Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhanced Defender license warnings for policy groups 2 and 4 #929

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
67 commits
Select commit Hold shift + click to select a range
7ab5091
add defender utils function
Dylan-MITRE Feb 21, 2024
63cff12
DefenderConfig.rego
Dylan-MITRE Feb 21, 2024
23cbe14
Defender.rego fix
Dylan-MITRE Feb 21, 2024
acfb81e
Defender.rego unused argument
Dylan-MITRE Feb 21, 2024
4879594
unit test fix for policy 2.x
Dylan-MITRE Feb 22, 2024
0e3c265
Update DefenderConfig_02_test.rego
Dylan-MITRE Feb 22, 2024
1dfa33e
remove enpty lines
Dylan-MITRE Feb 22, 2024
3d3bb3f
unit test update
Dylan-MITRE Feb 22, 2024
a6c2259
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 22, 2024
d769c68
Update DefenderConfig_02_test.rego
Dylan-MITRE Feb 22, 2024
ee950f4
Update Defender.rego
Dylan-MITRE Feb 22, 2024
cf3ab08
Update Defender.rego
Dylan-MITRE Feb 22, 2024
915c64e
unit test 2 update
Dylan-MITRE Feb 22, 2024
e6eeabf
unit test 4 update
Dylan-MITRE Feb 22, 2024
9a9b20d
Update Defender.rego
Dylan-MITRE Feb 22, 2024
aa19a52
Update DefenderConfig_02_test.rego
Dylan-MITRE Feb 22, 2024
d1d25a7
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 22, 2024
0ab6693
Update DefenderConfig.rego
Dylan-MITRE Feb 22, 2024
902ce19
Update DefenderConfig.rego
Dylan-MITRE Feb 22, 2024
1aac123
Update Defender.rego
Dylan-MITRE Feb 22, 2024
2677581
Update DefenderConfig.rego
Dylan-MITRE Feb 22, 2024
0da26cf
Update DefenderConfig.rego
Dylan-MITRE Feb 22, 2024
7f33816
Update DefenderConfig.rego
Dylan-MITRE Feb 22, 2024
b570a2e
Update Defender.rego
Dylan-MITRE Feb 22, 2024
41a1c8a
Update Defender.rego
Dylan-MITRE Feb 22, 2024
6ebabdc
Update Defender.rego
Dylan-MITRE Feb 22, 2024
b9f9652
Update DefenderConfig_02_test.rego
Dylan-MITRE Feb 22, 2024
673eca5
Update Defender.rego
Dylan-MITRE Feb 22, 2024
8746147
Update DefenderConfig_02_test.rego
Dylan-MITRE Feb 22, 2024
8c361a5
change language
Dylan-MITRE Feb 22, 2024
5cf1bd0
update unit test language
Dylan-MITRE Feb 22, 2024
5fe3fde
Update unit test 4 language
Dylan-MITRE Feb 22, 2024
b022df3
Update Defender.rego
Dylan-MITRE Feb 22, 2024
f3268be
unit test 2 update
Dylan-MITRE Feb 22, 2024
ef150bd
unit test 4
Dylan-MITRE Feb 22, 2024
379e175
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 22, 2024
3d5f52a
revert 4.1 4.3 4.4
Dylan-MITRE Feb 27, 2024
5d996bd
rever 4.1 4.3 4.4
Dylan-MITRE Feb 27, 2024
c5a222f
change wording
Dylan-MITRE Feb 27, 2024
39b868c
unit test 2 wording change
Dylan-MITRE Feb 27, 2024
a567224
unit 4 wording change
Dylan-MITRE Feb 27, 2024
5e5ee82
update 4.2
Dylan-MITRE Feb 27, 2024
38bd7eb
update unit test
Dylan-MITRE Feb 27, 2024
57dfa8c
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 27, 2024
45c848e
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 27, 2024
ac472e4
Update DefenderConfig_04_test.rego
Dylan-MITRE Feb 27, 2024
eaa0f77
Update DefenderConfig.rego
Dylan-MITRE Feb 27, 2024
39d2876
Update DefenderConfig.rego
Dylan-MITRE Feb 27, 2024
50076b0
test case wording fix
Dylan-MITRE Feb 27, 2024
832f7ba
Update Defender.rego
Dylan-MITRE Mar 6, 2024
d59d9db
policy 4.x changes
Dylan-MITRE Mar 6, 2024
3f1ec7c
provider add additional error checks
Dylan-MITRE Mar 7, 2024
415bcd4
update dlp license warning
Dylan-MITRE Mar 7, 2024
1f4aab2
Update DefenderConfig.rego
Dylan-MITRE Mar 7, 2024
70a0b3c
fix lint issue
Dylan-MITRE Mar 7, 2024
505e00f
add Utils DLP license true case
Dylan-MITRE Mar 13, 2024
fea9753
* Refactor license warning message
schrolla May 10, 2024
0f46a3b
Correct results filename in warning message
schrolla May 10, 2024
5eacbcc
Extend result file name construction logic
schrolla May 13, 2024
c8cefcd
Fix or ignore long line length style warnings
schrolla May 13, 2024
ef0cc88
* Improve test name for Defender for O365 license tests
schrolla May 16, 2024
ca37278
* Add tests for DLP license error
schrolla May 16, 2024
239a665
Add DLPLicenseWarning when DLP license not present
schrolla May 16, 2024
f9772c5
Remove unused import reference
schrolla May 16, 2024
621d1a6
Replace unused arg with wildcard
schrolla May 16, 2024
b36e02f
Fix spacing to be consistent with other uses in conditionals
schrolla May 31, 2024
8161f92
Rename dlp_license key to defender_dlp_license
schrolla May 31, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions PowerShell/ScubaGear/Modules/Providers/ExportDefenderProvider.psm1
Original file line number Diff line number Diff line change
Expand Up @@ -100,19 +100,36 @@ function Export-DefenderProvider {
$Tracker.AddUnSuccessfulCommand("Get-ProtectionAlert")
}
if ($IPPSConnected) {
$DLPCompliancePolicy = ConvertTo-Json @($Tracker.TryCommand("Get-DlpCompliancePolicy"))
$ProtectionAlert = ConvertTo-Json @($Tracker.TryCommand("Get-ProtectionAlert"))
$DLPComplianceRules = @($Tracker.TryCommand("Get-DlpComplianceRule"))
if (Get-Command Get-DlpCompliancePolicy -ErrorAction SilentlyContinue) {
$DLPCompliancePolicy = ConvertTo-Json @($Tracker.TryCommand("Get-DlpCompliancePolicy"))
$ProtectionAlert = ConvertTo-Json @($Tracker.TryCommand("Get-ProtectionAlert"))
$DLPComplianceRules = @($Tracker.TryCommand("Get-DlpComplianceRule"))
$DLPLicense = ConvertTo-Json $true

