET
                }
            }
            'VirusTotal' {
                if (-not $global:ApiKey) { throw "API Key is required for VirusTotal." }
                $headers = @{ "x-apikey" = $global:ApiKey }
                if ($IoC) {
                    $result = Invoke-RestMethod -Uri "https://www.virustotal.com/api/v3/search?query=$IoC" -Headers $headers
                } else {
                    $result = Invoke-RestMethod -Uri "https://www.virustotal.com/api/v3/intelligence/hunting_rulesets" -Headers $headers
                }
            }
            default {
                throw "Unsupported source: $Source"
            }
        }
        return $result
    } catch {
        Write-Error "Failed to fetch threat intelligence data. Error: $_"
    }
}

# Cmdlet to search Azure Sentinel logs for specific IoCs
function Hunt-SentinelLogs {
    param (
        [Parameter(Mandatory = $true)]
        [string]$IoC,
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [datetime]$StartTime,
        
        [Parameter(Mandatory = $true)]
        [datetime]$EndTime,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    Connect-SecurityAPI -TenantId $TenantId

    try {
        $query = "* | where TimeGenerated between(datetime($StartTime) .. datetime($EndTime)) | where tostring(EventData) contains '$IoC'"
        $logs = Search-AzSentinel -WorkspaceName $WorkspaceName -ResourceGroupName $ResourceGroupName -Query $query
        return $logs
    } catch {
        Write-Error "Failed to search Sentinel logs. Error: $_"
    }
}

# Cmdlet to correlate IoCs
function Correlate-IoCs {
    param (
        [Parameter(Mandatory = $true)]
        [array]$IoCs,
        
        [Parameter(Mandatory = $true)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $true)]
        [string]$WorkspaceName,
        
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    Connect-SecurityAPI -TenantId $TenantId

    try {
        $correlatedResults = @()

        foreach ($IoC in $IoCs) {
            $result = Hunt-SentinelLogs -IoC $IoC -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -StartTime (Get-Date).AddDays(-30) -EndTime (Get-Date) -TenantId $TenantId
            if ($result) {
                $correlatedResults += [PSCustomObject]@{
                    IoC     = $IoC
                    Results = $result
                }
            }
        }

        return $correlatedResults
    } catch {
        Write-Error "Failed to correlate IoCs. Error: $_"
    }
}

# Cmdlet to enrich IoCs
function Enrich-IoC {
    param (
        [Parameter(Mandatory = $true)]
        [string]$IoC,
        
        [Parameter(Mandatory = $true)]
        [string]$Source,  # MicrosoftGraph, VirusTotal, etc.
        
        [Parameter(Mandatory = $false)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $false)]
        [string]$ApiKey
    )

    Connect-SecurityAPI -TenantId $TenantId -ApiKey $ApiKey

    try {
        switch ($Source) {
            'MicrosoftGraph' {
                $result = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/security/tiIndicators?\$filter=displayName eq '$IoC'" -Method GET
            }
            'VirusTotal' {
                if (-not $global:ApiKey) { throw "API Key is required for VirusTotal." }
                $headers = @{ "x-apikey" = $global:ApiKey }
                $result = Invoke-RestMethod -Uri "https://www.virustotal.com/api/v3/search?query=$IoC" -Headers $headers
            }
            default {
                throw "Unsupported source: $Source"
            }
        }

        return $result
    } catch {
        Write-Error "Failed to enrich IoC. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Get-ThreatIntelligence, Hunt-SentinelLogs, Correlate-IoCs, Enrich-IoC

Get-ThreatIntelligence -Source 'MicrosoftGraph' -IoC 'malicious-ip' -TenantId 'my-tenant-id'

Hunt-SentinelLogs -IoC 'malicious-ip' -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -StartTime (Get-Date).AddDays(-7) -EndTime (Get-Date) -TenantId 'my-tenant-id'

