KITT.ps1

<#
    .NOTES
    --------------------------------------------------------------------------------
     Code generated by:  SAPIEN Technologies, Inc., PowerShell Studio 2020 v5.7.179
    --------------------------------------------------------------------------------
    .DESCRIPTION
        GUI script generated by PowerShell Studio 2020
#>


#----------------------------------------------
# Generated Form Function
#----------------------------------------------
function Show-DFIRPowershellGUI_psf {

	#----------------------------------------------
	#region Import the Assemblies
	#----------------------------------------------
	[void][reflection.assembly]::Load('System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089')
	[void][reflection.assembly]::Load('System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a')
	#endregion Import Assemblies

	#----------------------------------------------
	#region Generated Form Objects
	#----------------------------------------------
	[System.Windows.Forms.Application]::EnableVisualStyles()
	$MainForm = New-Object 'System.Windows.Forms.Form'
	$labelEndDate = New-Object 'System.Windows.Forms.Label'
	$LabelStartDate = New-Object 'System.Windows.Forms.Label'
	$UserLabel = New-Object 'System.Windows.Forms.Label'
	$UserProgressTextbox = New-Object 'System.Windows.Forms.RichTextBox'
	$TextBoxUserUPN = New-Object 'System.Windows.Forms.TextBox'
	$buttonSearch = New-Object 'System.Windows.Forms.Button'
	$buttonExit = New-Object 'System.Windows.Forms.Button'
	$SignInLogsTimePickerMax = New-Object 'System.Windows.Forms.DateTimePicker'
	$tabcontrol1 = New-Object 'System.Windows.Forms.TabControl'
	$UserTab = New-Object 'System.Windows.Forms.TabPage'
	$buttonRevokeAzureADRefreshToken = New-Object 'System.Windows.Forms.Button'
	$buttonResetUserPassword = New-Object 'System.Windows.Forms.Button'
	$UserLicenseOutputTextbox = New-Object 'System.Windows.Forms.RichTextBox'
	$UserOutputTextbox = New-Object 'System.Windows.Forms.RichTextBox'
	$EmailTab = New-Object 'System.Windows.Forms.TabPage'
	$buttonRemoveInboxRule = New-Object 'System.Windows.Forms.Button'
	$RuleOutputTextbox = New-Object 'System.Windows.Forms.RichTextBox'
	$RuleSelectionListbox = New-Object 'System.Windows.Forms.ListBox'
	$LoginsTab = New-Object 'System.Windows.Forms.TabPage'
	$buttonUseExistingUsername = New-Object 'System.Windows.Forms.Button'
	$SignInStatsTextBox = New-Object 'System.Windows.Forms.RichTextBox'
	$buttonViewUserFullLogs = New-Object 'System.Windows.Forms.Button'
	$buttonDownloadUserTriageLogs = New-Object 'System.Windows.Forms.Button'
	$buttonDownloadUserFullLogs = New-Object 'System.Windows.Forms.Button'
	$buttonViewUserTriageLogs = New-Object 'System.Windows.Forms.Button'
	$IPTab = New-Object 'System.Windows.Forms.TabPage'
	$buttonViewIPFullLogs = New-Object 'System.Windows.Forms.Button'
	$buttonViewIPTriageLogs = New-Object 'System.Windows.Forms.Button'
	$buttonDownloadIPFullLogs = New-Object 'System.Windows.Forms.Button'
	$buttonDownloadIPTriageLogs = New-Object 'System.Windows.Forms.Button'
	$IPSearchTextBox = New-Object 'System.Windows.Forms.TextBox'
	$IpStatsTextBox = New-Object 'System.Windows.Forms.RichTextBox'
	$buttonUseExistingIP = New-Object 'System.Windows.Forms.Button'
	$buttonUseNewIP = New-Object 'System.Windows.Forms.Button'
	$SearchEmailTab = New-Object 'System.Windows.Forms.TabPage'
	$label2 = New-Object 'System.Windows.Forms.Label'
	$label1 = New-Object 'System.Windows.Forms.Label'
	$labelMessageTraceCmdletOn = New-Object 'System.Windows.Forms.Label'
	$MessageTraceTimePickerMax = New-Object 'System.Windows.Forms.DateTimePicker'
	$MessageTraceTimePickerMin = New-Object 'System.Windows.Forms.DateTimePicker'
	$MessageTraceStatsTextBox = New-Object 'System.Windows.Forms.RichTextBox'
	$buttonViewMessageTraceLogs = New-Object 'System.Windows.Forms.Button'
	$buttonDownloadMessageTrace = New-Object 'System.Windows.Forms.Button'
	$buttonSearchMessageTrace = New-Object 'System.Windows.Forms.Button'
	$FromIPLabel = New-Object 'System.Windows.Forms.Label'
	$FromIPTextbox = New-Object 'System.Windows.Forms.TextBox'
	$RecipientLabel = New-Object 'System.Windows.Forms.Label'
	$RecipientTextbox = New-Object 'System.Windows.Forms.TextBox'
	$SenderLabel = New-Object 'System.Windows.Forms.Label'
	$SenderAddressTextbox = New-Object 'System.Windows.Forms.TextBox'
	$SignInLogsTimePickerMin = New-Object 'System.Windows.Forms.DateTimePicker'
	$InitialFormWindowState = New-Object 'System.Windows.Forms.FormWindowState'
	#endregion Generated Form Objects

	#----------------------------------------------
	# User Generated Script
	#----------------------------------------------
	<#
	
Welcome to KITT - This is a tool designed to make working O365 Business Email Compromise investigations easier and more efficient for DFIR and SOC analysts by pairing the power of PowerShell cmdlets with the ease of use of a GUI.
KITT was built using Sapien's PowerShell Studio. Dates are set to UTC. Powershell Cmdlet limitations limit the pulling of AzureAD SignIn Logs to 30 days, and Message Trace Logs to 10 days. By default, the timepickers are set to those values. 

---------------------------------------------------------------------------	
BEFORE YOU BEGIN:
	1. You'll need to install the following PS modules in order to run this:
	
		AzureADPreview - This is necessary as of 6/2020 because the preview version of AzureAD contains the Get-AzureADAuditSignInLogs cmdlet. You cannot have both AzureAD and AzureADPreview installed at the same time, so it is recommended to use this tool on a Dev system until Microsoft releases that cmdlet to the Prod version of AzureAD. 
		ExchangeOnlineManagement
		MSOnline
	
	2. Please search for "CHANGE_ME" to find two values you will need to change. These are: 
		1. You'll need to add your email address after Connect-ExchangeOnline -UserPrincipalName.  
		2. You'll need to change the variable $script:DomainName to be your domain. That will allow the script to get the password policy for your domain to calculate the password expiration date for a user. 
	
---------------------------------------------------------------------------
Feedback can be left on my Github or sent to the following contact details: 
@IntrepidTechie on Twitter
intrepidtechie@gmail.com
---------------------------------------------------------------------------
Please feel free to contribute to this tool by fixing bugs or providing feedback. I'm not a developer by trade, and would gladly accept feedback from seasoned devs/PowerShell Gurus.
Special thanks to my wonderful wife Kait for constantly supporting me. 
Dedicated to @HumanMalware. RIP bro, you are gone too soon. 
	
	#>
	
	#Loads PS Modules, sets dates of TimePickers, and starts a Transcript of the session. Analysts are asked where to save the transcript and what name to give it.
	
	$MainForm_Load = {
		
		#set default time values for the main TimePickers and MessageTrace TimePickers.
		
		$SignInLogsTimePickerMin.MinDate = (Get-Date).AddDays(-30).ToUniversalTime()
		$SignInLogsTimePickerMin.Value = (Get-Date).AddDays(-30).ToUniversalTime()
		$SignInLogsTimePickerMin.MaxDate = (Get-Date).ToUniversalTime()
		$SignInLogsTimePickerMax.MinDate = (Get-Date).AddDays(-30).ToUniversalTime()
		$SignInLogsTimePickerMax.Value = (Get-Date).ToUniversalTime()
		$SignInLogsTimePickerMax.MaxDate = (Get-Date).ToUniversalTime()
		$MessageTraceTimePickerMin.MinDate = (Get-Date).AddDays(-10).ToUniversalTime()
		$MessageTraceTimePickerMin.Value = (Get-Date).AddDays(-10).ToUniversalTime()
		$MessageTraceTimePickerMin.MaxDate = (Get-Date).ToUniversalTime()
		$MessageTraceTimePickerMax.MinDate = (Get-Date).AddDays(-10).ToUniversalTime()
		$MessageTraceTimePickerMax.Value = (Get-Date).ToUniversalTime()
		$MessageTraceTimePickerMax.MaxDate = (Get-Date).ToUniversalTime()
		
		
		#Prompts analyst for location and filename to save a transcript of actions taken while running the tool. 
		$Timestamp = Get-Date -Format o | ForEach-Object { $_ -replace ":", "." }
		$TranscriptFileName = "Transcript_$($Timestamp)"
		$TranscriptFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$TranscriptFileDialog.InitialDirectory = ".\"
		$TranscriptFileDialog.FileName = $TranscriptFileName
		$TranscriptFileDialog.DefaultExt = "txt"
		$TranscriptFileDialog.Filter = "txt (*.txt)|*.txt|All files (*.*)|*.*"
		$TranscriptFileDialog.Title = "Please choose a location to save the transcript of actions ran while this tool was used:"
		if ($TranscriptFileDialog.ShowDialog() -eq 'OK')
		{
			Start-Transcript -Path $TranscriptFileDialog.FileName
			Write-Host "Started Transcript"
		}
		
		
		
		#Sign into O365 
		AzureADPreview\Connect-AzureAD
		Connect-ExchangeOnline -UserPrincipalName "CHANGE_ME"
		Connect-MsolService 
	}
	
	
	
	#This function is designed to pull and display basic information about the user searched for. Please add your Domain Name for the $script:DomainName variable. That variable is used to calculate the password expiration dates. 
	Function GetUserInformation
	{
		$script:DomainName = "CHANGE_ME"
		#Pull User information
		$UserProgressTextbox.Text = "Getting User Information for $script:UserUPN"
		$UserInformation = Get-MsolUser -UserPrincipalName $script:UserUPN | Select-Object FirstName, LastName, Title, Department, StreetAddress, City, State, PostalCode, PhoneNumber, MobilePhone, Licenses, isLicensed
		Write-Host "Analyst began pull of User Information for $script:UserUPN"
		#If Property doesn't exist, set property value to "No Data"
		$UserInformation | ForEach-Object {
			foreach ($property in $_.PSObject.Properties)
			{
				if ($property.Value -eq $Null)
				{
					$property.Value = "No Data"
				}
			}
		}
		$UserSummary = "`r`nName: $($UserInformation.FirstName) $($UserInformation.LastName)`r`nTitle: $($UserInformation.Title)`r`nDepartment: $($UserInformation.Department)`r`nPhoneNumber: $($UserInformation.PhoneNumber)`r`nMobile Number: $($UserInformation.MobilePhone)`r`nAddress: `r`n`r`n$($UserInformation.StreetAddress)`r`n$($UserInformation.City), $($UserInformation.State) $($UserInformation.PostalCode)`r`n`r`n" | Out-String
		
