{"repo":"LETHAL-FORENSICS/Microsoft-Analyzer-Suite","free":true,"listed":false,"github":"https://github.com/LETHAL-FORENSICS/Microsoft-Analyzer-Suite","clone":"git clone https://github.com/LETHAL-FORENSICS/Microsoft-Analyzer-Suite.git","description":"A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID","language":"PowerShell","stars":669,"topics":["azure-active-directory","incident-response","microsoft-365","microsoft-entra","microsoft-graph","powershell"],"license":"GPL-3.0","category":"cli-tools","readme_excerpt":"Microsoft-Analyzer-Suite (Community Edition) A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID. TL;DR Automated Processing of Microsoft 365 Logs and Microsoft Entra ID Logs extracted by Microsoft-Extractor-Suite. The following Microsoft data sources are supported yet: Output Files of Microsoft-Extractor-Suite v4.1.0 by Invictus-IR Get-AdminUsers → Admins-Analyzer Get-Devices → Devices-Analyzer Get-GraphEntraAuditLogs → EntraAuditLogs-Analyzer Get-GraphEntraSignInLogs (EventType: interactiveUser, nonInteractiveUser) → EntraSignInLogs-Analyzer Get-GraphEntraSignInLogs (EventType: servicePrincipal) → ServicePrincipal-Analyzer Get-MailboxAuditStatus → MailboxAuditStatus-Analyzer Get-MailboxPermissions → MailboxPermissions-Analyzer Get-MessageTraceLog → MTL-Analyzer Get-MFA → MFA-Analyzer Get-OAuthPermissionsGraph → OAuthPermissions-Analyzer Get-RiskyDetections → RiskyDetections-Analyzer Get-RiskyUsers → RiskyUsers-Analyzer Get-UAL → UAL-Analyzer Get-UALGraph → UALGraph-Analyzer Get-Users → Users-Analyzer Get-TransportRules → TransportRules-Analyzer [!TIP] Check out the Wiki for additional documentation! Fig 1: RiskyDetections-Analyzer Fig 2: Risky Detections (1) Fig 3: Risky Detections (2) Fig 4: Risky Detections (Line Chart) Fig 5: MITRE ATT&CK Techniques (Stats) Fig 6: RiskEventType (Stats) Fig 7: RiskLevel (Stats) Fig 8: Source (Stats) F","default_branch":null,"files":null,"tree":[],"storefront":"/r/LETHAL-FORENSICS","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/LETHAL-FORENSICS/Microsoft-Analyzer-Suite/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}