$IoCs = @('malicious-ip', 'suspicious-domain')
Correlate-IoCs -IoCs $IoCs -ResourceGroupName 'MyResourceGroup' -WorkspaceName 'MyWorkspace' -TenantId 'my-tenant-id'

Enrich-IoC -IoC 'malicious-ip' -Source 'VirusTotal' -ApiKey 'your-virustotal-api-key'

Import-Module -Name 'Path\To\ThreatHuntingToolkit.psm1'

# AzureSecurityPostureToolkit Module

# Import necessary modules
Import-Module Az.Security
Import-Module Az.Accounts

# Helper function to handle MFA and multi-subscription scenarios
function Connect-Azure {
    param (
        [Parameter(Mandatory = $false)]
        [string]$TenantId
    )

    if ($TenantId) {
        Connect-AzAccount -TenantId $TenantId -ErrorAction Stop
    } else {
        Connect-AzAccount -ErrorAction Stop
    }
}

# Cmdlet to retrieve the current Azure Security Center secure score
function Get-AzureSecurityScore {
    param (
        [Parameter(Mandatory = $false)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName
    )

    try {
        if ($SubscriptionId) {
            Set-AzContext -SubscriptionId $SubscriptionId
        }

        if ($ResourceGroupName) {
            $score = Get-AzSecuritySecureScore -ResourceGroupName $ResourceGroupName
        } else {
            $score = Get-AzSecuritySecureScore
        }
        
        return $score
    } catch {
        Write-Error "Failed to retrieve secure score. Error: $_"
    }
}

# Cmdlet to fetch security recommendations from Azure Security Center
function Get-SecurityRecommendations {
    param (
        [Parameter(Mandatory = $false)]
        [string]$Severity,
        
        [Parameter(Mandatory = $false)]
        [string]$Status,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceType,
        
        [Parameter(Mandatory = $false)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName
    )

    try {
        if ($SubscriptionId) {
            Set-AzContext -SubscriptionId $SubscriptionId
        }

        $recommendations = Get-AzSecurityTask

        if ($Severity) {
            $recommendations = $recommendations | Where-Object { $_.Severity -eq $Severity }
        }
        if ($Status) {
            $recommendations = $recommendations | Where-Object { $_.State -eq $Status }
        }
        if ($ResourceType) {
            $recommendations = $recommendations | Where-Object { $_.ResourceType -eq $ResourceType }
        }
        if ($ResourceGroupName) {
            $recommendations = $recommendations | Where-Object { $_.ResourceGroupName -eq $ResourceGroupName }
        }

        return $recommendations
    } catch {
        Write-Error "Failed to fetch security recommendations. Error: $_"
    }
}

# Cmdlet to check compliance against specific regulatory frameworks
function Assess-RegulatoryCompliance {
    param (
        [Parameter(Mandatory = $true)]
        [string]$Framework,  # e.g., 'PCI DSS', 'HIPAA', 'GDPR'
        
        [Parameter(Mandatory = $false)]
        [string]$SubscriptionId
    )

    try {
        if ($SubscriptionId) {
            Set-AzContext -SubscriptionId $SubscriptionId
        }

        $compliance = Get-AzSecurityRegulatoryComplianceAssessment -Name $Framework
        return $compliance
    } catch {
        Write-Error "Failed to assess regulatory compliance. Error: $_"
    }
}

# Cmdlet to continuously monitor for new security alerts
function Monitor-SecurityAlerts {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $true)]
        [string]$NotificationMethod,  # Email, Teams
       
