Home

Welcome to the Microsoft-Analyzer-Suite Wiki! 🚀

Overview

This suite contains multiple PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID extracted via Microsoft-Extractor-Suite by Invictus Incident Response.

Prerequisites

1. Windows PowerShell 5.1 or newer.

Setup

1. Download the latest version of the Microsoft-Analyzer-Suite from the Releases section.
2. Create your free IPinfo account (Access Token required).
   https://ipinfo.io/signup?ref=cli
3. Enter your personal IPinfo Access Token within Config.json (and edit optional settings)

4. Install ImportExcel PowerShell module to import/export Excel spreadsheets, without Excel.

   Install-Module -Name ImportExcel

5. Run the specific script in PowerShell (e.g. UAL-Analyzer.ps1).

Usage

Open PowerShell and navigate to the directory containing UAL-Analyzer.ps1 and run the script with following command:

.\UAL-Analyzer.ps1

Fig 1: Select your 'UAL-Combined.csv' file

You can skip the file selection dialog and provide the file path to your log file with following command:
.\UAL-Analyzer.ps1 -Path "$env:USERPROFILE\Desktop\UAL-Combined.csv"

You can specify the output directory with following command (Default is "$env:USERPROFILE\Desktop\UAL-Analyzer"):
.\UAL-Analyzer.ps1 -Path "H:\Microsoft-Extractor-Suite\UAL-Combined.csv" -OutputDir "H:\Microsoft-Analyzer-Suite"

Note

The subdirectory 'UAL-Analyzer' is automatically created.

Get-Help

Display basic help information about a script:

Get-Help -Name C:\Tools\Microsoft-Analyzer-Suite\ADSignInLogsGraph-Analyzer.ps1

Display examples of using a script

Get-Help -Name C:\Tools\Microsoft-Analyzer-Suite\ADSignInLogsGraph-Analyzer.ps1 -Examples

Display detailed information about a script:

Get-Help -Name C:\Tools\Microsoft-Analyzer-Suite\ADSignInLogsGraph-Analyzer.ps1 -Detailed

Happy Hunting! 🕵️