Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defender provider fail to catch error for G3 #976

Closed
Dylan-MITRE opened this issue Mar 7, 2024 · 2 comments · Fixed by #929
Closed

Defender provider fail to catch error for G3 #976

Dylan-MITRE opened this issue Mar 7, 2024 · 2 comments · Fixed by #929
Assignees
Labels
bug This issue or pull request addresses broken functionality
Milestone

Comments

@Dylan-MITRE
Copy link
Contributor

🐛 Summary

When running defender for G3 tenant, get error of not able to run 'Get-DlpCompliancePolicy' 'Get-ProtectionAlert' 'Get-DlpComplianceRule' instead of omitting those command. And lead to error on final report for policy 4.1, 4.2, 4.3, 4.4, and 5.1

To reproduce

Steps to reproduce the behavior:

  1. Run
    Invoke-SCuBA -ProductNames defender for G3 tenant

Expected behavior

Should expect some message indicate "Omitting the following commands: Get-DlpCompliancePolicy, Get-DlpComplianceRule, and Get-ProtectionAlert." and not have error in the report

Any helpful log output or screenshots

Screenshot 2024-03-07 at 12 07 31 PM

Screenshot 2024-03-06 at 2 01 19 PM

@Dylan-MITRE Dylan-MITRE self-assigned this Mar 7, 2024
@Dylan-MITRE Dylan-MITRE added the bug This issue or pull request addresses broken functionality label Mar 7, 2024
@Dylan-MITRE Dylan-MITRE added this to the Glacier milestone Mar 7, 2024
@Dylan-MITRE Dylan-MITRE linked a pull request Mar 7, 2024 that will close this issue
20 tasks
@schrolla schrolla assigned schrolla and unassigned Dylan-MITRE Mar 14, 2024
@schrolla schrolla modified the milestones: Glacier, Halibut Mar 28, 2024
@schrolla
Copy link
Collaborator

@Dylan-MITRE After running tests with G3 using the commands listed above, I do not get the error indicated. While ScubaGear does correctly note the lack of a Defender for Office365 license when running against G3 and therefore doesn't have access to the Get-ATPPolicyForO365 and Get-ATPProtectionPolicyRule commands, it does still have access to the DLP related commands and evaluates them appropriately. These commands are available in E3/G3 license levels.
The only additional licensing required for DLP commands are when policies are applied to the Devices or Teams chat locations. The former requires DLP for Endpoint with at least one tenant registered device and the latter requires DLP for Teams which is included with E5/G5 licensing. Neither restricts access to the necessary provider commands, only whether a policy may include those locations. Updates to license warnings are already included in #599. Recommend closing this issue as can't repro/duplicate.

@schrolla
Copy link
Collaborator

schrolla commented May 6, 2024

Closing as cannot reproduce for now. Can reopen if the issue presents itself in the future.

@schrolla schrolla closed this as not planned Won't fix, can't repro, duplicate, stale May 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue or pull request addresses broken functionality
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants