Merge branch 'main' into 2020-securitysuite-1

Author: dagarwal-ecs

PowerShell/ScubaGear/Modules/Orchestrator.psm1

@@ -19,7 +19,7 @@ Function Get-ScubaGearPermissions {
         The switch to indicate that the permissions are to be retrieved for a service principal
 
     .PARAMETER Product
-        The product for which the permissions are to be retrieved. Options are 'aad', 'exo', 'securitysuite', 'teams', 'sharepoint', 'powerplatform'. Can be an array of products and used in pipeline
+        The product for which the permissions are to be retrieved. Options are 'aad', 'exo', 'defender', 'securitysuite', 'teams', 'sharepoint', 'powerplatform'. Can be an array of products and used in pipeline. 'securitysuite' is an alias for 'defender' (the Security Suite).
 
     .PARAMETER Environment
         The Environment for which the permissions are to be retrieved. Options are 'commercial', 'gcc', 'gcchigh', 'dod'. Default is 'commercial'
@@ -108,7 +108,7 @@ Function Get-ScubaGearPermissions {
         [switch]$ServicePrincipal,
 
         [Parameter(Mandatory = $true, ParameterSetName = 'ServicePrincipal',ValueFromPipeline=$true)]
-        [ValidateSet('aad', 'exo', 'securitysuite', 'teams', 'sharepoint', 'powerplatform', '*')]
+        [ValidateSet('aad', 'exo', 'defender', 'securitysuite', 'teams', 'sharepoint', 'scubatank', 'powerplatform', '*')]
         [string[]]$Product,
 
         [Parameter(Mandatory = $false)]

PowerShell/ScubaGear/Modules/Permissions/PermissionsHelper.psm1

@@ -176,7 +176,7 @@ function Export-AADProvider {
         $PrivilegedRoles = ConvertTo-Json @()
         $Tracker.AddUnSuccessfulCommand("Get-PrivilegedRole")
         $Tracker.AddUnSuccessfulCommand("Get-PrivilegedUser")
-        $PrivilegedServicePrincipals = ConvertTo-Json @()
+        $PrivilegedServicePrincipals = @{}
     }
 
     ##### This block gathers information on risky API permissions related to application/service principal objects
@@ -259,9 +259,8 @@ function Export-AADProvider {
     #####
     ##### End slowest functions block
 
-    # PrivilegedServicePrincipals is converted to JSON here because earlier it is used as a PowerShell object.
-    $PrivilegedServicePrincipals = ConvertTo-Json $PrivilegedServicePrincipals
-    $PrivilegedServicePrincipals = if ($null -eq $PrivilegedServicePrincipals) {"{}"} else {$PrivilegedServicePrincipals}
+    # PrivilegedServicePrincipals is converted to JSON here because it is a PowerShell Hashtable.
+    $PrivilegedServicePrincipalsJson = ConvertTo-Json $PrivilegedServicePrincipals -Depth 5
 
     # This conversion to JSON needs to be last because other blocks above here rely on the $ServicePlans object in its PowerShell form.
     $ServicePlans = ConvertTo-Json -Depth 3 @($ServicePlans)
@@ -275,7 +274,7 @@ function Export-AADProvider {
     "cap_table_data": $CapTableData,
     "authorization_policies": $AuthZPolicies,
     "privileged_users": $PrivilegedUsers,
-    "privileged_service_principals": $PrivilegedServicePrincipals,
+    "privileged_service_principals": $PrivilegedServicePrincipalsJson,
     "privileged_roles": $PrivilegedRoles,
     "service_plans": $ServicePlans,
     "directory_settings": $DirectorySettings,