		#Pull user password information, compute password expiration date using password policy, and display user password information. 
		$UserProgressTextbox.Text = "Getting Password Information for $script:UserUPN"
		$PasswordPolicy = Get-MsolPasswordPolicy -DomainName $script:DomainName
		Write-Host "Analyst began pull of Password Policy"
		$UserPasswordChangeDate = Get-MsolUser -UserPrincipalName $script:UserUPN | Select-Object LastPasswordChangeTimestamp
		Write-Host "Analyst began pull of  Last Password change for $UserUPN"
		$UserPasswordChangeDateOutput = $UserPasswordChangeDate.LastPasswordChangeTimestamp | Out-String
		$PasswordExpirationDate = $UserPasswordChangeDate.LastPasswordChangeTimestamp.AddDays($PasswordPolicy.ValidityPeriod) | Out-String
		
		$UserOutputTextbox.Text = "User Information: `r`n $UserSummary"
		$UserOutputTextbox.AppendText("User's password was last changed on: $($UserPasswordChangeDateOutput)`r`n")
		$UserOutputTextbox.AppendText("User's password expires on: $PasswordExpirationDate`r`n")
		
		
		#Display user license information, if user is licensed, sorted by ProvisioningStatus. 
		$UserProgressTextbox.Text = "Getting License Information for $script:UserUPN"
		Write-Host "Analyst began pull of  license information for $script:UserUPN"
		if ($UserInformation.IsLicensed -eq $true)
		{
			$LicenseInfo = $UserInformation.Licenses
			$UserLicenses = @()
			for ($counter = 0; $counter -lt $LicenseInfo.Count; $counter++)
			{
				$UserLicenses += "License:" + $LicenseInfo[$counter].AccountSkuId + "`r`n"
				$UserLicenses += $LicenseInfo[$counter].ServiceStatus | Sort-Object -Property ProvisioningStatus
				$UserLicenses += ""
			}
			$UserLicenses = $UserLicenses | Out-String
			$UserLicenseOutputTextbox.Text = $UserLicenses
		}
		else
		{
			$UserLicenseOutputTextbox.Text = "User is not Licensed."
		}
		
		#Pull user forwarding settings. These can be changed by an attacker to forward mail out of the organization. 
		$UserProgressTextbox.Text = "Getting Forwarding Settings for $script:UserUPN"
		Write-Host "Analyst began pull of  Forwarding settings for $script:UserUPN"
		$UserForwardingSettings = Get-EXOMailbox -Identity $script:UserUPN | Select-Object ForwardingSMTPAddress, ForwardingAddress, DeliverToMailboxAndForward
		$UserForwardingSettings | ForEach-Object {
			foreach ($property in $_.PSObject.Properties)
			{
				if ($property.Value -eq $Null)
				{
					$property.Value = "Not set"
				}
			}
		}
		
		
		$UserOutputTextbox.AppendText("`r`nUser Forwarding settings:`r`nForwarding Address: $($UserForwardingSettings.ForwardingAddress)`r`nForwardingSMTPAddress: $($UserForwardingSettings.ForwardingSMTPAddress)`r`nDeliver to Mailbox and Forward: $($UserForwardingSettings.DeliverToMailboxandForward)")
		$UserProgressTextbox.Text = "Done pulling User Information for $script:UserUPN"
		Write-Host "Done pulling all information for $script:UserUPN"
	}
	
	#This function pulls and displays the user's inbox rules. These are often set by attackers in order to hide nefarious activity. 
	Function InvestigateInboxRules
	{
		$UserProgressTextbox.Text = "Getting Inbox Rules for $script:UserUPN"
		$RuleOutputTextbox.Text = ""
		$script:InboxRules = @(Get-InboxRule -Mailbox $script:UserUPN)
		Write-Host "Analyst began pull of Inbox Rules for $script:UserUPN"
		$RuleList = @()
		$script:InboxRuleSummary = @()
		#If any Inbox Rules are found, display their name, discription, and whether or not they are enabled. 
		if ($script:InboxRules.Count -ne 0)
		{
			
	
			
			
			for ($counter = 1; $counter -le $script:InboxRules.Count; $counter++)
			{
				
				$RuleList += "Rule " + $counter + ": " + $script:InboxRules[$counter - 1].Name + "`r`n"
			}
			$RuleSelectionListbox.Items.AddRange($RuleList)
			$RuleSelectionListbox.SelectedIndex = 0
			$script:RuleIndex = $RuleSelectionListbox.SelectedIndex
			
			
			for ($counter = 0; $counter -le $script:InboxRules.Count; $counter++)
			{
				$script:InboxRuleSummary += $($script:InboxRules[$counter]) | Select-Object Name, Description, Enabled
			}
			$RuleSelectionListbox.SetSelected($script:RuleIndex, $true)
		}
		
		
		elseif ($script:InboxRules.Count -eq 0)
		{
			$RuleOutputTextbox.Text = "No Rules found for user specified."
		}
		
		$UserProgressTextbox.Text = "Done pulling Inbox Rules for $script:UserUPN"
		Write-Host "Done pulling Inbox Rules for $script:UserUPN"
		
	}
	
	#This function pulls AzureSignIn logs for the user specified. It will show statistics about the signin logs in the panel on the left. 
	#You can also view and filter the logs using the "View" buttons as well as download them with the "Download" buttons. 
	#View and Download are broken up into two groups: Triage and Full. Full logs are exactly what is pulled, with all fields present. 
	#Triage logs are parsed to show only a few fields to make quick work of confirming a sign-in. 
	Function PullAzureADAuditSignInLogs
	{
		$UserProgressTextbox.Text = "Getting Azure AD Sign In Logs for User $script:UserUPN"
		$script:FullUserLogs = @()
		$script:FullUserLogs = Get-AzureADAuditSignInLogs -Filter "userPrincipalName eq '$script:UserUPN' and createdDateTime ge $script:MinTime and createdDateTime le $script:MaxTime"
		Write-Host "Analyst began pull of AzureAD SignIn Logs"
	
		#Cmdlet only pulls 1000 logs at a time. This will loop until all logs are pulled. 
		If ($script:FullUserLogs.Count -eq 1000)
		{
			do
			{
				$lastArrayItem = $script:FullUserLogs.Count - 1
				$script:MaxTime = $script:FullUserLogs[$lastArrayItem].createdDateTime
				$script:FullUserLogs += Get-AzureADAuditSignInLogs -Filter "userPrincipalName eq '$script:UserUPN' and createdDateTime ge $script:MinTime and createdDateTime lt $script:MaxTime"
				
				
			}
			While ($script:FullUserLogs.Count % 1000 -eq 0)
			
		}
		Write-Host $script:FullUserLogs.Count "pulled."
		$script:TriageLogs = $script:FullUserLogs | Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, AppDisplayName, IpAddress, ClientAppUsed, Status, DeviceDetail, Location, AuthenticationProcessingDetails
		$IPAddressCount = $script:FullUserLogs.IpAddress | Group-Object -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
		$BrowserCount = $script:FullUserLogs.DeviceDetail | Group-Object Browser, OperatingSystem -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
		$ApplicationCount = $script:FullUserLogs.AppDisplayName | Group-Object -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
		If ($script:FullUserLogs.Count -eq 0)
		{
			$SignInStatsTextBox.Text = "No logs found for User during timeframe specified."
		}
		Else
		{
			
			$SignInStatsTextBox.Text = "Logs for User $($script:UserUPN):`r`n"
			$SignInStatsTextBox.AppendText("Unique IP Addresses used for SignIn:`r`n")
			$SignInStatsTextBox.AppendText($($IPAddressCount))
			$SignInStatsTextBox.AppendText("`r`n")
			$SignInStatsTextBox.AppendText("Device Details:`r`n")
			$SignInStatsTextBox.AppendText($($BrowserCount))
			$SignInStatsTextBox.AppendText("`r`n")
			$SignInStatsTextBox.AppendText("Application Count:`r`n")
			$SignInStatsTextBox.AppendText($($ApplicationCount))
		}
		
		$UserProgressTextbox.Text = "Done Pulling AzureAD SignIn Logs for $script:UserUPN"
		Write-Host "Done Pulling AzureAD SignIn Logs for $script:UserUPN"
	}
	#This function pulls AzureSignIn logs for the IP specified. It will show statistics about the signin logs in the panel on the left. 
	#You can also view and filter the logs using the "View" buttons as well as download them with the "Download" buttons. 
	#View and Download are broken up into two groups: Triage and Full. Full logs are exactly what is pulled, with all fields present. 
	#Triage logs are parsed to show only a few fields to make quick work of confirming a sign-in. 
	Function SearchAzureADSignInLogsExistingIP
	{
		$UserProgressTextbox.Text = "Getting AzureAD SignIn Logs for $script:ExistingIP"
		$script:FullIPLogs = @()
		$script:FullIPLogs = Get-AzureADAuditSignInLogs -Filter "IpAddress eq '$script:ExistingIP' and createdDateTime ge $script:MinTime and createdDateTime le $script:MaxTime"
		Write-Host "Analyst began pull of AzureAD SignIn Logs for $script:ExistingIP"
		#Cmdlet only allows 1000 logs to be pulled at a time. This will loop until all logs are pulled.
		If ($script:FullIPLogs.Count -eq 1000)
		{
			do
			{
				$lastArrayItem = $script:FullIPLogs.Count - 1
				$script:MaxTime = $script:FullIPLogs[$lastArrayItem].createdDateTime
				$script:FullIPLogs += Get-AzureADAuditSignInLogs -Filter "IpAddress eq '$script:ExistingIP' and createdDateTime ge $script:MinTime and createdDateTime lt $script:MaxTime"
				
				
			}
			While ($script:FullIPLogs.Count % 1000 -eq 0)
			
		}
		Write-Host $script:FullIPLogs.Count " logs pulled."
		
		$script:TriageIPLogs = $script:FullIPLogs | Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, AppDisplayName, IpAddress, ClientAppUsed, Status, DeviceDetail, Location, AuthenticationProcessingDetails
		
		If ($script:FullIPLogs.Count -ne 0)
		{
			
			$UserList = $script:FullIPLogs | Sort-Object -Property UserPrincipalName | Group-Object -Property UserPrincipalName -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$DeviceDetails = $script:FullIPLogs.DeviceDetail | Group-Object Browser, OperatingSystem -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$ApplicationCount = $script:FullIPLogs.AppDisplayName | Group-Object -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$IpStatsTextBox.Text = "List of Users from $($script:ExistingIP): `r`n"
			$IpStatsTextBox.AppendText($($UserList))
			$IpStatsTextBox.AppendText("`r`n")
			$IpStatsTextBox.AppendText("Device Details:`r`n")
			$IpStatsTextBox.AppendText($($DeviceDetails))
			$IpStatsTextBox.AppendText("`r`n")
			$IpStatsTextBox.AppendText("Application Details:`r`n")
			$IpStatsTextBox.AppendText($($ApplicationCount))
		}
		elseif ($script:FullIPLogs.Count -eq 0)
		{
			$IpStatsTextBox.Text = "No logs found for IP and timeframe specified."
		}
		
		$UserProgressTextbox.Text = "Done pulling SignIn Logs for IP $script:ExistingIP"
		Write-Host "Done pulling SignIn Logs for IP $script:ExistingIP"
		
	}
	
	#This function pulls AzureSignIn logs for the IP specified. It will show statistics about the signin logs in the panel on the left. 
	#You can also view and filter the logs using the "View" buttons as well as download them with the "Download" buttons. 
	#View and Download are broken up into two groups: Triage and Full. Full logs are exactly what is pulled, with all fields present. 
	#Triage logs are parsed to show only a few fields to make quick work of confirming a sign-in.
	
