Skip to content

Commit 1fe1c5a

Browse files
silverhacksilverhack
committed
Merge branch 'develop'
2 parents b3f43c4 + d0eeb6c commit 1fe1c5a

File tree

248 files changed

+6023
-2527
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

248 files changed

+6023
-2527
lines changed

‎Invoke-Monkey365.ps1‎

Lines changed: 52 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -63,26 +63,26 @@ Function Invoke-Monkey365{
6363
https://github.com/silverhack/monkey365
6464
6565
.EXAMPLE
66-
$assets = Invoke-Monkey365 -ExportTo CSV -PromptBehavior SelectAccount -IncludeEntraID -Instance Microsoft365 -Analysis SharePointOnline
66+
$assets = Invoke-Monkey365 -ExportTo CSV -PromptBehavior SelectAccount -IncludeEntraID -Instance Microsoft365 -Collect SharePointOnline
6767
68-
This example retrieves information of both Azure AD and SharePoint Online and will save results into a CSV file. If credentials are not supplied, Monkey365 will prompt for credentials.
68+
This example will collect information of both Azure AD and SharePoint Online and will save results into a CSV file. If credentials are not supplied, Monkey365 will prompt for credentials.
6969
7070
.EXAMPLE
71-
Invoke-Monkey365 -PromptBehavior SelectAccount -Instance Azure -Analysis All -subscriptions 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML
71+
Invoke-Monkey365 -PromptBehavior SelectAccount -Instance Azure -Collect All -subscriptions 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML
7272
73-
This example retrieves information of an Azure subscription and will export data to a XML-based file. If credentials are not supplied, Monkey365 will prompt for credentials.
73+
This example will collect information of an Azure subscription and will export data to a XML-based file. If credentials are not supplied, Monkey365 will prompt for credentials.
7474
7575
.EXAMPLE
76-
Invoke-Monkey365 -ClientId 00000000-0000-0000-0000-000000000000 -ClientSecret ("MySuperClientSecret" | ConvertTo-SecureString -AsPlainText -Force) -Instance Azure -Analysis All -subscriptions 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML,CSV,JSON,HTML
76+
Invoke-Monkey365 -ClientId 00000000-0000-0000-0000-000000000000 -ClientSecret ("MySuperClientSecret" | ConvertTo-SecureString -AsPlainText -Force) -Instance Azure -Collect All -subscriptions 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML,CSV,JSON,HTML
7777
7878
This example retrieves information of an Azure subscription and will export data driven to CSV, JSON, HTML, XML and Excel format into monkey-reports folder. The script will connect to Azure using the client credential flow.
7979
8080
.EXAMPLE
81-
Invoke-Monkey365 -certificate C:\monkey365\testapp.pfx -ClientId 00000000-0000-0000-0000-000000000000 -CertFilePassword ("MySuperCertSecret" | ConvertTo-SecureString -AsPlainText -Force) -Instance Microsoft365 -Analysis SharePointOnline -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML,CSV,JSON,HTML
81+
Invoke-Monkey365 -certificate C:\monkey365\testapp.pfx -ClientId 00000000-0000-0000-0000-000000000000 -CertFilePassword ("MySuperCertSecret" | ConvertTo-SecureString -AsPlainText -Force) -Instance Microsoft365 -Collect SharePointOnline -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo CLIXML,CSV,JSON,HTML
8282
This example retrieves information of an Microsoft 365 subscription and will export data driven to CSV, JSON, HTML, XML and Excel format into monkey-reports folder. The script will connect to Azure using the certificate credential flow.
8383
8484
.EXAMPLE
85-
Invoke-Monkey365 -PromptBehavior SelectAccount -Instance Azure -Analysis All -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo HTML
85+
Invoke-Monkey365 -PromptBehavior SelectAccount -Instance Azure -Collect All -TenantID 00000000-0000-0000-0000-000000000000 -ExportTo HTML
8686
8787
This example retrieves information of an Azure subscription and will export data driven to HTML format into monkey-reports folder. If credentials are not supplied, Monkey365 will prompt for credentials.
8888
@@ -92,7 +92,7 @@ Function Invoke-Monkey365{
9292
.PARAMETER Instance
9393
Select the instance to scan. Valid options are Azure or Microsoft365
9494
95-
.PARAMETER Analysis
95+
.PARAMETER Collect
9696
Collect data from specified assets. Depending of what instance was selected, the following values are accepted:
9797
9898
Value Description
@@ -303,7 +303,13 @@ Function Invoke-Monkey365{
303303
[Switch]$DeviceCode,
304304