        [Parameter(Mandatory = $false)]
        [string]$Email,
        
        [Parameter(Mandatory = $false)]
        [string]$TeamsWebhookUrl,
        
        [Parameter(Mandatory = $false)]
        [string]$Severity,
        
        [Parameter(Mandatory = $false)]
        [string]$Status
    )

    try {
        Set-AzContext -SubscriptionId $SubscriptionId

        while ($true) {
            $alerts = Get-AzSecurityAlert

            if ($Severity) {
                $alerts = $alerts | Where-Object { $_.Severity -eq $Severity }
            }
            if ($Status) {
                $alerts = $alerts | Where-Object { $_.Status -eq $Status }
            }

            if ($alerts.Count -gt 0) {
                switch ($NotificationMethod) {
                    'Email' {
                        if (-not $Email) { throw "Email address is required for email notifications." }
                        $alerts | Format-Table | Out-String | Send-MailMessage -To $Email -Subject "New Security Alerts" -SmtpServer "smtp.yourserver.com"
                    }
                    'Teams' {
                        if (-not $TeamsWebhookUrl) { throw "Teams webhook URL is required for Teams notifications." }
                        $alerts | Format-Table | Out-String | Invoke-RestMethod -Uri $TeamsWebhookUrl -Method POST -Body @{ text = $_ } | ConvertTo-Json
                    }
                    default {
                        throw "Unsupported notification method: $NotificationMethod"
                    }
                }
            }

            Start-Sleep -Seconds 300  # Check every 5 minutes
        }
    } catch {
        Write-Error "Failed to monitor security alerts. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Get-AzureSecurityScore, Get-SecurityRecommendations, Assess-RegulatoryCompliance, Monitor-SecurityAlerts

Get-AzureSecurityScore -SubscriptionId 'your-subscription-id'

Get-SecurityRecommendations -Severity 'High' -SubscriptionId 'your-subscription-id'

Assess-RegulatoryCompliance -Framework 'PCI DSS' -SubscriptionId 'your-subscription-id'

Monitor-SecurityAlerts -SubscriptionId 'your-subscription-id' -NotificationMethod 'Email' -Email '[email protected]'

Import-Module -Name 'Path\To\AzureSecurityPostureToolkit.psm1'

# PhishingInvestigationToolkit Module

# Import necessary modules
Import-Module ExchangeOnlineManagement

# Helper function to handle MFA and multi-tenant scenarios
function Connect-ExchangeOnline {
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId
    )

    Connect-ExchangeOnline -UserPrincipalName "<user>@$TenantId.onmicrosoft.com" -ShowProgress $true -ErrorAction Stop
}

# Cmdlet to retrieve phishing emails
function Get-PhishingEmail {
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $false)]
        [string]$Sender,
        
        [Parameter(Mandatory = $false)]
        [string]$Recipient,
        
        [Parameter(Mandatory = $false)]
        [string]$Subject,
        
        [Parameter(Mandatory = $false)]
        [datetime]$StartDate,
        
        [Parameter(Mandatory = $false)]
        [datetime]$EndDate
    )

    Connect-ExchangeOnline -TenantId $TenantId

    try {
        $filter = @()
        if ($Sender) {
            $filter += "Sender -eq '$Sender'"
        }
        if ($Recipient) {
            $filter += "Recipients -eq '$Recipient'"
        }
        if ($Subject) {
            $filter += "Subject -like '*$Subject*'"
        }
        if ($StartDate) {
            $filter += "Received -ge '$($StartDate.ToString("yyyy-MM-ddTHH:mm:ssZ"))'"
        }
        if ($EndDate) {
            $filter += "Received -le '$($EndDate.ToString("yyyy-MM-ddTHH:mm:ssZ"))'"
        }
        $searchFilter = $filter -join ' -and '

        $emails = Get-Mailbox | ForEach-Object { Get-MessageTrace -Recipient $_.PrimarySmtpAddress -StartDate $StartDate -EndDate $EndDate | Where-Object { $_.MessageId -like $searchFilter } }

        return $emails
    } catch {
        Write-Error "Failed to retrieve phishing emails. Error: $_"
    }
}

# Cmdlet to extract IoCs from phishing emails
function Extract-EmailIoCs {
    param (
        [Parameter(Mandatory = $true)]
        [array]$Emails
    )

    $iocs = @()
    foreach ($email in $Emails) {
        $urls = ($email.Body -split '\s') | Where-Object { $_ -match 'http[s]?://[^\s]+' }
        $attachments = $email.Attachments
        $headers = $email.Headers

