├── Image
└── logo.jpg
├── CODE_OF_CONDUCT.md
├── RunCAMPReport.ps1
├── Outputs
└── output-json.ps1
├── LICENSE
├── SUPPORT.md
├── Utilities
├── CCValidationUtility.ps1
├── IPValidationUtility.ps1
├── IRMValidationUtility.ps1
├── RMValidationUtility.ps1
├── IGValidationUtility.ps1
└── DLPValidationUtility.ps1
├── Templates
└── NewDLPPolicyTemplate.txt
├── SECURITY.md
├── Checks
├── check-ComplianceManager.ps1
├── check-DLP.ps1
├── check-IRM102.ps1
├── check-IRM103.ps1
├── check-IP103.ps1
├── check-RM102.ps1
├── check-IG102.ps1
├── check-IG101.ps1
├── check-RM101.ps1
├── check-CC102.ps1
├── check-Audit101.ps1
├── check-eDiscovery102.ps1
├── check-CC103.ps1
├── check-eDiscovery101.ps1
├── check-Audit102.ps1
├── check-IP102.ps1
├── check-CC101.ps1
├── check-IP104.ps1
└── check-IP101.ps1
├── .gitignore
├── Remediation
└── RemediationAction.ps1
└── README.md
/Image/logo.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/OfficeDev/CAMP/HEAD/Image/logo.jpg
--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.md:
--------------------------------------------------------------------------------
1 | # Microsoft Open Source Code of Conduct
2 |
3 | This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
4 |
5 | Resources:
6 |
7 | - [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
8 | - [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
9 | - Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns
10 |
--------------------------------------------------------------------------------
/RunCAMPReport.ps1:
--------------------------------------------------------------------------------
1 | Remove-Module MCCAPreview -ErrorAction SilentlyContinue
2 | Remove-Module ExchangeOnlineManagement -ErrorAction SilentlyContinue
3 | Unblock-File ".\*"
4 | Unblock-File ".\Checks\*"
5 | Unblock-File ".\Outputs\*"
6 | Unblock-File ".\Remediation\*"
7 | Unblock-File ".\Utilities\*"
8 |
9 | Import-Module .\CAMP.psm1
10 |
11 |
12 | #Get-CAMPReport -Geo @("nam") -Solution @("num")
13 |
14 | #Get-CAMPReport -ExchangeEnvironmentName O365USGovGCCHigh
15 |
16 |
17 |
18 |
19 |
--------------------------------------------------------------------------------
/Outputs/output-json.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class json : CAMPOutput
4 | {
5 |
6 | $OutputDirectory=$null
7 |
8 | json()
9 | {
10 | $this.Name="JSON"
11 | }
12 |
13 | RunOutput($Checks,$Collection)
14 | {
15 |
16 | # Write to file
17 |
18 | if($null -eq $this.OutputDirectory)
19 | {
20 | $OutputDir = $this.DefaultOutputDirectory
21 | }
22 | else
23 | {
24 | $OutputDir = $this.OutputDirectory
25 | }
26 |
27 | $Tenant = $(($Collection["AcceptedDomains"] | Where-Object {$_.InitialDomain -eq $True}).DomainName -split '\.')[0]
28 | $ReportFileName = "CAMP-$($tenant)-$(Get-Date -Format 'yyyyMMddHHmm').json"
29 |
30 | $OutputFile = "$OutputDir\$ReportFileName"
31 |
32 | $Result = New-Object -TypeName PSObject -Property @{
33 | ResultDate=$(Get-Date -format s)
34 | Tenant=$Tenant
35 | Results=$Checks
36 | }
37 |
38 | $Result | ConvertTo-Json -Depth 100 | Out-File -FilePath $OutputFile
39 |
40 | $this.Completed = $True
41 | $this.Result = $OutputFile
42 |
43 | }
44 |
45 | }
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) Microsoft Corporation.