PowerShell/ScubaGear/Modules/Providers/ExportAADProvider.psm1

@@ -49,13 +49,23 @@ function Export-SecuritySuiteProvider {
         }
     }
 
+    # Get the tenant's provisioned service plans via Graph. These are used to
+    # determine whether the tenant has the per-user license (E5 / E5 Compliance /
+    # E5 eDiscovery and Audit add-on) required to retain audit logs beyond 180
+    # days for MS.SECURITYSUITE.5.2v1. The Rego looks at the service_plans list.
+    $SubscribedSku = $Tracker.TryCommand("Get-MgBetaSubscribedSku", @{"M365Environment"=$M365Environment; "GraphDirect"=$true})
+    $ServicePlans = $SubscribedSku.ServicePlans | Where-Object -Property ProvisioningStatus -eq -Value "Success"
+    $ServicePlans = ConvertTo-Json -Depth 3 @($ServicePlans)
+
     # Regular Exchange i.e non IPPSSession cmdlets
     $AdminAuditLogConfig = ConvertTo-Json @($Tracker.TryCommand("Get-AdminAuditLogConfig"))
     $ProtectionPolicyRule = ConvertTo-Json @($Tracker.TryCommand("Get-EOPProtectionPolicyRule"))
     $AntiPhishPolicy = ConvertTo-Json @($Tracker.TryCommand("Get-AntiPhishPolicy"))
     $AntiPhishRule = ConvertTo-Json @($Tracker.TryCommand("Get-AntiPhishRule"))
     $AcceptedDomains = ConvertTo-Json @($Tracker.TryCommand("Get-AcceptedDomain"))
     $ConnectionFilter = ConvertTo-Json @($Tracker.TryCommand("Get-HostedConnectionFilterPolicy"))
+    $SafeLinksPolicy = ConvertTo-Json @($Tracker.TryCommand("Get-SafeLinksPolicy"))
+    $SafeLinksRule = ConvertTo-Json @($Tracker.TryCommand("Get-SafeLinksRule"))
     $HostedContentFilterPolicies = ConvertTo-Json @($Tracker.TryCommand("Get-HostedContentFilterPolicy"))
     $HostedContentFilterRules = ConvertTo-Json @($Tracker.TryCommand("Get-HostedContentFilterRule"))
     $AntiMalwarePolicy = ConvertTo-Json @($Tracker.TryCommand("Get-MalwareFilterPolicy"))
@@ -107,10 +117,11 @@ function Export-SecuritySuiteProvider {
     }
     catch {
         Write-Warning "Error running Connect-IPPSSession: $($_.Exception.Message)`n$($_.ScriptStackTrace)"
-        Write-Warning "Omitting the following commands: Get-DlpCompliancePolicy, Get-DlpComplianceRule, and Get-ProtectionAlert."
+        Write-Warning "Omitting the following commands: Get-DlpCompliancePolicy, Get-DlpComplianceRule, Get-ProtectionAlert, and Get-UnifiedAuditLogRetentionPolicy."
         $Tracker.AddUnSuccessfulCommand("Get-DlpCompliancePolicy")
         $Tracker.AddUnSuccessfulCommand("Get-DlpComplianceRule")
         $Tracker.AddUnSuccessfulCommand("Get-ProtectionAlert")
+        $Tracker.AddUnSuccessfulCommand("Get-UnifiedAuditLogRetentionPolicy")
     }
     if ($IPPSConnected) {
         if (Get-Command Get-DlpCompliancePolicy -ErrorAction SilentlyContinue) {
@@ -147,13 +158,18 @@ function Export-SecuritySuiteProvider {
         # We need to specify the depth because the data contains some
         # nested tables.
         $DLPComplianceRules = ConvertTo-Json -Depth 3 $DLPComplianceRules
+
+        # Audit log retention policies are managed through the Security &
+        # Compliance session and are needed to evaluate MS.SECURITYSUITE.5.2v1.
+        $UnifiedAuditLogRetentionPolicy = ConvertTo-Json @($Tracker.TryCommand("Get-UnifiedAuditLogRetentionPolicy"))
     }
     else {
         $DLPCompliancePolicy = ConvertTo-Json @()
         $DLPComplianceRules = ConvertTo-Json @()
         $ProtectionAlert = ConvertTo-Json @()
         $DLPComplianceRules = ConvertTo-Json @()
         $DLPLicense = ConvertTo-Json $false
+        $UnifiedAuditLogRetentionPolicy = ConvertTo-Json @()
     }
 
     $SuccessfulCommands = ConvertTo-Json @($Tracker.GetSuccessfulCommands())
@@ -174,7 +190,11 @@ function Export-SecuritySuiteProvider {
     "protection_alerts": $ProtectionAlert,
     "admin_audit_log_config": $AdminAuditLogConfig,
     "atp_policy_for_o365": $ATPPolicy,
+    "service_plans": $ServicePlans,
+    "unified_audit_log_retention_policies": $UnifiedAuditLogRetentionPolicy,
     "conn_filter": $ConnectionFilter,
+    "safe_links_policies": $SafeLinksPolicy,
+    "safe_links_rules": $SafeLinksRule,
     "defender_license": $DefenderLicense,
     "defender_dlp_license": $DLPLicense,
     "hosted_content_filter_policies": $HostedContentFilterPolicies,