Comments (6)
Interesting, perhaps we need to add a switch to disable the O365 check
from sparrow.
Maybe I'm misreading the issue, but what if you comment out line 475:
Get-UALData -ExportDir $ExportDir -StartDate $StartDate -EndDate $EndDate -ExchangeEnvironment $ExchangeEnvironment -AzureEnvironment $AzureEnvironment -Verbose
Do you still receive the error?
from sparrow.
I don't think you're misreading the issue. I commented line 475 and re-ran and got the export files successfully generated. I had attempted to identify which line(s) would be required...but #notadev. Thanks! I still think it would be an improvement to have a switch but simply adding this to the documentation would also be sufficient. I'm closing the issue.
from sparrow.
Perhaps I closed too soon without verifying what the output results should be after commenting out 475. In my scenario, I only got two .csv files. ApplicationGraphPermissions.csv and Domain_list.csv.
What I don't have, and perhaps it's a good sign, is that there's no files for AppRoleAssignment_Operations_Export.csv, AppUpdate_Operations_Export.csv, Consent_Operations_Export.csv, Domain_Operations_Export.csv,PSLogin_Operations_Export.csv,SAMLToken_Operations_Export.csv,ServicePrincipal_Operations_Export.csv
from sparrow.
Thank you for clarifying. Sparrow relies on being able to look at the unified audit log of a tenant organization, which is part of the Exchange Online PowerShell cmdlets (https://docs.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps).
Without Exchange Online, you will only receive those two .csv files.
from sparrow.
Thanks for the clarification. And those two files are pretty benign in what they're going to show. the UAL stuff is really where the IOC or other unknown activities to be investigated would be.
from sparrow.
Related Issues (20)
- Audit Log search error HOT 2
- Choose your Azure Environment [AzureCloud] HOT 17
- Not Getting output to CSV when Sparrow is run HOT 1
- Expand Script to use Azure AD Logs and Azure Activity logs instead of Unified Audit Log
- What exactly is the expected powershell output? HOT 7
- Readme Update - Explicit Export Information HOT 1
- "Choose Your Environment" comes up blank if AzureADPreview is installed instead of AzureAD module HOT 1
- Add docs on how to setup/retreive credentials HOT 2
- New-ExoPSSession : Access is denied HOT 3
- AppId's in PSLogin_Operations_Export query not in results HOT 5
- Issue while running sparrow.ps1 HOT 1
- Aviary dashboard that works with live o365 data in Splunk
- Run via Taskmanager HOT 1
- Delete
- Having issues running the script for Sparrow ps1
- Error running in GCC High
- Errors connecting to Exchange environment
- How to Upload Dashboard HOT 3
- How do I ingest the csv files into the dashboard? HOT 2
- One more time
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sparrow.