305305
[Parameter(Mandatory=$false, HelpMessage="Force to load MSAL Desktop PowerShell Core on Windows")]
306-
[Switch]$ForceMSALDesktop
306+
[Switch]$ForceMSALDesktop,
307+
308+
[Parameter(Mandatory=$false, HelpMessage="List available collectors")]
309+
[Switch]$ListCollector,
310+
311+
[Parameter(Mandatory=$false, HelpMessage="List available rules")]
312+
[Switch]$ListRule
307313
)
308314
dynamicparam{
309315
# Set available instance class
@@ -318,15 +324,15 @@ Function Invoke-Monkey365{
318324
$attributeCollection = New-Object -TypeName System.Collections.ObjectModel.Collection[System.Attribute]
319325
# define a new parameter attribute
320326
$analysis_attr_name = New-Object System.Management.Automation.ParameterAttribute
321-
$analysis_attr_name.Mandatory = $true
327+
$analysis_attr_name.Mandatory = $false
322328
$attributeCollection.Add($analysis_attr_name)
323329

324330
# set the ValidateSet attribute
325331
$token_attr_name = New-Object System.Management.Automation.ValidateSetAttribute($instance_class.Item($Instance))
326332
$attributeCollection.Add($token_attr_name)
327333

328-
# create the dynamic -Analysis parameter
329-
$analysis_pname = 'Analysis'
334+
# create the dynamic -Collect parameter
335+
$analysis_pname = 'Collect'
330336
$analysis_type_dynParam = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameter($analysis_pname,
331337
[Array], $attributeCollection)
332338
$paramDictionary.Add($analysis_pname, $analysis_type_dynParam)
@@ -416,10 +422,43 @@ Function Invoke-Monkey365{
416422
#Initialize Logger
417423
Initialize-MonkeyLogger
418424
#Check if import job
419-
if($PSBoundParameters.ContainsKey('ImportJob') -and $PSBoundParameters.ImportJob){
425+
If($PSBoundParameters.ContainsKey('ImportJob') -and $PSBoundParameters.ImportJob){
420426
Import-MonkeyJob
421427
return
422428
}
429+
#Check if list collectors
430+
If($PSBoundParameters.ContainsKey('ListCollector') -and $PSBoundParameters['ListCollector'].IsPresent){
431+
#Get command Metadata
432+
$MetaData = New-Object -TypeName "System.Management.Automation.CommandMetaData" (Get-Command -Name "Get-MonkeyCollector")
433+
$newPsboundParams = [ordered]@{}
434+
if($null -ne $MetaData){
435+
$param = $MetaData.Parameters.Keys
436+
foreach($p in $param.GetEnumerator()){
437+
if($PSBoundParameters.ContainsKey($p)){
438+
$newPsboundParams.Add($p,$PSBoundParameters[$p])
439+
}
440+
}
441+
#Add verbose, debug
442+
$newPsboundParams.Add('Verbose',$O365Object.verbose)
443+
$newPsboundParams.Add('Debug',$O365Object.debug)
444+
$newPsboundParams.Add('InformationAction',$O365Object.InformationAction)
445+
#Add services if exists
446+
If($null -ne $O365Object.initParams.Collect -and $O365Object.initParams.Collect.Count -gt 0){
447+
#Remove all option
448+
$collect = $O365Object.initParams.Collect.Where({$_.ToLower() -ne 'all'})
449+
[void]$newPsboundParams.Add('Service',$collect);
450+
}
451+
#Add pretty print
452+
[void]$newPsboundParams.Add('Pretty',$true);
453+
#Add Provider
454+
If($PSBoundParameters.ContainsKey('Instance') -and $PSBoundParameters['Instance']){
455+
[void]$newPsboundParams.Add('Provider',$PSBoundParameters['Instance']);
456+
}
457+
#Execute command
458+
Get-MonkeyCollector @newPsboundParams
459+
}
460+
return
461+
}
423462
#Check for mandatory params
424463
Test-MandatoryParameter
425464
#Import MSAL module

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,10 @@ By default, the HTML report shows you the CIS (Center for Internet Security) Ben
9393

9494
The following standards are supported by Monkey365:
9595

96-
* CIS Microsoft Azure Foundations Benchmark v1.4.0
97-
* CIS Microsoft 365 Foundations Benchmark v1.4.0
98-
* CIS Microsoft Azure Foundations Benchmark v1.5.0
99-
* CIS Microsoft 365 Foundations Benchmark v1.5.0
96+
* CIS Microsoft Azure Foundations Benchmark v2.0.0
97+
* CIS Microsoft Azure Foundations Benchmark v3.0.0
98+
* CIS Microsoft 365 Foundations Benchmark v2.0.0
99+
* CIS Microsoft 365 Foundations Benchmark v3.0.0
100100