	Function SearchAzureADSignInLogsNewIP
	{
		$UserProgressTextbox.Text = "Getting Azure AD SignIn Logs for $script:NewIP"
		
		$script:FullIPLogs = @()
		$script:FullIPLogs = Get-AzureADAuditSignInLogs -Filter "IpAddress eq '$script:NewIP' and createdDateTime ge $script:MinTime and createdDateTime le $script:MaxTime"
		Write-Host "Analyst began pull of AzureAD SignIn Logs for $script:NewIP"
		#Cmdlet only allows pulling of 1000 logs. This will loop until all logs are pulled. 
		If ($script:FullIPLogs.Count -eq 1000)
		{
			do
			{
				$lastArrayItem = $script:FullIPLogs.Count - 1
				$script:MaxTime = $script:FullIPLogs[$lastArrayItem].createdDateTime
				$script:FullIPLogs += Get-AzureADAuditSignInLogs -Filter "IpAddress eq '$script:NewIP' and createdDateTime ge $script:MinTime and createdDateTime lt $script:MaxTime"
				
				
			}
			While ($script:FullIPLogs.Count % 1000 -eq 0)
			
		}
		Write-Host $script:FullIPLogs.Count " logs pulled."
		$script:TriageIPLogs = $script:FullIPLogs | Select-Object CreatedDateTime, UserDisplayName, UserPrincipalName, AppDisplayName, IpAddress, ClientAppUsed, Status, DeviceDetail, Location, AuthenticationProcessingDetails
		If ($script:FullIPLogs.Count -ne 0)
		{
			$UserList = $script:FullIPLogs | Sort-Object -Property UserPrincipalName | Group-Object -Property UserPrincipalName -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$DeviceDetails = $script:FullIPLogs.DeviceDetail | Group-Object Browser, OperatingSystem -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$ApplicationCount = $script:FullIPLogs.AppDisplayName | Group-Object -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$IpStatsTextBox.Text = "List of Users from $($script:NewIP): `r`n"
			$IpStatsTextBox.AppendText($($UserList))
			$IpStatsTextBox.AppendText("`r`n")
			$IpStatsTextBox.AppendText("Device Details:`r`n")
			$IpStatsTextBox.AppendText($($DeviceDetails))
			$IpStatsTextBox.AppendText("`r`n")
			$IpStatsTextBox.AppendText("Application Details:`r`n")
			$IpStatsTextBox.AppendText($($ApplicationCount))
		}
		Elseif ($script:FullIPLogs.Count -eq 0)
		{
			$IpStatsTextBox.Text = "No results found. Please try another search."
		}
		
		$UserProgressTextbox.Text = "Done pulling SignIn Logs for IP $script:NewIP"
		Write-Host "Done pulling SignIn Logs for IP $script:NewIP"
	}
	#This function pulls Message Trace logs filtering on a variety of inputs. It will stop and alert the user if it reaches the cmdlet maximum of 1 Million logs.  
	#Pulls 5000 logs at a time, and will loop until all logs are retrieved. 
	Function SearchMessageTrace
	{
		$UserProgressTextbox.Text = "Pulling Message Trace Logs"
		$MessageTraceStatsTextBox.Text = ""
		$Filter = $null
		$script:MessageTraceLogs = @()
		$script:MessageTraceStartDate = $MessageTraceTimePickerMin.Value
		$script:MessageTraceEndDate = $MessageTraceTimePickerMax.Value
		#This horrendous mess is an if-else tree designed to only search for the parameters provided by the analyst. 
		If ($script:SenderAddress -eq $null -and $script:RecipientAddress -eq $null -and $script:MessageTraceFromIP -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -PageSize 5000
			Write-Host "Analyst began Pull of Message Trace Logs with no parameters."
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs += Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -PageSize 5000
					
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
		}
		elseif ($script:RecipientAddress -eq $null -and $script:SenderAddress -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -FromIp $script:MessageTraceFromIP -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameter $script:MessageTraceFromIP"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -FromIp $script:MessageTraceFromIP -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
			
		}
		elseif ($script:MessageTraceFromIP -eq $null -and $script:SenderAddress -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -RecipientAddress $script:RecipientAddress -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameter $script:RecipientAddress"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -RecipientAddress $script:RecipientAddress -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
			
		}
		elseif ($script:RecipientAddress -eq $null -and $script:MessageTraceFromIP -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameters $script:SenderAddress"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
		}
		elseif ($script:MessageTraceFromIP -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -RecipientAddress $script:RecipientAddress -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameters of $script:SenderAddress and $script:RecipientAddress"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -RecipientAddress $script:RecipientAddress -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
		}
		elseif ($script:SenderAddress -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -RecipientAddress $script:RecipientAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameters $script:RecipientAddress and $script:MessageTraceFromIP"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -RecipientAddress $script:RecipientAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
		}
		elseif ($script:RecipientAddress -eq $null)
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
			Write-Host "Analyst began pull of Message Trace logs using parameters $script:SenderAddress and $script:MessageTraceFromIP"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
		}
		else
		{
			$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -RecipientAddress $script:RecipientAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
			Write-Host "Analyst began pull of Message Trace Logs using parameters $script:SenderAddress and $script:RecipientAddress and $script:MessageTraceFromIP"
			If ($script:MessageTraceLogs.Count -eq 5000)
			{
				do
				{
					$lastArrayItem = $script:MessageTraceLogs.Count - 1
					$script:MessageTraceStartDate = $script:MessageTraceLogs[$lastArrayItem].Received
					$script:MessageTraceLogs = Get-MessageTrace -StartDate $script:MessageTraceStartDate -EndDate $script:MessageTraceEndDate -SenderAddress $script:SenderAddress -RecipeientAddress $script:RecipientAddress -FromIP $script:MessageTraceFromIP -PageSize 5000
					Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
					
					
				}
				While ($script:MessageTraceLogs.Count % 5000 -eq 0 -and $script:MessageTraceLogs.Count -ne 1000000)
				
			}
			Write-Host @($script:MessageTraceLogs).Count " Message Trace Logs pulled"
			If ($script:MessageTraceLogs.Count -eq 1000000)
			{
				$UserProgressTextbox.Text = "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
				Write-Host "Pulled Cmdlet Maximum of 1M Logs. Recommend shorter timeframe"
			}
			
			
		}
		#Sort and Display statistics about the Message Trace logs pulled. 
		If ($script:MessageTraceLogs.Count -ne 0)
		{
			
			$SenderList = $script:MessageTraceLogs | Sort-Object -Property SenderAddress | Group-Object -Property SenderAddress -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$RecipientList = $script:MessageTraceLogs | Sort-Object -Property RecipientAddress | Group-Object -Property RecipientAddress -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$DeliveryStatus = $script:MessageTraceLogs | Sort-Object -Property Status | Group-Object -Property Status -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$FromIPList = $script:MessageTraceLogs | Sort-Object -Property FromIP | Group-Object -Property FromIP -NoElement | Sort-Object Count -Descending | Format-Table -AutoSize | Out-String
			$MessageTraceStatsTextBox.Text = "Message Trace Search Statistics:`r`n`r`n"
			$MessageTraceStatsTextBox.AppendText("Total Logs: $($script:MessageTraceLogs.Count)`r`n")
			$MessageTraceStatsTextBox.AppendText("List of Senders `r`n")
			$MessageTraceStatsTextBox.AppendText($($SenderList))
			$MessageTraceStatsTextBox.AppendText("`r`n")
			$MessageTraceStatsTextBox.AppendText("Recipient List`r`n")
			$MessageTraceStatsTextBox.AppendText($($RecipientList))
			$MessageTraceStatsTextBox.AppendText("`r`n")
			$MessageTraceStatsTextBox.AppendText("Delivery Overview:`r`n")
			$MessageTraceStatsTextBox.AppendText($($DeliveryStatus))
			$MessageTraceStatsTextBox.AppendText("From IP List:`r`n")
			$MessageTraceStatsTextBox.AppendText($($FromIPList))
		}
		elseif ($script:MessageTraceLogs.Count -eq 0)
		{
			$MessageTraceStatsTextBox.Text = "0 logs found for input parameters. Please try other parameters."
		}
		
		$UserProgressTextbox.Text = "Done Pulling Message Trace Logs"
		Write-Host "Done Pulling Message Trace Logs"
		
	}
	
	
	
	#If the analyst clicks a different Inbox Rule in the list, change the Rule information to match the selection. 
	$RuleSelectionListbox_SelectedIndexChanged = {
		$script:RuleIndex = $RuleSelectionListbox.SelectedIndex
		$RuleOutputTextbox.Text = "Name: $($script:InboxRuleSummary[$script:RuleIndex].Name)`r`n`r`nDescription: `r`n$($script:InboxRuleSummary[$script:RuleIndex].Description)`r`n`r`nEnabled: $($script:InboxRuleSummary[$script:RuleIndex].Enabled)"
	}
	#Stops Transcript upon clicking the Exit Button. 
	$buttonExit_Click = {
		
		Get-PSSession | Remove-PSSession
		Stop-Transcript
	}
	#Prompts the analyst with a Yes/No to ensure they actually want to change the user's password. If Yes, password is set to a randomly chosen password by the cmdlet and that password is displayed to the analyst. 
	$buttonResetUserPassword_Click = {
		Write-Host "Analyst clicked Password Reset Button"
		$response = [System.Windows.Forms.MessageBox]::Show('Reset Password for user: ' + $script:UserUPN, 'Reset Password?', 'YesNo')
		if ($response -eq 'Yes')
		{
			$randompassword = Set-MsolUserPassword -UserPrincipalName $script:UserUPN -ForceChangePassword $true
			[System.Windows.Forms.MessageBox]::Show('Password Set to: ' + $randompassword)
			Write-Host "Analyst reset $script:UserUPN password"
		}
		if ($response -eq 'No')
		{
			[System.Windows.Forms.MessageBox]::Show('No Action Taken')
			Write-Host "Analyst did not reset password for $script:UserUPN"
		}
		
	}
	
	#Set earliest time searched to reflect value changed in the "Start Date" TimePicker. Also restricts the Min Date in the "End Date" TimePicker to reflect the analyst choice. 
	$SignInLogsTimePickerMin_ValueChanged = {
		
		$script:MinTime = $SignInLogsTimePickerMin.Value.ToString("yyyy-MM-dd")
		$SignInLogsTimePickerMax.MinDate = $SignInLogsTimePickerMin.Value
	}
	#Set latest time searched to reflect value changed in the "End Date" TimePicker. Also restricts the Max Date in the "Start Date" TimePicker to reflect the analyst choice. 
	$SignInLogsTimePickerMax_ValueChanged = {
		
		$script:MaxTime = $SignInLogsTimePickerMax.Value.ToString("yyyy-MM-dd")
		$SignInLogsTimePickerMin.MaxDate = $SignInLogsTimePickerMax.Value
	}
	
	#Allows analyst to View triage logs upon button click. 
	$buttonViewUserTriageLogs_Click = {
		
		$script:TriageLogs | Out-GridView -Title "Triage Logs"
		Write-Host "Analyst viewed Triage Logs"
	}
	#Prompts analyst for save location and file name before saving triage logs. 
	$buttonDownloadUserTriageLogs_Click = {
		
		
		$UserSaveFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$UserSaveFileDialog.InitialDirectory = ".\"
		$UserSaveFileDialog.FileName = "$($script:UserUPN)_TriageLogs_.csv"
		$UserSaveFileDialog.DefaultExt = "csv"
		$UserSaveFileDialog.Filter = "CSV (*.csv)|*.csv|All files (*.*)|*.*"
		if ($UserSaveFileDialog.ShowDialog() -eq 'OK')
		{
			$script:TriageLogs | Export-Csv -Path $UserSaveFileDialog.FileName -NoTypeInformation
			Write-Host "Analyst downloaded Triage Logs"
		}
	}
	#Allows analyst to view full logs upon button click. 
	$buttonViewUserFullLogs_Click = {
		
		$script:FullUserLogs | Out-GridView -Title "Full Logs"
		Write-Host "Analyst viewed User SignIn Full Logs"
	}
	
	
	#Prompts analyst for save location and file name before saving full logs. 
	$buttonDownloadUserFullLogs_Click = {
		
		
		$UserSaveFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$UserSaveFileDialog.InitialDirectory = ".\"
		$UserSaveFileDialog.FileName = "$($script:UserUPN)_FullLogs_.csv"
		$UserSaveFileDialog.DefaultExt = "csv"
		$UserSaveFileDialog.Filter = "CSV (*.csv)|*.csv|All files (*.*)|*.*"
		if ($UserSaveFileDialog.ShowDialog() -eq 'OK')
		{
			$script:FullUserLogs | Export-Csv -Path $UserSaveFileDialog.FileName -NoTypeInformation
			Write-Host "Analyst downloaded User SignIn Full Logs"
		}
	}
	
	
	#Allows analyst to chose IP from "Logins by User" tab to use for their search. 
	$buttonUseExistingIP_Click = {
		
		
		$IP = $script:FullUserLogs | Select-Object IPAddress | Group-Object IpAddress -NoElement | Select-Object Name | Out-GridView -Title "Select an IP" -PassThru
		If ($IP.Count -eq 0)
		{
			$IpStatsTextBox.Text = "No IPs found in User Tab or user canceled choice."
		}
		else
		{
			$script:ExistingIP = $IP.Name
			$IPSearchTextBox.Text = $script:ExistingIP
			SearchAzureADSignInLogsExistingIP
		}
		
	}
	
	#Searches Message Trace upon analyst clicking button. Will also check IP value provided to ensure it is valid. This IP check works for IPv4 and IPv6 addresses.
	$buttonSearchMessageTrace_Click = {
		
		Write-Host "Analyst began search of Message Trace logs"
		
		$script:MessageTraceFromIP = $null
		$script:SenderAddress = $null
		$script:RecipientAddress = $null
		
		if ($SenderAddressTextbox.TextLength -ne 0)
		{
			$script:SenderAddress = $SenderAddressTextbox.Text
		}
		if ($RecipientTextbox.TextLength -ne 0)
		{
			$script:RecipientAddress = $RecipientTextbox.Text
		}
		
		
		if ($FromIPTextbox.TextLength -ne 0)
		{
			$text = $FromIPTextbox.Text
			$IP = [ipaddress]$text
			if ($IP.IPAddressToString)
			{
				$script:MessageTraceFromIP = $IP.IPAddressToString
			}
		
		}
		If (!$IP.IPAddressToString -and $FromIPTextbox.TextLength -ne 0)
		{
			$MessageTraceStatsTextBox.Text = "Error - Please enter a valid IP."
		}
		elseif (!$script:MessageTraceFromIP -and !$script:SenderAddress -and !$script:RecipientAddress)
		{
			$MessageTraceStatsTextBox.Text = "Please Enter at least one search parameter."
		}
		else
		{
			SearchMessageTrace
		}
	}
	
	#Allows analyst to view MessageTrace Logs upon clicking button. 
	$buttonViewMessageTraceLogs_Click = {
		
		$script:MessageTraceLogs | Out-GridView
		Write-Host "Analyst viewed Message Trace Logs"
	}
	#Prompts analyst for file name and location before saving MessageTrace Logs. 
	$buttonDownloadMessageTrace_Click = {
		
		$UserSaveFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$UserSaveFileDialog.InitialDirectory = ".\"
		$UserSaveFileDialog.FileName = "MessageTraceOutput_.csv"
		$UserSaveFileDialog.DefaultExt = "csv"
		$UserSaveFileDialog.Filter = "CSV (*.csv)|*.csv|All files (*.*)|*.*"
		if($UserSaveFileDialog.ShowDialog() -eq 'OK'){
			
			$script:MessageTraceLogs | Export-Csv -Path $UserSaveFileDialog.FileName -NoTypeInformation
			Write-Host "Analyst downloaded Message Trace Logs"
		}
		
		
		
	}
	
	
	
	#Allows analyst to remove Inbox rule if deemed malicious. Will prompt analyst for confirmation first before removing rule. 
	$buttonRemoveInboxRule_Click = {
		
		Write-Host "Analyst clicked button to remove Inbox Rule "$script:InboxRules[$script:RuleIndex].Name
		
		$response = [System.Windows.Forms.MessageBox]::Show('Remove Inbox Rule: ' + $script:InboxRules[$script:RuleIndex].Name, 'Remove Inbox Rule?', 'YesNo')
		if ($response -eq 'Yes')
		{
			Remove-InboxRule -Mailbox $script:UserUPN -Identity $script:InboxRules[$script:RuleIndex].RuleIdentity -Force
			[System.Windows.Forms.MessageBox]::Show('Rule Removed: ' + $script:InboxRules[$script:RuleIndex].Name)
			Write-Host "Analyst Removed Inbox Rule "$script:InboxRules[$script:RuleIndex].Name
			$RuleSelectionListbox.Items.Clear()
			$script:InboxRuleSummary = @()
			InvestigateInboxRules
		}
		if ($response -eq 'No')
		{
			[System.Windows.Forms.MessageBox]::Show('No Action Taken')
			Write-Host "Analyst canceled action of removing Inbox Rule."
		}
	}
	#Allows analyst to revoke AzureAD Refresh Token for a user. Will prompt analyst for confirmation.  Please see Microsoft documentation for more information. 
	$buttonRevokeAzureADRefreshToken_Click = {
		
		Write-Host "Analyst clicked Revoke AzureAD token button"
		
		$response = [System.Windows.Forms.MessageBox]::Show('Revoke AzureAD Refresh Token for User:' + $script:UserUPN, 'Revoke AzureAD Refresh Token?', 'YesNo')
		if ($response -eq 'Yes')
		{
			$User = Get-AzureADUser -ObjectId $script:UserUPN
			try
			{
				Revoke-AzureADUserAllRefreshToken -ObjectId $User.ObjectId
				[System.Windows.Forms.MessageBox]::Show('Token Revoked for user: ' + $script:UserUPN)
			}
			catch
			{
				[System.Windows.Forms.MessageBox]::Show('An Error Occured. Please try again later.')
			}
			Write-Host "Analyst revoked AzureAD Refresh Token"
		}
		if ($response -eq 'No')
		{
			[System.Windows.Forms.MessageBox]::Show('No Action Taken')
			Write-Host "Analyst did not revoke AzureAD Refresh Token for $script:UserUPN"
		}
	}
	
	#Allows analyst to search for a user that was found through an "Logins by IP" search.
	$buttonUseExistingUsername_Click = {
		
		$User = $script:FullIPLogs | Select-Object UserPrincipalName | Group-Object UserPrincipalName -NoElement | Select-Object Name | Out-GridView -Title "Select a User" -PassThru
		
		If ($User.Count -eq 0)
		{
			$SignInStatsTextBox.Text = "No Users found in IP Tab or user canceled choice."
		}
		else
		{
			$TextBoxUserUPN.Text = $User.Name
			$RuleSelectionListbox.Items.Clear()
			$script:InboxRuleSummary = @()
			$script:UserUPN = $TextBoxUserUPN.Text
			GetUserInformation
			InvestigateInboxRules
			PullAzureADAuditSignInLogs
		}
	
		
		
		
	}
	
	#Set earliest date searched to reflect value changed in the "Start Date" TimePicker for Message Trace. Also restricts the Min Date in the "End Date" TimePicker to reflect the analyst choice.
	$MessageTraceTimePickerMin_ValueChanged = {
		
		$script:MessageTraceStartDate = $MessageTraceTimePickerMin.Value.ToString("yyyy-MM-dd")
		$MessageTraceTimePickerMax.MinDate = $MessageTraceTimePickerMin.Value
		
	}
	#Set latest date searched to reflect value changed in the "End Date" TimePicker for Message Trace. Also restricts the Max Date in the "Start Date" TimePicker to reflect the analyst choice.
	$MessageTraceTimePickerMax_ValueChanged = {
		
		$script:MessageTraceEndDate = $MessageTraceTimePickerMax.Value.ToString("yyyy-MM-dd")
		$MessageTraceTimePickerMin.MaxDate = $MessageTraceTimePickerMax.Value
		
	}
	#Allows analyst to search "Logins by IP" using a fresh IP. This will do a check to ensure the IP is valid. It accepts IPv4 and IPv6 addresses. 
	$buttonUseNewIP_Click = {
		
		
		$script:NewIP = $null
		If ($IPSearchTextBox.TextLength -eq 0)
		{
			$IpStatsTextBox.Text = "Please enter an IP"
		}
		Else
		{
			$text = $IPSearchTextBox.Text
			Write-Host $IP
			try
			{
				$IP = [ipaddress]$text
				$script:NewIP = $IP.IPAddressToString
				SearchAzureADSignInLogsNewIP
			}
			
			
			catch
			{
				$IpStatsTextBox.Text = "Please enter a valid IP"
			}
			
			
		}
	}
	
	#Performs a Get-MsolUser -SearchString using analyst input. This will search for users matching the analyst input.
	$buttonSearch_Click= {
		Write-Host "Analyst attempted search using"$TextBoxUserUPN.Text
		$RuleSelectionListbox.Items.Clear()
		$UserLicenseOutputTextbox.Text = ""
		$RuleOutputTextbox.Text = ""
		$SignInStatsTextBox.Text = ""
		$script:InboxRuleSummary = @()
		$script:UserUPN = $TextBoxUserUPN.Text
		$Users = Get-MsolUser -SearchString "$script:UserUPN"
		#If no matches are found, alert the analyst. 
		if ($Users.Count -eq 0)
		{
			$UserOutputTextbox.Text = "No Users found for this search term."
			$UserProgressTextbox.Text = "No Users found for this search term."
			Write-Host "No users found for Analyst search term"
		}
		#If one match is found, begin pulling user information immediately. 
		elseif ($Users.Count -eq 1)
		{
			Write-Host "1 user match found. Beginning pull of user information for $script:UserUPN"
			$script:UserUPN = $Users.UserPrincipalName
			$TextBoxUserUPN.Text = "$script:UserUPN"
			GetUserInformation
			InvestigateInboxRules
			PullAzureADAuditSignInLogs
		}
		#If two or more users match the input, allow the analyst to choose which one before procededing. 
		elseif ($Users.Count -ge 2)
		{
			$UserSelection = $Users | Out-GridView -Title "Select a User" -PassThru
			$script:UserUPN = $UserSelection.UserPrincipalName
			$TextBoxUserUPN.Text = "$script:UserUPN"
			Write-Host "2 or more user matches found. Analyst chose $script:UserUPN. Beginning pull of user information."
			GetUserInformation
			InvestigateInboxRules
			PullAzureADAuditSignInLogs
		}
	}
	#Prompts analyst for file location and name for Triage logs from "Logins by IP" tab before saving them. 
	$buttonDownloadIPTriageLogs_Click={
		
		$UserSaveFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$UserSaveFileDialog.InitialDirectory = ".\"
		$UserSaveFileDialog.FileName = "$($IPSearchTextBox.Text)_TriageLogs_.csv"
		$UserSaveFileDialog.DefaultExt = "csv"
		$UserSaveFileDialog.Filter = "CSV (*.csv)|*.csv|All files (*.*)|*.*"
		
		if ($UserSaveFileDialog.ShowDialog() -eq 'OK')
		{
			$script:TriageIPLogs | Export-Csv -Path $UserSaveFileDialog.FileName -NoTypeInformation
			Write-Host "Analyst downloaded Triage AzureAD SignIn Logs for IP "$IPSearchTextBox.Text
		}
	}
	#Prompts analyst for file location and name for Full Logs from "Logins by IP" tab before saving them. 
	$buttonDownloadIPFullLogs_Click={
		
		$UserSaveFileDialog = New-Object -TypeName System.Windows.Forms.SaveFileDialog
		$UserSaveFileDialog.InitialDirectory = ".\"
		$UserSaveFileDialog.FileName = "$($IPSearchTextBox.Text)_FullLogs_.csv"
		$UserSaveFileDialog.DefaultExt = "csv"
		$UserSaveFileDialog.Filter = "CSV (*.csv)|*.csv|All files (*.*)|*.*"
		if ($UserSaveFileDialog.ShowDialog() -eq 'OK')
		{
			
			$script:FullIPLogs | Export-Csv -Path $UserSaveFileDialog.FileName -NoTypeInformation
			Write-Host "Analyst downloaded Full AzureAD SignIn Logs for IP "$IPSearchTextBox.Text
		}
	}
	#Allows analyst to view "Logins by IP" triage logs. 
	$buttonViewIPTriageLogs_Click={
		
		$script:TriageIPLogs | Out-GridView -Title "IP Triage Logs"
		Write-Host "Analyst viewed Triage IP Logs"
	}
	#Allows analyst to view "Logins by IP" full logs. 
	$buttonViewIPFullLogs_Click={
		
		
		$script:FullIPLogs | Out-GridView -Title "Full IP Logs"
		Write-Host "Analyst viewed Full IP Logs"
	}
	
	
	
	# --End User Generated Script--
	#----------------------------------------------
	#region Generated Events
	#----------------------------------------------
	
	$Form_StateCorrection_Load=
	{
		#Correct the initial state of the form to prevent the .Net maximized form issue
		$MainForm.WindowState = $InitialFormWindowState
	}
	
	$Form_Cleanup_FormClosed=
	{
		#Remove all event handlers from the controls
		try
		{
			$buttonSearch.remove_Click($buttonSearch_Click)
			$buttonExit.remove_Click($buttonExit_Click)
			$SignInLogsTimePickerMax.remove_ValueChanged($SignInLogsTimePickerMax_ValueChanged)
			$buttonRevokeAzureADRefreshToken.remove_Click($buttonRevokeAzureADRefreshToken_Click)
			$buttonResetUserPassword.remove_Click($buttonResetUserPassword_Click)
			$buttonRemoveInboxRule.remove_Click($buttonRemoveInboxRule_Click)
			$RuleSelectionListbox.remove_SelectedIndexChanged($RuleSelectionListbox_SelectedIndexChanged)
			$buttonUseExistingUsername.remove_Click($buttonUseExistingUsername_Click)
			$buttonViewUserFullLogs.remove_Click($buttonViewUserFullLogs_Click)
			$buttonDownloadUserTriageLogs.remove_Click($buttonDownloadUserTriageLogs_Click)
			$buttonDownloadUserFullLogs.remove_Click($buttonDownloadUserFullLogs_Click)
			$buttonViewUserTriageLogs.remove_Click($buttonViewUserTriageLogs_Click)
			$buttonViewIPFullLogs.remove_Click($buttonViewIPFullLogs_Click)
			$buttonViewIPTriageLogs.remove_Click($buttonViewIPTriageLogs_Click)
			$buttonDownloadIPFullLogs.remove_Click($buttonDownloadIPFullLogs_Click)
			$buttonDownloadIPTriageLogs.remove_Click($buttonDownloadIPTriageLogs_Click)
			$buttonUseExistingIP.remove_Click($buttonUseExistingIP_Click)
			$buttonUseNewIP.remove_Click($buttonUseNewIP_Click)
			$MessageTraceTimePickerMax.remove_ValueChanged($MessageTraceTimePickerMax_ValueChanged)
			$MessageTraceTimePickerMin.remove_ValueChanged($MessageTraceTimePickerMin_ValueChanged)
			$buttonViewMessageTraceLogs.remove_Click($buttonViewMessageTraceLogs_Click)
			$buttonDownloadMessageTrace.remove_Click($buttonDownloadMessageTrace_Click)
			$buttonSearchMessageTrace.remove_Click($buttonSearchMessageTrace_Click)
			$SignInLogsTimePickerMin.remove_ValueChanged($SignInLogsTimePickerMin_ValueChanged)
			$MainForm.remove_Load($MainForm_Load)
			$MainForm.remove_Load($Form_StateCorrection_Load)
			$MainForm.remove_FormClosed($Form_Cleanup_FormClosed)
		}
		catch { Out-Null <# Prevent PSScriptAnalyzer warning #> }
	}
	#endregion Generated Events