        $iocs += [PSCustomObject]@{
            EmailId     = $email.MessageId
            URLs        = $urls -join ', '
            Attachments = $attachments -join ', '
            Headers     = $headers
        }
    }

    return $iocs
}

# Cmdlet to analyze email headers
function Analyze-EmailHeaders {
    param (
        [Parameter(Mandatory = $true)]
        [string]$Header
    )

    try {
        $analysis = @{}
        $headerLines = $Header -split '\r\n'
        foreach ($line in $headerLines) {
            if ($line -match '^(?<key>[^:]+):\s*(?<value>.+)$') {
                $analysis[$matches['key']] = $matches['value']
            }
        }

        # Check for potential spoofing indicators
        if ($analysis['Received-SPF'] -match 'fail') {
            $analysis['SpoofingIndicator'] = 'SPF Fail'
        } elseif ($analysis['Authentication-Results'] -match 'dkim=fail') {
            $analysis['SpoofingIndicator'] = 'DKIM Fail'
        } else {
            $analysis['SpoofingIndicator'] = 'None'
        }

        return $analysis
    } catch {
        Write-Error "Failed to analyze email header. Error: $_"
    }
}

# Cmdlet to search for phishing campaigns
function Hunt-PhishingCampaigns {
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $false)]
        [string]$Pattern,
        
        [Parameter(Mandatory = $false)]
        [datetime]$StartDate,
        
        [Parameter(Mandatory = $false)]
        [datetime]$EndDate
    )

    Connect-ExchangeOnline -TenantId $TenantId

    try {
        $filter = @()
        if ($Pattern) {
            $filter += "Subject -like '*$Pattern*' -or Body -like '*$Pattern*'"
        }
        if ($StartDate) {
            $filter += "Received -ge '$($StartDate.ToString("yyyy-MM-ddTHH:mm:ssZ"))'"
        }
        if ($EndDate) {
            $filter += "Received -le '$($EndDate.ToString("yyyy-MM-ddTHH:mm:ssZ"))'"
        }
        $searchFilter = $filter -join ' -and '

        $campaigns = Get-Mailbox | ForEach-Object { Get-MessageTrace -Recipient $_.PrimarySmtpAddress -StartDate $StartDate -EndDate $EndDate | Where-Object { $_.MessageId -like $searchFilter } }

        return $campaigns
    } catch {
        Write-Error "Failed to hunt phishing campaigns. Error: $_"
    }
}

# Cmdlet to remediate phishing incidents
function Remediate-PhishingIncident {
    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId,
        
        [Parameter(Mandatory = $true)]
        [array]$Emails,
        
        [Parameter(Mandatory = $true)]
        [ValidateSet("Remove", "BlockSender", "UpdateRules")]
        [string]$Action
    )

    Connect-ExchangeOnline -TenantId $TenantId

    try {
        foreach ($email in $Emails) {
            switch ($Action) {
                'Remove' {
                    Search-Mailbox -Identity $email.Recipient -SearchQuery "MessageId:$($email.MessageId)" -DeleteContent
                }
                'BlockSender' {
                    New-TransportRule -Name "Block $($email.Sender)" -SenderAddressMatchesPatterns $email.Sender -DeleteMessage $true
                }
                'UpdateRules' {
                    # Add custom logic for updating security rules
                }
            }
        }
    } catch {
        Write-Error "Failed to remediate phishing incident. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Get-PhishingEmail, Extract-EmailIoCs, Analyze-EmailHeaders, Hunt-PhishingCampaigns, Remediate-PhishingIncident

Get-PhishingEmail -TenantId 'your-tenant-id' -Sender '[email protected]' -StartDate (Get-Date).AddDays(-7)

$emails = Get-PhishingEmail -TenantId 'your-tenant-id' -Sender '[email protected]' -StartDate (Get-Date).AddDays(-7)
Extract-EmailIoCs -Emails $emails

Analyze-EmailHeaders -Header 'your-email-header'

Hunt-PhishingCampaigns -TenantId 'your-tenant-id' -Pattern 'phishing' -StartDate (Get-Date).AddDays(-7)

$emails = Get-PhishingEmail -TenantId 'your-tenant-id' -Sender '[email protected]' -StartDate (Get-Date).AddDays(-7)
Remediate-PhishingIncident -TenantId 'your-tenant-id' -Emails $emails -Action 'Remove'

Import-Module -Name 'Path\To\PhishingInvestigationToolkit.psm1'

# IAMAuditingToolkit Module

# Import necessary modules
Import-Module AzureAD
Import-Module Az

# Helper function to handle MFA
function Connect-AzureADWithMFA {
    try {
        Connect-AzureAD -ErrorAction Stop
        Write-Output "Successfully authenticated to Azure AD."
    } catch {
        Write-Error "Failed to authenticate to Azure AD. Please check your credentials and ensure MFA is enabled."
    }
}

# Cmdlet to retrieve risky users in Azure AD
function Get-AzureADRiskyUsers {
    Connect-AzureADWithMFA

    try {
        $riskyUsers = Get-AzureADUserRiskyUser
        return $riskyUsers
    } catch {
        Write-Error "Failed to retrieve risky users. Error: $_"
    }
}

# Cmdlet to analyze permissions assigned to users and groups
function Review-AzureADPermissions {
    Connect-AzureADWithMFA

    param (
        [Parameter(Mandatory = $false)]
        [string]$UserId
    )

    try {
        if ($UserId) {
            $permissions = Get-AzureADUserAppRoleAssignment -ObjectId $UserId
        } else {
            $permissions = Get-AzureADUser | ForEach-Object { Get-AzureADUserAppRoleAssignment -ObjectId $_.ObjectId }
        }

        $excessivePermissions = $permissions | Where-Object { $_.ResourceDisplayName -match '.*Admin.*' }
        return $excessivePermissions
    } catch {
        Write-Error "Failed to analyze permissions. Error: $_"
    }
}

# Cmdlet to enforce least privilege principle
function Enforce-LeastPrivilege {
    Connect-AzureADWithMFA

    param (
        [Parameter(Mandatory = $true)]
        [string]$UserId
    )

    try {
        $permissions = Get-AzureADUserAppRoleAssignment -ObjectId $UserId

        foreach ($permission in $permissions) {
            if ($permission.ResourceDisplayName -match '.*Admin.*') {
                Remove-AzureADUserAppRoleAssignment -ObjectId $UserId -AppRoleAssignmentId $permission.Id
                Write-Output "Removed admin permission '$($permission.ResourceDisplayName)' from user '$UserId'."
            }
        }
    } catch {
        Write-Error "Failed to enforce least privilege. Error: $_"
    }
}

# Cmdlet to monitor IAM changes
function Monitor-IAMChanges {
    Connect-AzureADWithMFA

    param (
        [Parameter(Mandatory = $true)]
        [string]$TenantId,

        [Parameter(Mandatory = $true)]
        [string]$NotificationMethod,  # Email, Teams

        [Parameter(Mandatory = $false)]
        [string]$Email,

        [Parameter(Mandatory = $false)]
        [string]$TeamsWebhookUrl,

        [Parameter(Mandatory = $false)]
        [int]$FrequencyMinutes = 5
    )

    try {
        while ($true) {
            $changes = Get-AzureADAuditDirectoryLogs -All $true -Filter "category eq 'UserManagement'"

            if ($changes.Count -gt 0) {
                switch ($NotificationMethod) {
                    'Email' {
                        if (-not $Email) { throw "Email address is required for email notifications." }
                        $changes | Format-Table | Out-String | Send-MailMessage -To $Email -Subject "IAM Changes Detected" -SmtpServer "smtp.yourserver.com"
                    }
                    'Teams' {
                        if (-not $TeamsWebhookUrl) { throw "Teams webhook URL is required for Teams notifications." }
                        $changes | Format-Table | Out-String | Invoke-RestMethod -Uri $TeamsWebhookUrl -Method POST -Body @{ text = $_ } | ConvertTo-Json
                    }
                    default {
                        throw "Unsupported notification method: $NotificationMethod"
                    }
                }
            }