101101
More standards will be added in next releases (NIST, HIPAA, GDPR, PCI-DSS, etc..) as they are available.
102102

‎collectors/azure/APIM/Get-MonkeyAZAPIM.ps1‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -55,21 +55,25 @@ function Get-MonkeyAZAPIM {
5555
Group = @(
5656
"APIM"
5757
);
58-
Tags = @{
59-
"enabled" = $true
60-
};
61-
Docs = "https://silverhack.github.io/monkey365/";
58+
Tags = @(
59+
60+
);
61+
references = @(
62+
"https://silverhack.github.io/monkey365/"
63+
);
6264
ruleSuffixes = @(
6365
"az_APIM"
6466
);
6567
dependsOn = @(
6668

6769
);
70+
enabled = $true;
71+
supportClientCredential = $true
6872
}
6973
#Get Config
7074
$APIMConfig = $O365Object.internal_config.ResourceManager | Where-Object { $_.Name -eq "APIManagement" } | Select-Object -ExpandProperty resource
7175
#Get Storage accounts
72-
$APIM_objects = $O365Object.all_resources.Where({$_.type -like 'Microsoft.ApiManagement/service'})
76+
$APIM_objects = $O365Object.all_resources.Where({ $_.type -like 'Microsoft.ApiManagement/service' })
7377
if (-not $APIM_objects) { continue }
7478
#Set array
7579
$all_APIM = $null
@@ -83,25 +87,25 @@ function Get-MonkeyAZAPIM {
8387
Tags = @('AzureAPIManagementInfo');
8488
}
8589
Write-Information @msg
86-
if($APIM_objects.Count -gt 0){
87-
$new_arg = @{
88-
APIVersion = $APIMConfig.api_version;
89-
}
90-
$p = @{
91-
ScriptBlock = { Get-MonkeyAzAPIMInfo -InputObject $_ };
92-
Arguments = $new_arg;
93-
Runspacepool = $O365Object.monkey_runspacePool;
94-
ReuseRunspacePool = $true;
95-
Debug = $O365Object.VerboseOptions.Debug;
96-
Verbose = $O365Object.VerboseOptions.Verbose;
97-
MaxQueue = $O365Object.nestedRunspaces.MaxQueue;
98-
BatchSleep = $O365Object.nestedRunspaces.BatchSleep;
99-
BatchSize = $O365Object.nestedRunspaces.BatchSize;
100-
}
101-
$all_APIM = $APIM_objects | Invoke-MonkeyJob @p
102-
}
90+
if ($APIM_objects.Count -gt 0) {
91+
$new_arg = @{
92+
APIVersion = $APIMConfig.api_version;
93+
}
94+
$p = @{
95+
ScriptBlock = { Get-MonkeyAzAPIMInfo -InputObject $_ };
96+
Arguments = $new_arg;
97+
Runspacepool = $O365Object.monkey_runspacePool;
98+
ReuseRunspacePool = $true;
99+
Debug = $O365Object.VerboseOptions.Debug;
100+
Verbose = $O365Object.VerboseOptions.Verbose;
101+
MaxQueue = $O365Object.nestedRunspaces.MaxQueue;
102+
BatchSleep = $O365Object.nestedRunspaces.BatchSleep;
103+
BatchSize = $O365Object.nestedRunspaces.BatchSize;
104+
}
105+
$all_APIM = $APIM_objects | Invoke-MonkeyJob @p
106+
}
103107
}
104-
End {
108+
end {
105109
if ($all_APIM) {
106110
$all_APIM.PSObject.TypeNames.Insert(0,'Monkey365.Azure.APIM')
107111
[pscustomobject]$obj = @{
@@ -125,3 +129,4 @@ function Get-MonkeyAZAPIM {
125129
}
126130

127131

132+

‎collectors/azure/alerts/securityalerts/Get-MonkeyAzSecurityAlert.ps1‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,20 @@ function Get-MonkeyAzSecurityAlert {
5656
Group = @(
5757
"SecurityAlerts"
5858
);
59-
Tags = @{
60-
"enabled" = $true
61-
};
62-
Docs = "https://silverhack.github.io/monkey365/";
59+
Tags = @(
60+
61+
);
62+
references = @(
63+
"https://silverhack.github.io/monkey365/"
64+
);
6365
ruleSuffixes = @(
6466
"aad_security_alerts"
6567
);
6668
dependsOn = @(
6769

6870
);
71+
enabled = $true;
72+
supportClientCredential = $true
6973
}
7074
#Get Environment
7175
$Environment = $O365Object.Environment
@@ -132,3 +136,4 @@ function Get-MonkeyAzSecurityAlert {
132136