# Powershell is inconsistent with how it saves lists to json.
# This loop ensures that the format of ContentContainsSensitiveInformation
# will *always* be a list.

foreach($Rule in $DLPComplianceRules) {
if ($Rule.Count -gt 0) {
$Rule.ContentContainsSensitiveInformation = @($Rule.ContentContainsSensitiveInformation)
foreach($Rule in $DLPComplianceRules) {
if ($Rule.Count -gt 0) {
$Rule.ContentContainsSensitiveInformation = @($Rule.ContentContainsSensitiveInformation)
}
}
}
else {
Write-Warning "Defender for DLP license not available in tenant. Omitting the following commands: Get-DlpCompliancePolicy, Get-DlpComplianceRule, and Get-ProtectionAlert."
$DLPCompliancePolicy = ConvertTo-Json @()
$DLPComplianceRules = ConvertTo-Json @()
$ProtectionAlert = ConvertTo-Json @()
$DLPComplianceRules = ConvertTo-Json @()
$Tracker.AddUnSuccessfulCommand("Get-DlpCompliancePolicy")
$Tracker.AddUnSuccessfulCommand("Get-DlpComplianceRule")
$Tracker.AddUnSuccessfulCommand("Get-ProtectionAlert")
$Tracker.AddSuccessfulCommand("Get-DlpCompliancePolicy")
$Tracker.AddSuccessfulCommand("Get-DlpComplianceRule")
$Tracker.AddSuccessfulCommand("Get-ProtectionAlert")
Sloane4 marked this conversation as resolved.
Show resolved Hide resolved
$DLPLicense = ConvertTo-Json $false
}

# We need to specify the depth because the data contains some
# nested tables.
Expand All @@ -139,6 +156,7 @@ function Export-DefenderProvider {
"admin_audit_log_config": $AdminAuditLogConfig,
"atp_policy_for_o365": $ATPPolicy,
"defender_license": $DefenderLicense,
"defender_dlp_license": $DLPLicense,
"defender_successful_commands": $SuccessfulCommands,
"defender_unsuccessful_commands": $UnSuccessfulCommands,
"@
Expand Down
Loading
Loading