            Start-Sleep -Seconds ($FrequencyMinutes * 60)
        }
    } catch {
        Write-Error "Failed to monitor IAM changes. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Get-AzureADRiskyUsers, Review-AzureADPermissions, Enforce-LeastPrivilege, Monitor-IAMChanges

Get-AzureADRiskyUsers

Review-AzureADPermissions -UserId 'user-id'

Enforce-LeastPrivilege -UserId 'user-id'

Monitor-IAMChanges -TenantId 'tenant-id' -NotificationMethod 'Email' -Email '[email protected]' -FrequencyMinutes 10

Import-Module -Name 'Path\To\IAMAuditingToolkit.psm1'

# CloudSecurityAssessmentToolkit Module

# Import necessary modules
Import-Module Az.Security
Import-Module Az.Storage
Import-Module Az.Network

# Helper function to handle MFA
function Connect-AzWithMFA {
    try {
        Connect-AzAccount -ErrorAction Stop
        Write-Output "Successfully authenticated to Azure."
    } catch {
        Write-Error "Failed to authenticate to Azure. Please check your credentials and ensure MFA is enabled."
    }
}

# Cmdlet to assess security recommendations from Azure Security Center
function Assess-AzureSecurityCenter {
    param (
        [Parameter(Mandatory = $false)]
        [string]$ResourceType,
        
        [Parameter(Mandatory = $false)]
        [string]$Severity,
        
        [Parameter(Mandatory = $false)]
        [string]$Status,
        
        [Parameter(Mandatory = $false)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName
    )

    Connect-AzWithMFA

    try {
        if ($SubscriptionId) {
            Set-AzContext -SubscriptionId $SubscriptionId
        }

        $recommendations = Get-AzSecurityTask

        if ($ResourceType) {
            $recommendations = $recommendations | Where-Object { $_.ResourceType -eq $ResourceType }
        }
        if ($Severity) {
            $recommendations = $recommendations | Where-Object { $_.Severity -eq $Severity }
        }
        if ($Status) {
            $recommendations = $recommendations | Where-Object { $_.State -eq $Status }
        }
        if ($ResourceGroupName) {
            $recommendations = $recommendations | Where-Object { $_.ResourceGroupName -eq $ResourceGroupName }
        }

        return $recommendations
    } catch {
        Write-Error "Failed to assess security recommendations. Error: $_"
    }
}

# Cmdlet to check Azure resource configurations
function Check-AzureResourceConfiguration {
    param (
        [Parameter(Mandatory = $true)]
        [string]$ResourceId
    )

    Connect-AzWithMFA

    try {
        $resource = Get-AzResource -ResourceId $ResourceId -ErrorAction Stop

        # Implement specific configuration checks based on resource type
        $results = @()
        switch ($resource.ResourceType) {
            "Microsoft.Compute/virtualMachines" {
                # Example check: Ensure VMs have boot diagnostics enabled
                $vm = Get-AzVM -ResourceGroupName $resource.ResourceGroupName -Name $resource.Name
                if (-not $vm.DiagnosticsProfile.BootDiagnostics.Enabled) {
                    $results += [PSCustomObject]@{
                        ResourceName = $resource.Name
                        Issue        = "Boot diagnostics not enabled"
                    }
                }
            }
            "Microsoft.Sql/servers/databases" {
                # Example check: Ensure SQL databases have threat detection enabled
                $sqlDb = Get-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $resource.ResourceGroupName -ServerName $resource.ServerName -DatabaseName $resource.Name
                if ($sqlDb.State -ne 'Enabled') {
                    $results += [PSCustomObject]@{
                        ResourceName = $resource.Name
                        Issue        = "Threat detection not enabled"
                    }
                }
            }
            default {
                Write-Warning "No specific checks implemented for resource type $($resource.ResourceType)"
            }
        }

        return $results
    } catch {
        Write-Error "Failed to check resource configuration. Error: $_"
    }
}

