Skip to content

Commit 8c94b80

Browse files
silverhacksilverhack
committed
add new directories
1 parent 622cf40 commit 8c94b80

543 files changed

Lines changed: 66770 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎collectors/azure/alerts/securityalerts/Get-MonkeyAzSecurityAlert.ps1‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Monkey365 - the PowerShell Cloud Security Tool for Azure and Microsoft 365 (copyright 2022) by Juan Garrido
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
16+
function Get-MonkeyAzSecurityAlert {
17+
<#
18+
.SYNOPSIS
19+
Collector to extract Security alerts from Azure
20+
21+
.DESCRIPTION
22+
Collector to extract Security alerts from Azure
23+
24+
.INPUTS
25+
26+
.OUTPUTS
27+
28+
.EXAMPLE
29+
30+
.NOTES
31+
Author : Juan Garrido
32+
Twitter : @tr1ana
33+
File Name : Get-MonkeyAzSecurityAlert
34+
Version : 1.0
35+
36+
.LINK
37+
https://github.com/silverhack/monkey365
38+
#>
39+
40+
[CmdletBinding()]
41+
param(
42+
[Parameter(Mandatory = $false,HelpMessage = "Background Collector ID")]
43+
[string]$collectorId
44+
)
45+
begin {
46+
#Collector metadata
47+
$monkey_metadata = @{
48+
Id = "az00001";
49+
Provider = "Azure";
50+
Resource = "SecurityAlerts";
51+
ResourceType = $null;
52+
resourceName = $null;
53+
collectorName = "Get-MonkeyAzSecurityAlert";
54+
ApiType = "resourceManagement";
55+
description = "Collector to get Security alerts from Azure";
56+
Group = @(
57+
"SecurityAlerts"
58+
);
59+
Tags = @(
60+
61+
);
62+
references = @(
63+
"https://silverhack.github.io/monkey365/"
64+
);
65+
ruleSuffixes = @(
66+
"aad_security_alerts"
67+
);
68+
dependsOn = @(
69+
70+
);
71+
enabled = $true;
72+
supportClientCredential = $true
73+
}
74+
#Get Environment
75+
$Environment = $O365Object.Environment
76+
#Get Azure Active Directory Auth
77+
$rm_auth = $O365Object.auth_tokens.ResourceManager
78+
$AzureAlerts = $O365Object.internal_config.ResourceManager | Where-Object { $_.Name -eq "azureAlerts" } | Select-Object -ExpandProperty resource
79+
}
80+
process {
81+
$msg = @{
82+
MessageData = ($message.MonkeyGenericTaskMessage -f $collectorId,"Azure alerts",$O365Object.current_subscription.displayName);
83+
callStack = (Get-PSCallStack | Select-Object -First 1);
84+
logLevel = 'info';
85+
InformationAction = $InformationAction;
86+
Tags = @('AzureAlerts');
87+
}
88+
Write-Information @msg
89+
$params = @{
90+
Authentication = $rm_auth;
91+
Provider = $AzureAlerts.Provider;
92+
ObjectType = 'alerts';
93+
Environment = $Environment;
94+
ContentType = 'application/json';
95+
Method = "GET";
96+
APIVersion = $AzureAlerts.api_version;
97+
}
98+
$all_alerts = Get-MonkeyRMObject @params
99+
#Get primary object
100+
$AllAlerts = @()
101+
foreach ($Alert in $all_alerts) {
102+
$Properties = $Alert.Properties | Select-Object @{ Name = 'AlertName'; Expression = { $Alert.Name } },`
103+
vendorName,alertDisplayName,detectedTimeUtc,actionTaken,`
104+
reportedSeverity,compromisedEntity,reportedTimeUtc,@{ Name = 'ThreatName'; Expression = { $Alert.Properties.extendedProperties.Name } },`
105+
@{ Name = 'Path'; Expression = { $Alert.Properties.extendedProperties.path } },@{ Name = 'Category'; Expression = { $Alert.Properties.extendedProperties.Category } }
106+
$Properties.PSObject.TypeNames.Insert(0,'Monkey365.Azure.SecurityAlerts')
107+
$AllAlerts += $Properties
108+
}
109+
}
110+
end {
111+
if ($AllAlerts) {
112+
$AllAlerts.PSObject.TypeNames.Insert(0,'Monkey365.Azure.SecurityAlerts')
113+
[pscustomobject]$obj = @{
114+
Data = $AllAlerts;
115+
Metadata = $monkey_metadata;
116+
}
117+
$returnData.aad_security_alerts = $obj
118+
}
119+
else {
120+
$msg = @{
121+
MessageData = ($message.MonkeyEmptyResponseMessage -f "Azure alerts",$O365Object.TenantID);
122+
callStack = (Get-PSCallStack | Select-Object -First 1);
123+
logLevel = "verbose";
124+
InformationAction = $O365Object.InformationAction;
125+
Tags = @('AzureAlertsEmptyResponse');
126+
Verbose = $O365Object.Verbose;
127+
}
128+
Write-Verbose @msg
129+
}
130+
}
131+
}
132+
133+
134+
135+
136+
137+
138+
139+
140+

