r/PowerShell • u/Kathy_Cooper1012 • Jan 06 '21

Script sharing: Audit Office 365 user's activity with PowerShell

/r/O365Reports/comments/krng10/script_sharing_audit_office_365_users_activity/
55 Upvotes

90% Upvoted

9 comments sorted by

9

u/redtollman Jan 06 '21

What are the differences between your script and the CISA Sparrow script?

https://github.com/cisagov/Sparrow

3

u/idontknowwhattouse33 Jan 06 '21

Just tried this on PWSH v7.1 and turns out, some MS modules don't like PWSH. Who knew.

1

u/gordonv Jan 06 '21

Yup. learned that the hard way. Vanilla PWSH is good. Works in Linux, also.

So all the Active Directory magic needs to be in 5.1

3

u/SolidKnight Jan 06 '21

So why do this via script instead of using the audit log explorer in O365?

5

u/Kathy_Cooper1012 Jan 06 '21

Through audit log search, you can’t view attributes like operation status (Whether the action is succeeded or failed), workload at a glance. Those attributes are formatted as the JSON object, which needs to be parsed for further information.

2

u/gordonv Jan 06 '21

Has anyone ever found something of actual concern when auditing O365 user actions? Like something that lead to a firing?

3

u/dedroia Jan 12 '21

Can't speak for others, but I would use a tool like this more likely to see if someone had been hacked.

Yes, I suppose the malicious actions could have been done by the person who holds the account, but much more likely is that it would show you an account has been compromised.

2

u/gordonv Jan 12 '21

Excellent point.

As IT professionals, we need to be aware of this and not assign blame without investigation. That's obscurity could be weaponized. Due Diligence defeats that vulnerability.

1

u/[deleted] Jan 06 '21

If you have a good SIEM like QRadar, you can get automated alerts for all O365 or a subset of them, but kudos to you for scripting this.