	#----------------------------------------------
	#region Generated Form Code
	#----------------------------------------------
	$MainForm.SuspendLayout()
	$tabcontrol1.SuspendLayout()
	$UserTab.SuspendLayout()
	$EmailTab.SuspendLayout()
	$LoginsTab.SuspendLayout()
	$IPTab.SuspendLayout()
	$SearchEmailTab.SuspendLayout()
	#
	# MainForm
	#
	$MainForm.Controls.Add($labelEndDate)
	$MainForm.Controls.Add($LabelStartDate)
	$MainForm.Controls.Add($UserLabel)
	$MainForm.Controls.Add($UserProgressTextbox)
	$MainForm.Controls.Add($TextBoxUserUPN)
	$MainForm.Controls.Add($buttonSearch)
	$MainForm.Controls.Add($buttonExit)
	$MainForm.Controls.Add($SignInLogsTimePickerMax)
	$MainForm.Controls.Add($tabcontrol1)
	$MainForm.Controls.Add($SignInLogsTimePickerMin)
	$MainForm.AutoScaleDimensions = New-Object System.Drawing.SizeF(10, 20)
	$MainForm.AutoScaleMode = 'Font'
	$MainForm.AutoScroll = $True
	$MainForm.ClientSize = New-Object System.Drawing.Size(2255, 1122)
	$MainForm.Margin = '8, 8, 8, 8'
	$MainForm.Name = 'MainForm'
	$MainForm.ShowIcon = $False
	$MainForm.Text = ' KITT - An Open Source PowerShell O365 Business Email Compromise Investigation Tool'
	$MainForm.add_Load($MainForm_Load)
	#
	# labelEndDate
	#
	$labelEndDate.AutoSize = $True
	$labelEndDate.Location = New-Object System.Drawing.Point(1068, 48)
	$labelEndDate.Margin = '5, 0, 5, 0'
	$labelEndDate.Name = 'labelEndDate'
	$labelEndDate.Size = New-Object System.Drawing.Size(79, 20)
	$labelEndDate.TabIndex = 7
	$labelEndDate.Text = 'End Date'
	#
	# LabelStartDate
	#
	$LabelStartDate.AutoSize = $True
	$LabelStartDate.Location = New-Object System.Drawing.Point(721, 48)
	$LabelStartDate.Margin = '5, 0, 5, 0'
	$LabelStartDate.Name = 'LabelStartDate'
	$LabelStartDate.Size = New-Object System.Drawing.Size(86, 20)
	$LabelStartDate.TabIndex = 6
	$LabelStartDate.Text = 'Start Date'
	#
	# UserLabel
	#
	$UserLabel.AutoSize = $True
	$UserLabel.Location = New-Object System.Drawing.Point(14, 17)
	$UserLabel.Margin = '5, 0, 5, 0'
	$UserLabel.Name = 'UserLabel'
	$UserLabel.Size = New-Object System.Drawing.Size(89, 24)
	$UserLabel.TabIndex = 5
	$UserLabel.Text = 'Username:'
	$UserLabel.UseCompatibleTextRendering = $True
	#
	# UserProgressTextbox
	#
	$UserProgressTextbox.BorderStyle = 'None'
	$UserProgressTextbox.Location = New-Object System.Drawing.Point(1283, 17)
	$UserProgressTextbox.Margin = '5, 5, 5, 5'
	$UserProgressTextbox.Name = 'UserProgressTextbox'
	$UserProgressTextbox.ReadOnly = $True
	$UserProgressTextbox.Size = New-Object System.Drawing.Size(954, 47)
	$UserProgressTextbox.TabIndex = 1
	$UserProgressTextbox.Text = ''
	#
	# TextBoxUserUPN
	#
	$TextBoxUserUPN.Location = New-Object System.Drawing.Point(117, 17)
	$TextBoxUserUPN.Margin = '5, 5, 5, 5'
	$TextBoxUserUPN.Name = 'TextBoxUserUPN'
	$TextBoxUserUPN.Size = New-Object System.Drawing.Size(337, 26)
	$TextBoxUserUPN.TabIndex = 4
	#
	# buttonSearch
	#
	$buttonSearch.Location = New-Object System.Drawing.Point(463, 17)
	$buttonSearch.Margin = '5, 5, 5, 5'
	$buttonSearch.Name = 'buttonSearch'
	$buttonSearch.Size = New-Object System.Drawing.Size(125, 26)
	$buttonSearch.TabIndex = 0
	$buttonSearch.Text = 'Search'
	$buttonSearch.UseCompatibleTextRendering = $True
	$buttonSearch.UseVisualStyleBackColor = $True
	$buttonSearch.add_Click($buttonSearch_Click)
	#
	# buttonExit
	#
	$buttonExit.Anchor = 'Bottom, Right'
	$buttonExit.DialogResult = 'OK'
	$buttonExit.Location = New-Object System.Drawing.Point(2107, 1057)
	$buttonExit.Margin = '5, 5, 5, 5'
	$buttonExit.Name = 'buttonExit'
	$buttonExit.Size = New-Object System.Drawing.Size(125, 35)
	$buttonExit.TabIndex = 1
	$buttonExit.Text = 'Exit'
	$buttonExit.UseCompatibleTextRendering = $True
	$buttonExit.UseVisualStyleBackColor = $True
	$buttonExit.add_Click($buttonExit_Click)
	#
	# SignInLogsTimePickerMax
	#
	$SignInLogsTimePickerMax.Font = [System.Drawing.Font]::new('Microsoft Sans Serif', '8.25')
	$SignInLogsTimePickerMax.Location = New-Object System.Drawing.Point(942, 17)
	$SignInLogsTimePickerMax.Margin = '5, 5, 5, 5'
	$SignInLogsTimePickerMax.Name = 'SignInLogsTimePickerMax'
	$SignInLogsTimePickerMax.Size = New-Object System.Drawing.Size(332, 26)
	$SignInLogsTimePickerMax.TabIndex = 3
	$SignInLogsTimePickerMax.add_ValueChanged($SignInLogsTimePickerMax_ValueChanged)
	#
	# tabcontrol1
	#
	$tabcontrol1.Controls.Add($UserTab)
	$tabcontrol1.Controls.Add($EmailTab)
	$tabcontrol1.Controls.Add($LoginsTab)
	$tabcontrol1.Controls.Add($IPTab)
	$tabcontrol1.Controls.Add($SearchEmailTab)
	$tabcontrol1.Anchor = 'Top, Bottom, Left, Right'
	$tabcontrol1.Location = New-Object System.Drawing.Point(14, 66)
	$tabcontrol1.Margin = '5, 5, 5, 5'
	$tabcontrol1.Name = 'tabcontrol1'
	$tabcontrol1.SelectedIndex = 0
	$tabcontrol1.Size = New-Object System.Drawing.Size(2227, 989)
	$tabcontrol1.TabIndex = 0
	#
	# UserTab
	#
	$UserTab.Controls.Add($buttonRevokeAzureADRefreshToken)
	$UserTab.Controls.Add($buttonResetUserPassword)
	$UserTab.Controls.Add($UserLicenseOutputTextbox)
	$UserTab.Controls.Add($UserOutputTextbox)
	$UserTab.Location = New-Object System.Drawing.Point(4, 29)
	$UserTab.Margin = '5, 5, 5, 5'
	$UserTab.Name = 'UserTab'
	$UserTab.Padding = '5, 5, 5, 5'
	$UserTab.Size = New-Object System.Drawing.Size(2219, 956)
	$UserTab.TabIndex = 0
	$UserTab.Text = 'User Information'
	$UserTab.UseVisualStyleBackColor = $True
	#
	# buttonRevokeAzureADRefreshToken
	#
	$buttonRevokeAzureADRefreshToken.Location = New-Object System.Drawing.Point(1897, 55)
	$buttonRevokeAzureADRefreshToken.Margin = '5, 5, 5, 5'
	$buttonRevokeAzureADRefreshToken.Name = 'buttonRevokeAzureADRefreshToken'
	$buttonRevokeAzureADRefreshToken.Size = New-Object System.Drawing.Size(312, 35)
	$buttonRevokeAzureADRefreshToken.TabIndex = 4
	$buttonRevokeAzureADRefreshToken.Text = 'Revoke AzureAD Refresh Tokens'
	$buttonRevokeAzureADRefreshToken.UseCompatibleTextRendering = $True
	$buttonRevokeAzureADRefreshToken.UseVisualStyleBackColor = $True
	$buttonRevokeAzureADRefreshToken.add_Click($buttonRevokeAzureADRefreshToken_Click)
	#
	# buttonResetUserPassword
	#
	$buttonResetUserPassword.Location = New-Object System.Drawing.Point(1895, 10)
	$buttonResetUserPassword.Margin = '5, 5, 5, 5'
	$buttonResetUserPassword.Name = 'buttonResetUserPassword'
	$buttonResetUserPassword.Size = New-Object System.Drawing.Size(312, 35)
	$buttonResetUserPassword.TabIndex = 3
	$buttonResetUserPassword.Text = 'Reset User Password'
	$buttonResetUserPassword.UseCompatibleTextRendering = $True
	$buttonResetUserPassword.UseVisualStyleBackColor = $True
	$buttonResetUserPassword.add_Click($buttonResetUserPassword_Click)
	#
	# UserLicenseOutputTextbox
	#
	$UserLicenseOutputTextbox.Font = [System.Drawing.Font]::new('Lucida Console', '10')
	$UserLicenseOutputTextbox.Location = New-Object System.Drawing.Point(721, 14)
	$UserLicenseOutputTextbox.Margin = '5, 5, 5, 5'
	$UserLicenseOutputTextbox.Name = 'UserLicenseOutputTextbox'
	$UserLicenseOutputTextbox.ReadOnly = $True
	$UserLicenseOutputTextbox.Size = New-Object System.Drawing.Size(1164, 932)
	$UserLicenseOutputTextbox.TabIndex = 2
	$UserLicenseOutputTextbox.Text = ''
	#
	# UserOutputTextbox
	#
	$UserOutputTextbox.Font = [System.Drawing.Font]::new('Lucida Console', '10')
	$UserOutputTextbox.Location = New-Object System.Drawing.Point(10, 14)
	$UserOutputTextbox.Margin = '5, 5, 5, 5'
	$UserOutputTextbox.Name = 'UserOutputTextbox'
	$UserOutputTextbox.ReadOnly = $True
	$UserOutputTextbox.Size = New-Object System.Drawing.Size(701, 932)
	$UserOutputTextbox.TabIndex = 0
	$UserOutputTextbox.Text = ''
	#
	# EmailTab
	#
	$EmailTab.Controls.Add($buttonRemoveInboxRule)
	$EmailTab.Controls.Add($RuleOutputTextbox)
	$EmailTab.Controls.Add($RuleSelectionListbox)
	$EmailTab.Location = New-Object System.Drawing.Point(4, 29)
	$EmailTab.Margin = '5, 5, 5, 5'
	$EmailTab.Name = 'EmailTab'
	$EmailTab.Padding = '5, 5, 5, 5'
	$EmailTab.Size = New-Object System.Drawing.Size(2219, 956)
	$EmailTab.TabIndex = 1
	$EmailTab.Text = 'User Inbox Rules'
	$EmailTab.UseVisualStyleBackColor = $True
	#
	# buttonRemoveInboxRule
	#
	$buttonRemoveInboxRule.Location = New-Object System.Drawing.Point(10, 911)
	$buttonRemoveInboxRule.Margin = '5, 5, 5, 5'
	$buttonRemoveInboxRule.Name = 'buttonRemoveInboxRule'
	$buttonRemoveInboxRule.Size = New-Object System.Drawing.Size(717, 35)
	$buttonRemoveInboxRule.TabIndex = 2
	$buttonRemoveInboxRule.Text = 'Remove Inbox Rule'
	$buttonRemoveInboxRule.UseCompatibleTextRendering = $True
	$buttonRemoveInboxRule.UseVisualStyleBackColor = $True
	$buttonRemoveInboxRule.add_Click($buttonRemoveInboxRule_Click)
	#
	# RuleOutputTextbox
	#
	$RuleOutputTextbox.Location = New-Object System.Drawing.Point(733, 3)
	$RuleOutputTextbox.Margin = '5, 5, 5, 5'
	$RuleOutputTextbox.Name = 'RuleOutputTextbox'
	$RuleOutputTextbox.ReadOnly = $True
	$RuleOutputTextbox.Size = New-Object System.Drawing.Size(1179, 943)
	$RuleOutputTextbox.TabIndex = 1
	$RuleOutputTextbox.Text = ''
	#
	# RuleSelectionListbox
	#
	$RuleSelectionListbox.FormattingEnabled = $True
	$RuleSelectionListbox.ItemHeight = 20
	$RuleSelectionListbox.Location = New-Object System.Drawing.Point(10, 5)
	$RuleSelectionListbox.Margin = '5, 5, 5, 5'
	$RuleSelectionListbox.Name = 'RuleSelectionListbox'
	$RuleSelectionListbox.Size = New-Object System.Drawing.Size(714, 904)
	$RuleSelectionListbox.TabIndex = 0
	$RuleSelectionListbox.add_SelectedIndexChanged($RuleSelectionListbox_SelectedIndexChanged)
	#
	# LoginsTab
	#
	$LoginsTab.Controls.Add($buttonUseExistingUsername)
	$LoginsTab.Controls.Add($SignInStatsTextBox)
	$LoginsTab.Controls.Add($buttonViewUserFullLogs)
	$LoginsTab.Controls.Add($buttonDownloadUserTriageLogs)
	$LoginsTab.Controls.Add($buttonDownloadUserFullLogs)
	$LoginsTab.Controls.Add($buttonViewUserTriageLogs)
	$LoginsTab.Location = New-Object System.Drawing.Point(4, 29)
	$LoginsTab.Margin = '5, 5, 5, 5'
	$LoginsTab.Name = 'LoginsTab'
	$LoginsTab.Padding = '3, 3, 3, 3'
	$LoginsTab.Size = New-Object System.Drawing.Size(2219, 956)
	$LoginsTab.TabIndex = 5
	$LoginsTab.Text = 'Logins by User'
	$LoginsTab.UseVisualStyleBackColor = $True
	#
	# buttonUseExistingUsername
	#
	$buttonUseExistingUsername.Location = New-Object System.Drawing.Point(1896, 26)
	$buttonUseExistingUsername.Margin = '5, 5, 5, 5'
	$buttonUseExistingUsername.Name = 'buttonUseExistingUsername'
	$buttonUseExistingUsername.Size = New-Object System.Drawing.Size(297, 35)
	$buttonUseExistingUsername.TabIndex = 15
	$buttonUseExistingUsername.Text = 'Search Username from IP Tab'
	$buttonUseExistingUsername.UseCompatibleTextRendering = $True
	$buttonUseExistingUsername.UseVisualStyleBackColor = $True
	$buttonUseExistingUsername.add_Click($buttonUseExistingUsername_Click)
	#
	# SignInStatsTextBox
	#
	$SignInStatsTextBox.Font = [System.Drawing.Font]::new('Lucida Console', '12')
	$SignInStatsTextBox.Location = New-Object System.Drawing.Point(8, 8)
	$SignInStatsTextBox.Margin = '5, 5, 5, 5'
	$SignInStatsTextBox.Name = 'SignInStatsTextBox'
	$SignInStatsTextBox.ReadOnly = $True
	$SignInStatsTextBox.Size = New-Object System.Drawing.Size(1878, 940)
	$SignInStatsTextBox.TabIndex = 14
	$SignInStatsTextBox.Text = ''
	#
	# buttonViewUserFullLogs
	#
	$buttonViewUserFullLogs.Location = New-Object System.Drawing.Point(1896, 116)
	$buttonViewUserFullLogs.Margin = '5, 5, 5, 5'
	$buttonViewUserFullLogs.Name = 'buttonViewUserFullLogs'
	$buttonViewUserFullLogs.Size = New-Object System.Drawing.Size(297, 35)
	$buttonViewUserFullLogs.TabIndex = 13
	$buttonViewUserFullLogs.Text = 'View Full Logs'
	$buttonViewUserFullLogs.UseCompatibleTextRendering = $True
	$buttonViewUserFullLogs.UseVisualStyleBackColor = $True
	$buttonViewUserFullLogs.add_Click($buttonViewUserFullLogs_Click)
	#
	# buttonDownloadUserTriageLogs
	#
	$buttonDownloadUserTriageLogs.Location = New-Object System.Drawing.Point(1896, 161)
	$buttonDownloadUserTriageLogs.Margin = '5, 5, 5, 5'
	$buttonDownloadUserTriageLogs.Name = 'buttonDownloadUserTriageLogs'
	$buttonDownloadUserTriageLogs.Size = New-Object System.Drawing.Size(297, 35)
	$buttonDownloadUserTriageLogs.TabIndex = 12
	$buttonDownloadUserTriageLogs.Text = 'Download Triage Logs'
	$buttonDownloadUserTriageLogs.UseCompatibleTextRendering = $True
	$buttonDownloadUserTriageLogs.UseVisualStyleBackColor = $True
	$buttonDownloadUserTriageLogs.add_Click($buttonDownloadUserTriageLogs_Click)
	#
	# buttonDownloadUserFullLogs
	#
	$buttonDownloadUserFullLogs.Location = New-Object System.Drawing.Point(1896, 206)
	$buttonDownloadUserFullLogs.Margin = '5, 5, 5, 5'
	$buttonDownloadUserFullLogs.Name = 'buttonDownloadUserFullLogs'
	$buttonDownloadUserFullLogs.Size = New-Object System.Drawing.Size(297, 35)
	$buttonDownloadUserFullLogs.TabIndex = 11
	$buttonDownloadUserFullLogs.Text = 'Download Full Logs'
	$buttonDownloadUserFullLogs.UseCompatibleTextRendering = $True
	$buttonDownloadUserFullLogs.UseVisualStyleBackColor = $True
	$buttonDownloadUserFullLogs.add_Click($buttonDownloadUserFullLogs_Click)
	#
	# buttonViewUserTriageLogs
	#
	$buttonViewUserTriageLogs.Location = New-Object System.Drawing.Point(1896, 71)
	$buttonViewUserTriageLogs.Margin = '5, 5, 5, 5'
	$buttonViewUserTriageLogs.Name = 'buttonViewUserTriageLogs'
	$buttonViewUserTriageLogs.Size = New-Object System.Drawing.Size(297, 35)
	$buttonViewUserTriageLogs.TabIndex = 10
	$buttonViewUserTriageLogs.Text = 'View Triage Logs'
	$buttonViewUserTriageLogs.UseCompatibleTextRendering = $True
	$buttonViewUserTriageLogs.UseVisualStyleBackColor = $True
	$buttonViewUserTriageLogs.add_Click($buttonViewUserTriageLogs_Click)
	#
	# IPTab
	#
	$IPTab.Controls.Add($buttonViewIPFullLogs)
	$IPTab.Controls.Add($buttonViewIPTriageLogs)
	$IPTab.Controls.Add($buttonDownloadIPFullLogs)
	$IPTab.Controls.Add($buttonDownloadIPTriageLogs)
	$IPTab.Controls.Add($IPSearchTextBox)
	$IPTab.Controls.Add($IpStatsTextBox)
	$IPTab.Controls.Add($buttonUseExistingIP)
	$IPTab.Controls.Add($buttonUseNewIP)
	$IPTab.Location = New-Object System.Drawing.Point(4, 29)
	$IPTab.Margin = '5, 5, 5, 5'
	$IPTab.Name = 'IPTab'
	$IPTab.Size = New-Object System.Drawing.Size(2219, 956)
	$IPTab.TabIndex = 7
	$IPTab.Text = 'Logins by IP'
	$IPTab.UseVisualStyleBackColor = $True
	#
	# buttonViewIPFullLogs
	#
	$buttonViewIPFullLogs.Location = New-Object System.Drawing.Point(1858, 197)
	$buttonViewIPFullLogs.Margin = '5, 5, 5, 5'
	$buttonViewIPFullLogs.Name = 'buttonViewIPFullLogs'
	$buttonViewIPFullLogs.Size = New-Object System.Drawing.Size(335, 35)
	$buttonViewIPFullLogs.TabIndex = 7
	$buttonViewIPFullLogs.Text = 'View Full Logs'
	$buttonViewIPFullLogs.UseCompatibleTextRendering = $True
	$buttonViewIPFullLogs.UseVisualStyleBackColor = $True
	$buttonViewIPFullLogs.add_Click($buttonViewIPFullLogs_Click)
	#
	# buttonViewIPTriageLogs
	#
	$buttonViewIPTriageLogs.Location = New-Object System.Drawing.Point(1858, 152)
	$buttonViewIPTriageLogs.Margin = '5, 5, 5, 5'
	$buttonViewIPTriageLogs.Name = 'buttonViewIPTriageLogs'
	$buttonViewIPTriageLogs.Size = New-Object System.Drawing.Size(335, 35)
	$buttonViewIPTriageLogs.TabIndex = 6
	$buttonViewIPTriageLogs.Text = 'View Triage Logs'
	$buttonViewIPTriageLogs.UseCompatibleTextRendering = $True
	$buttonViewIPTriageLogs.UseVisualStyleBackColor = $True
	$buttonViewIPTriageLogs.add_Click($buttonViewIPTriageLogs_Click)
	#
	# buttonDownloadIPFullLogs
	#
	$buttonDownloadIPFullLogs.Location = New-Object System.Drawing.Point(1858, 286)
	$buttonDownloadIPFullLogs.Margin = '5, 5, 5, 5'
	$buttonDownloadIPFullLogs.Name = 'buttonDownloadIPFullLogs'
	$buttonDownloadIPFullLogs.Size = New-Object System.Drawing.Size(335, 35)
	$buttonDownloadIPFullLogs.TabIndex = 5
	$buttonDownloadIPFullLogs.Text = 'Download Full Logs'
	$buttonDownloadIPFullLogs.UseCompatibleTextRendering = $True
	$buttonDownloadIPFullLogs.UseVisualStyleBackColor = $True
	$buttonDownloadIPFullLogs.add_Click($buttonDownloadIPFullLogs_Click)
	#
	# buttonDownloadIPTriageLogs
	#
	$buttonDownloadIPTriageLogs.Location = New-Object System.Drawing.Point(1858, 242)
	$buttonDownloadIPTriageLogs.Margin = '5, 5, 5, 5'
	$buttonDownloadIPTriageLogs.Name = 'buttonDownloadIPTriageLogs'
	$buttonDownloadIPTriageLogs.Size = New-Object System.Drawing.Size(335, 35)
	$buttonDownloadIPTriageLogs.TabIndex = 4
	$buttonDownloadIPTriageLogs.Text = 'Download Triage Logs'
	$buttonDownloadIPTriageLogs.UseCompatibleTextRendering = $True
	$buttonDownloadIPTriageLogs.UseVisualStyleBackColor = $True
	$buttonDownloadIPTriageLogs.add_Click($buttonDownloadIPTriageLogs_Click)
	#
	# IPSearchTextBox
	#
	$IPSearchTextBox.Location = New-Object System.Drawing.Point(1861, 23)
	$IPSearchTextBox.Margin = '8, 8, 8, 8'
	$IPSearchTextBox.Name = 'IPSearchTextBox'
	$IPSearchTextBox.Size = New-Object System.Drawing.Size(332, 26)
	$IPSearchTextBox.TabIndex = 3
	#
	# IpStatsTextBox
	#
	$IpStatsTextBox.Font = [System.Drawing.Font]::new('Lucida Console', '12')
	$IpStatsTextBox.Location = New-Object System.Drawing.Point(5, 23)
	$IpStatsTextBox.Margin = '5, 5, 5, 5'
	$IpStatsTextBox.Name = 'IpStatsTextBox'
	$IpStatsTextBox.ReadOnly = $True
	$IpStatsTextBox.Size = New-Object System.Drawing.Size(1843, 928)
	$IpStatsTextBox.TabIndex = 2
	$IpStatsTextBox.Text = ''
	#
	# buttonUseExistingIP
	#
	$buttonUseExistingIP.Location = New-Object System.Drawing.Point(1858, 107)
	$buttonUseExistingIP.Margin = '5, 5, 5, 5'
	$buttonUseExistingIP.Name = 'buttonUseExistingIP'
	$buttonUseExistingIP.Size = New-Object System.Drawing.Size(335, 35)
	$buttonUseExistingIP.TabIndex = 1
	$buttonUseExistingIP.Text = 'Use Existing IP from User Logins Tab'
	$buttonUseExistingIP.UseCompatibleTextRendering = $True
	$buttonUseExistingIP.UseVisualStyleBackColor = $True
	$buttonUseExistingIP.add_Click($buttonUseExistingIP_Click)
	#
	# buttonUseNewIP
	#
	$buttonUseNewIP.Location = New-Object System.Drawing.Point(1858, 62)
	$buttonUseNewIP.Margin = '5, 5, 5, 5'
	$buttonUseNewIP.Name = 'buttonUseNewIP'
	$buttonUseNewIP.Size = New-Object System.Drawing.Size(335, 35)
	$buttonUseNewIP.TabIndex = 0
	$buttonUseNewIP.Text = 'Search using fresh IP'
	$buttonUseNewIP.UseCompatibleTextRendering = $True
	$buttonUseNewIP.UseVisualStyleBackColor = $True
	$buttonUseNewIP.add_Click($buttonUseNewIP_Click)
	#
	# SearchEmailTab
	#
	$SearchEmailTab.Controls.Add($label2)
	$SearchEmailTab.Controls.Add($label1)
	$SearchEmailTab.Controls.Add($labelMessageTraceCmdletOn)
	$SearchEmailTab.Controls.Add($MessageTraceTimePickerMax)
	$SearchEmailTab.Controls.Add($MessageTraceTimePickerMin)
	$SearchEmailTab.Controls.Add($MessageTraceStatsTextBox)
	$SearchEmailTab.Controls.Add($buttonViewMessageTraceLogs)
	$SearchEmailTab.Controls.Add($buttonDownloadMessageTrace)
	$SearchEmailTab.Controls.Add($buttonSearchMessageTrace)
	$SearchEmailTab.Controls.Add($FromIPLabel)
	$SearchEmailTab.Controls.Add($FromIPTextbox)
	$SearchEmailTab.Controls.Add($RecipientLabel)
	$SearchEmailTab.Controls.Add($RecipientTextbox)
	$SearchEmailTab.Controls.Add($SenderLabel)
	$SearchEmailTab.Controls.Add($SenderAddressTextbox)
	$SearchEmailTab.Location = New-Object System.Drawing.Point(4, 29)
	$SearchEmailTab.Margin = '5, 5, 5, 5'
	$SearchEmailTab.Name = 'SearchEmailTab'
	$SearchEmailTab.Size = New-Object System.Drawing.Size(2219, 956)
	$SearchEmailTab.TabIndex = 6
	$SearchEmailTab.Text = 'Message Trace'
	$SearchEmailTab.UseVisualStyleBackColor = $True
	#
	# label2
	#
	$label2.AutoSize = $True
	$label2.Location = New-Object System.Drawing.Point(2002, 468)
	$label2.Margin = '5, 0, 5, 0'
	$label2.Name = 'label2'
	$label2.Size = New-Object System.Drawing.Size(79, 20)
	$label2.TabIndex = 15
	$label2.Text = 'End Date'
	#
	# label1
	#
	$label1.AutoSize = $True
	$label1.Location = New-Object System.Drawing.Point(1995, 384)
	$label1.Margin = '5, 0, 5, 0'
	$label1.Name = 'label1'
	$label1.Size = New-Object System.Drawing.Size(86, 20)
	$label1.TabIndex = 14
	$label1.Text = 'Start Date'
	#
	# labelMessageTraceCmdletOn
	#
	$labelMessageTraceCmdletOn.AutoSize = $True
	$labelMessageTraceCmdletOn.Location = New-Object System.Drawing.Point(1889, 514)
	$labelMessageTraceCmdletOn.Margin = '5, 0, 5, 0'
	$labelMessageTraceCmdletOn.MinimumSize = New-Object System.Drawing.Size(306, 0)
	$labelMessageTraceCmdletOn.Name = 'labelMessageTraceCmdletOn'
	$labelMessageTraceCmdletOn.Size = New-Object System.Drawing.Size(306, 80)
	$labelMessageTraceCmdletOn.TabIndex = 13
	$labelMessageTraceCmdletOn.Text = 'Message Trace cmdlet only allows 
pulling of 10 days of logs, hence why 
there are separate Time Pickers here.