# Cmdlet to evaluate Network Security Group (NSG) rules
function Scan-NetworkSecurityGroups {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName
    )

    Connect-AzWithMFA

    try {
        Set-AzContext -SubscriptionId $SubscriptionId

        $nsgs = if ($ResourceGroupName) {
            Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName
        } else {
            Get-AzNetworkSecurityGroup
        }

        $results = @()
        foreach ($nsg in $nsgs) {
            foreach ($rule in $nsg.SecurityRules) {
                if ($rule.Access -eq 'Allow' -and $rule.Direction -eq 'Inbound' -and $rule.SourceAddressPrefix -eq '*') {
                    $results += [PSCustomObject]@{
                        NSGName     = $nsg.Name
                        RuleName    = $rule.Name
                        Issue       = "Overly permissive inbound rule"
                        Description = "Rule allows traffic from any source"
                    }
                }
            }
        }

        return $results
    } catch {
        Write-Error "Failed to scan Network Security Groups. Error: $_"
    }
}

# Cmdlet to assess storage account security configurations
function Assess-StorageAccountSecurity {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName
    )

    Connect-AzWithMFA

    try {
        Set-AzContext -SubscriptionId $SubscriptionId

        $storageAccounts = if ($ResourceGroupName) {
            Get-AzStorageAccount -ResourceGroupName $ResourceGroupName
        } else {
            Get-AzStorageAccount
        }

        $results = @()
        foreach ($storageAccount in $storageAccounts) {
            if ($storageAccount.EnableHttpsTrafficOnly -eq $false) {
                $results += [PSCustomObject]@{
                    StorageAccountName = $storageAccount.StorageAccountName
                    Issue              = "HTTPS not enforced"
                }
            }
            if ($storageAccount.NetworkRuleSet.DefaultAction -ne 'Deny') {
                $results += [PSCustomObject]@{
                    StorageAccountName = $storageAccount.StorageAccountName
                    Issue              = "Public access allowed"
                }
            }
            if (-not $storageAccount.EncryptionServices.Blob.Enabled -or -not $storageAccount.EncryptionServices.File.Enabled) {
                $results += [PSCustomObject]@{
                    StorageAccountName = $storageAccount.StorageAccountName
                    Issue              = "Encryption not enabled"
                }
            }
        }

        return $results
    } catch {
        Write-Error "Failed to assess storage account security. Error: $_"
    }
}

# Cmdlet to generate a compliance report
function Generate-ComplianceReport {
    param (
        [Parameter(Mandatory = $true)]
        [string]$SubscriptionId,
        
        [Parameter(Mandatory = $false)]
        [string]$ResourceGroupName,
        
        [Parameter(Mandatory = $false)]
        [string]$OutputPath
    )

    Connect-AzWithMFA

    try {
        Set-AzContext -SubscriptionId $SubscriptionId

        $report = @()

        $report += Assess-AzureSecurityCenter -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName
        $report += Scan-NetworkSecurityGroups -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName
        $report += Assess-StorageAccountSecurity -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName

        if ($OutputPath) {
            $report | Export-Csv -Path $OutputPath -NoTypeInformation
            Write-Output "Compliance report generated at $OutputPath"
        } else {
            return $report
        }
    } catch {
        Write-Error "Failed to generate compliance report. Error: $_"
    }
}

# Export module functions
Export-ModuleMember -Function Assess-AzureSecurityCenter, Check-AzureResourceConfiguration, Scan-NetworkSecurityGroups, Assess-StorageAccountSecurity, Generate-ComplianceReport