‎collectors/azure/apim/Get-MonkeyAZAPIM.ps1‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Monkey365 - the PowerShell Cloud Security Tool for Azure and Microsoft 365 (copyright 2022) by Juan Garrido
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
function Get-MonkeyAZAPIM {
16+
<#
17+
.SYNOPSIS
18+
Collector to get information about Azure API Management
19+
20+
.DESCRIPTION
21+
Collector to get information about Azure API Management
22+
23+
.INPUTS
24+
25+
.OUTPUTS
26+
27+
.EXAMPLE
28+
29+
.NOTES
30+
Author : Juan Garrido
31+
Twitter : @tr1ana
32+
File Name : Get-MonkeyAZAPIM
33+
Version : 1.0
34+
35+
.LINK
36+
https://github.com/silverhack/monkey365
37+
#>
38+
39+
[CmdletBinding()]
40+
param(
41+
[Parameter(Mandatory = $false,HelpMessage = "Background Collector ID")]
42+
[string]$collectorId
43+
)
44+
begin {
45+
#Collector metadata
46+
$monkey_metadata = @{
47+
Id = "az00120";
48+
Provider = "Azure";
49+
Resource = "APIM";
50+
ResourceType = $null;
51+
resourceName = $null;
52+
collectorName = "Get-MonkeyAZAPIM";
53+
ApiType = "resourceManagement";
54+
description = "Collector to get information about Azure API Management";
55+
Group = @(
56+
"APIM"
57+
);
58+
Tags = @(
59+
60+
);
61+
references = @(
62+
"https://silverhack.github.io/monkey365/"
63+
);
64+
ruleSuffixes = @(
65+
"az_APIM"
66+
);
67+
dependsOn = @(
68+
69+
);
70+
enabled = $true;
71+
supportClientCredential = $true
72+
}
73+
#Get Config
74+
$APIMConfig = $O365Object.internal_config.ResourceManager | Where-Object { $_.Name -eq "APIManagement" } | Select-Object -ExpandProperty resource
75+
#Get Storage accounts
76+
$APIM_objects = $O365Object.all_resources.Where({ $_.type -like 'Microsoft.ApiManagement/service' })
77+
if (-not $APIM_objects) { continue }
78+
#Set array
79+
$all_APIM = $null
80+
}
81+
process {
82+
$msg = @{
83+
MessageData = ($message.MonkeyGenericTaskMessage -f $collectorId,"Azure API Management",$O365Object.current_subscription.displayName);
84+
callStack = (Get-PSCallStack | Select-Object -First 1);
85+
logLevel = 'info';
86+
InformationAction = $O365Object.InformationAction;
87+
Tags = @('AzureAPIManagementInfo');
88+
}
89+
Write-Information @msg
90+
if ($APIM_objects.Count -gt 0) {
91+
$new_arg = @{
92+
APIVersion = $APIMConfig.api_version;
93+
}
94+
$p = @{
95+
ScriptBlock = { Get-MonkeyAzAPIMInfo -InputObject $_ };
96+
Arguments = $new_arg;
97+
Runspacepool = $O365Object.monkey_runspacePool;
98+
ReuseRunspacePool = $true;
99+
Debug = $O365Object.VerboseOptions.Debug;
100+
Verbose = $O365Object.VerboseOptions.Verbose;
101+
MaxQueue = $O365Object.nestedRunspaces.MaxQueue;
102+
BatchSleep = $O365Object.nestedRunspaces.BatchSleep;
103+
BatchSize = $O365Object.nestedRunspaces.BatchSize;
104+
}
105+
$all_APIM = $APIM_objects | Invoke-MonkeyJob @p
106+
}
107+
}
108+
end {
109+
if ($all_APIM) {
110+
$all_APIM.PSObject.TypeNames.Insert(0,'Monkey365.Azure.APIM')
111+
[pscustomobject]$obj = @{
112+
Data = $all_APIM;
113+
Metadata = $monkey_metadata;
114+
}
115+
$returnData.az_APIM = $obj
116+
}
117+
else {
118+
$msg = @{
119+
MessageData = ($message.MonkeyEmptyResponseMessage -f "Azure API Management",$O365Object.TenantID);
120+
callStack = (Get-PSCallStack | Select-Object -First 1);
121+
logLevel = "verbose";
122+
InformationAction = $O365Object.InformationAction;
123+
Tags = @('AzureAPIMEmptyResponse');
124+
Verbose = $O365Object.Verbose;
125+
}
126+
Write-Verbose @msg
127+
}
128+
}
129+
}
130+
131+
132+
133+

0 commit comments

Comments
 (0)