133137

134138

139+

‎collectors/azure/appservices/Get-MonkeyAzAppServiceInfo.ps1‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,20 @@ function Get-MonkeyAzAppServiceInfo {
5656
Group = @(
5757
"AppServices"
5858
);
59-
Tags = @{
60-
"enabled" = $true
61-
};
62-
Docs = "https://silverhack.github.io/monkey365/";
59+
Tags = @(
60+
61+
);
62+
references = @(
63+
"https://silverhack.github.io/monkey365/"
64+
);
6365
ruleSuffixes = @(
6466
"az_app_services"
6567
);
6668
dependsOn = @(
6769

6870
);
71+
enabled = $true;
72+
supportClientCredential = $true
6973
}
7074
#config
7175
$config = $O365Object.internal_config.ResourceManager | Where-Object { $_.Name -eq "azureWebApps" } | Select-Object -ExpandProperty resource
@@ -85,21 +89,21 @@ function Get-MonkeyAzAppServiceInfo {
8589
}
8690
Write-Information @msg
8791
if ($app_services.Count -gt 0) {
88-
$new_arg = @{
92+
$new_arg = @{
8993
APIVersion = $config.api_version;
9094
}
91-
$p = @{
92-
ScriptBlock = { Get-MonkeyAzAppService -InputObject $_ };
93-
Arguments = $new_arg;
94-
Runspacepool = $O365Object.monkey_runspacePool;
95-
ReuseRunspacePool = $true;
96-
Debug = $O365Object.VerboseOptions.Debug;
97-
Verbose = $O365Object.VerboseOptions.Verbose;
98-
MaxQueue = $O365Object.nestedRunspaces.MaxQueue;
99-
BatchSleep = $O365Object.nestedRunspaces.BatchSleep;
100-
BatchSize = $O365Object.nestedRunspaces.BatchSize;
101-
}
102-
$all_apps = $app_services | Invoke-MonkeyJob @p
95+
$p = @{
96+
ScriptBlock = { Get-MonkeyAzAppService -InputObject $_ };
97+
Arguments = $new_arg;
98+
Runspacepool = $O365Object.monkey_runspacePool;
99+
ReuseRunspacePool = $true;
100+
Debug = $O365Object.VerboseOptions.Debug;
101+
Verbose = $O365Object.VerboseOptions.Verbose;
102+
MaxQueue = $O365Object.nestedRunspaces.MaxQueue;
103+
BatchSleep = $O365Object.nestedRunspaces.BatchSleep;
104+
BatchSize = $O365Object.nestedRunspaces.BatchSize;
105+
}
106+
$all_apps = $app_services | Invoke-MonkeyJob @p
103107
}
104108
}
105109
end {
@@ -131,3 +135,4 @@ function Get-MonkeyAzAppServiceInfo {
131135

132136

133137

138+

‎collectors/azure/botchannels/Get-MonkeyAzBotChannel.ps1‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,16 +62,20 @@ function Get-MonkeyAzBotChannel {
6262
Group = @(
6363
"BotChannels"
6464
);
65-
Tags = @{
66-
"enabled" = $true
67-
};
68-
Docs = "https://silverhack.github.io/monkey365/";
65+
Tags = @(
66+
67+
);
68+
references = @(
69+
"https://silverhack.github.io/monkey365/"
70+
);
6971
ruleSuffixes = @(
7072
"az_bots"
7173
);
7274
dependsOn = @(
7375

7476
);
77+
enabled = $true;
78+
supportClientCredential = $true
7579
}
7680
#Import Localized data
7781
$LocalizedDataParams = $O365Object.LocalizedDataParams
@@ -133,3 +137,4 @@ function Get-MonkeyAzBotChannel {
133137

134138

135139

140+

‎collectors/azure/classicvm/virtualmachines/Get-MonkeyAzClassicDisk.ps1‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ function Get-MonkeyAzClassicDisk {
3636
.LINK
3737
https://github.com/silverhack/monkey365
3838
#>
39-
[Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "", Scope="Function")]
39+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions","",Scope = "Function")]
4040
[CmdletBinding()]
4141
param(
4242
[Parameter(Mandatory = $false,HelpMessage = "Background Collector ID")]
@@ -56,16 +56,20 @@ function Get-MonkeyAzClassicDisk {
5656
Group = @(
5757
"VirtualMachines"
5858
);
59-
Tags = @{
60-
"enabled" = $true
61-
};
62-
Docs = "https://silverhack.github.io/monkey365/";
59+
Tags = @(
60+
61+
);
62+
references = @(
63+
"https://silverhack.github.io/monkey365/"
64+
);
6365
ruleSuffixes = @(
6466
"az_classic_disks"
6567
);
6668
dependsOn = @(
6769

6870
);
71+
enabled = $true;
72+
supportClientCredential = $true
6973
}
7074
#Import Localized data
7175
$LocalizedDataParams = $O365Object.LocalizedDataParams
@@ -126,3 +130,4 @@ function Get-MonkeyAzClassicDisk {
126130

127131

128132

133+

0 commit comments

Comments
 (0)