'
	#
	# MessageTraceTimePickerMax
	#
	$MessageTraceTimePickerMax.Font = [System.Drawing.Font]::new('Microsoft Sans Serif', '8.25')
	$MessageTraceTimePickerMax.Location = New-Object System.Drawing.Point(1887, 419)
	$MessageTraceTimePickerMax.Margin = '5, 5, 5, 5'
	$MessageTraceTimePickerMax.Name = 'MessageTraceTimePickerMax'
	$MessageTraceTimePickerMax.Size = New-Object System.Drawing.Size(308, 26)
	$MessageTraceTimePickerMax.TabIndex = 12
	$MessageTraceTimePickerMax.add_ValueChanged($MessageTraceTimePickerMax_ValueChanged)
	#
	# MessageTraceTimePickerMin
	#
	$MessageTraceTimePickerMin.Location = New-Object System.Drawing.Point(1887, 350)
	$MessageTraceTimePickerMin.Margin = '8, 8, 8, 8'
	$MessageTraceTimePickerMin.Name = 'MessageTraceTimePickerMin'
	$MessageTraceTimePickerMin.Size = New-Object System.Drawing.Size(308, 26)
	$MessageTraceTimePickerMin.TabIndex = 11
	$MessageTraceTimePickerMin.add_ValueChanged($MessageTraceTimePickerMin_ValueChanged)
	#
	# MessageTraceStatsTextBox
	#
	$MessageTraceStatsTextBox.Font = [System.Drawing.Font]::new('Lucida Console', '12')
	$MessageTraceStatsTextBox.Location = New-Object System.Drawing.Point(5, 5)
	$MessageTraceStatsTextBox.Margin = '5, 5, 5, 5'
	$MessageTraceStatsTextBox.Name = 'MessageTraceStatsTextBox'
	$MessageTraceStatsTextBox.ReadOnly = $True
	$MessageTraceStatsTextBox.Size = New-Object System.Drawing.Size(1869, 946)
	$MessageTraceStatsTextBox.TabIndex = 10
	$MessageTraceStatsTextBox.Text = ''
	#
	# buttonViewMessageTraceLogs
	#
	$buttonViewMessageTraceLogs.Location = New-Object System.Drawing.Point(1887, 248)
	$buttonViewMessageTraceLogs.Margin = '5, 5, 5, 5'
	$buttonViewMessageTraceLogs.Name = 'buttonViewMessageTraceLogs'
	$buttonViewMessageTraceLogs.Size = New-Object System.Drawing.Size(308, 35)
	$buttonViewMessageTraceLogs.TabIndex = 9
	$buttonViewMessageTraceLogs.Text = 'View Message Trace Logs'
	$buttonViewMessageTraceLogs.UseCompatibleTextRendering = $True
	$buttonViewMessageTraceLogs.UseVisualStyleBackColor = $True
	$buttonViewMessageTraceLogs.add_Click($buttonViewMessageTraceLogs_Click)
	#
	# buttonDownloadMessageTrace
	#
	$buttonDownloadMessageTrace.Location = New-Object System.Drawing.Point(1885, 293)
	$buttonDownloadMessageTrace.Margin = '5, 5, 5, 5'
	$buttonDownloadMessageTrace.Name = 'buttonDownloadMessageTrace'
	$buttonDownloadMessageTrace.Size = New-Object System.Drawing.Size(308, 35)
	$buttonDownloadMessageTrace.TabIndex = 8
	$buttonDownloadMessageTrace.Text = 'Download Message Trace Logs'
	$buttonDownloadMessageTrace.UseCompatibleTextRendering = $True
	$buttonDownloadMessageTrace.UseVisualStyleBackColor = $True
	$buttonDownloadMessageTrace.add_Click($buttonDownloadMessageTrace_Click)
	#
	# buttonSearchMessageTrace
	#
	$buttonSearchMessageTrace.Location = New-Object System.Drawing.Point(1887, 203)
	$buttonSearchMessageTrace.Margin = '5, 5, 5, 5'
	$buttonSearchMessageTrace.Name = 'buttonSearchMessageTrace'
	$buttonSearchMessageTrace.Size = New-Object System.Drawing.Size(308, 35)
	$buttonSearchMessageTrace.TabIndex = 7
	$buttonSearchMessageTrace.Text = 'Search Message Trace'
	$buttonSearchMessageTrace.UseCompatibleTextRendering = $True
	$buttonSearchMessageTrace.UseVisualStyleBackColor = $True
	$buttonSearchMessageTrace.add_Click($buttonSearchMessageTrace_Click)
	#
	# FromIPLabel
	#
	$FromIPLabel.AutoSize = $True
	$FromIPLabel.Location = New-Object System.Drawing.Point(2007, 174)
	$FromIPLabel.Margin = '8, 0, 8, 0'
	$FromIPLabel.Name = 'FromIPLabel'
	$FromIPLabel.Size = New-Object System.Drawing.Size(66, 24)
	$FromIPLabel.TabIndex = 6
	$FromIPLabel.Text = 'From IP'
	$FromIPLabel.TextAlign = 'MiddleCenter'
	$FromIPLabel.UseCompatibleTextRendering = $True
	#
	# FromIPTextbox
	#
	$FromIPTextbox.Location = New-Object System.Drawing.Point(1887, 140)
	$FromIPTextbox.Margin = '8, 8, 8, 8'
	$FromIPTextbox.Name = 'FromIPTextbox'
	$FromIPTextbox.Size = New-Object System.Drawing.Size(306, 26)
	$FromIPTextbox.TabIndex = 5
	#
	# RecipientLabel
	#
	$RecipientLabel.AutoSize = $True
	$RecipientLabel.Location = New-Object System.Drawing.Point(1941, 108)
	$RecipientLabel.Margin = '8, 0, 8, 0'
	$RecipientLabel.Name = 'RecipientLabel'
	$RecipientLabel.Size = New-Object System.Drawing.Size(191, 24)
	$RecipientLabel.TabIndex = 4
	$RecipientLabel.Text = 'Recipient Email Address'
	$RecipientLabel.TextAlign = 'MiddleCenter'
	$RecipientLabel.UseCompatibleTextRendering = $True
	#
	# RecipientTextbox
	#
	$RecipientTextbox.Location = New-Object System.Drawing.Point(1887, 74)
	$RecipientTextbox.Margin = '8, 8, 8, 8'
	$RecipientTextbox.Name = 'RecipientTextbox'
	$RecipientTextbox.Size = New-Object System.Drawing.Size(306, 26)
	$RecipientTextbox.TabIndex = 3
	#
	# SenderLabel
	#
	$SenderLabel.AutoSize = $True
	$SenderLabel.Location = New-Object System.Drawing.Point(1952, 42)
	$SenderLabel.Margin = '8, 0, 8, 0'
	$SenderLabel.Name = 'SenderLabel'
	$SenderLabel.Size = New-Object System.Drawing.Size(175, 24)
	$SenderLabel.TabIndex = 2
	$SenderLabel.Text = 'Sender Email Address'
	$SenderLabel.TextAlign = 'MiddleCenter'
	$SenderLabel.UseCompatibleTextRendering = $True
	#
	# SenderAddressTextbox
	#
	$SenderAddressTextbox.Location = New-Object System.Drawing.Point(1887, 8)
	$SenderAddressTextbox.Margin = '8, 8, 8, 8'
	$SenderAddressTextbox.Name = 'SenderAddressTextbox'
	$SenderAddressTextbox.Size = New-Object System.Drawing.Size(306, 26)
	$SenderAddressTextbox.TabIndex = 1
	#
	# SignInLogsTimePickerMin
	#
	$SignInLogsTimePickerMin.Location = New-Object System.Drawing.Point(598, 17)
	$SignInLogsTimePickerMin.Margin = '8, 8, 8, 8'
	$SignInLogsTimePickerMin.Name = 'SignInLogsTimePickerMin'
	$SignInLogsTimePickerMin.Size = New-Object System.Drawing.Size(332, 26)
	$SignInLogsTimePickerMin.TabIndex = 2
	$SignInLogsTimePickerMin.add_ValueChanged($SignInLogsTimePickerMin_ValueChanged)
	$SearchEmailTab.ResumeLayout()
	$IPTab.ResumeLayout()
	$LoginsTab.ResumeLayout()
	$EmailTab.ResumeLayout()
	$UserTab.ResumeLayout()
	$tabcontrol1.ResumeLayout()
	$MainForm.ResumeLayout()
	#endregion Generated Form Code

	#----------------------------------------------

	#Save the initial state of the form
	$InitialFormWindowState = $MainForm.WindowState
	#Init the OnLoad event to correct the initial state of the form
	$MainForm.add_Load($Form_StateCorrection_Load)
	#Clean up the control events
	$MainForm.add_FormClosed($Form_Cleanup_FormClosed)
	#Show the Form
	return $MainForm.ShowDialog()

} #End Function

#Call the form
Show-DFIRPowershellGUI_psf | Out-Null