darkquasar / azurehunter Goto Github PK

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

License: MIT License

PowerShell 100.00%

azure digital-forensics cloud-forensics cybersecurity azuresearcher azforensics threat-hunting threathunting incident-response unifiedauditlog

azurehunter's Issues

Improve Base playbook to leverate Sylvan.CSV .NET library

Currently the "base" playbook is written with the basic powershell in-memory data tables.
We need to improve the base playbook by re-shuffling it to use Sylvan.CSV and achieve 10x speed increase in large data processing

Link to documentation broken

Hi,

I've been testing out this tool and ran a few playbooks after getting the CSV.

I noticed that the documentation link leads nowhere. Are there any other features or things that are important to know with this tool that's not mentioned on GitHub?

Link:

Add ability to list all Hunting Playbooks

We currently don't have a switch to Invoke-AzHunterPlaybook that will list all available playbooks and their purpose
It would be handy to have such option and add an obligatory short description on playbook templates to extract this information from

Recommend Projects