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE
22 |
--------------------------------------------------------------------------------
/SUPPORT.md:
--------------------------------------------------------------------------------
1 | # TODO: The maintainer of this repo has not yet edited this file
2 |
3 | **REPO OWNER**: Do you want Customer Service & Support (CSS) support for this product/project?
4 |
5 | - **No CSS support:** Fill out this template with information about how to file issues and get help.
6 | - **Yes CSS support:** Fill out an intake form at [aka.ms/onboardsupport](https://aka.ms/onboardsupport). CSS will work with/help you to determine next steps.
7 | - **Not sure?** Fill out an intake as though the answer were "Yes". CSS will help you decide.
8 |
9 | *Then remove this first heading from this SUPPORT.MD file before publishing your repo.*
10 |
11 | # Support
12 |
13 | ## How to file issues and get help
14 |
15 | This project uses GitHub Issues to track bugs and feature requests. Please search the existing
16 | issues before filing new issues to avoid duplicates. For new issues, file your bug or
17 | feature request as a new Issue.
18 |
19 | For help and questions about using this project, please **REPO MAINTAINER: INSERT INSTRUCTIONS HERE
20 | FOR HOW TO ENGAGE REPO OWNERS OR COMMUNITY FOR HELP. COULD BE A STACK OVERFLOW TAG OR OTHER
21 | CHANNEL. WHERE WILL YOU HELP PEOPLE?**.
22 |
23 | ## Microsoft Support Policy
24 |
25 | Support for this **PROJECT or PRODUCT** is limited to the resources listed above.
26 |
--------------------------------------------------------------------------------
/Utilities/CCValidationUtility.ps1:
--------------------------------------------------------------------------------
1 |
2 | using module "..\CAMP.psm1"
3 | <#
4 | This function returns list of parent labels and sublabels
5 | #>
6 |
7 | Function Get-RoleGroupwithMembers {
8 | Param(
9 | $RoleGroups,
10 | $LogFile,
11 | $Role
12 | )
13 |
14 | $ConfigObjectList = @()
15 | try {
16 | $RoleGroupName = ""
17 | if ( $null -eq $RoleGroups) {
18 | $ConfigObject = [CAMPCheckConfig]::new()
19 | $ConfigObject.ConfigItem = "$Role"
20 | $ConfigObject.ConfigData = "No Role Group with any Members"
21 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
22 | $ConfigObjectList += $ConfigObject
23 | }
24 | else {
25 | foreach ($RoleGroup in $RoleGroups ) {
26 | if ($RoleGroupName -ne "") {
27 | $RoleGroupName += ", $($RoleGroup.Name)"
28 | }
29 | else {
30 | $RoleGroupName = $($RoleGroup.Name)
31 | }
32 | }
33 | $ConfigObject = [CAMPCheckConfig]::new()
34 | $ConfigObject.ConfigItem = "$Role"
35 | $ConfigObject.ConfigData = $($RoleGroupName)
36 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
37 | $ConfigObjectList += $ConfigObject
38 | }
39 | }
40 | catch {
41 | Write-Host "Error:$(Get-Date) There was an issue while running CAMP. Please try running the tool again after some time." -ForegroundColor:Red
42 | $ErrorMessage = $_.ToString()
43 | $StackTraceInfo = $_.ScriptStackTrace
44 | Write-Log -IsError -ErrorMessage $ErrorMessage -StackTraceInfo $StackTraceInfo -LogFile $LogFile -ErrorAction:SilentlyContinue
45 | }
46 | return $ConfigObjectList
47 | }
48 |
49 |
--------------------------------------------------------------------------------
/Templates/NewDLPPolicyTemplate.txt:
--------------------------------------------------------------------------------
1 | #Attributes for Policy
2 | $PolicyName = '';
3 | $params = @{
4 | 'Name' = $PolicyName
5 | 'ExchangeLocation' ='All';
6 | 'OneDriveLocation' = 'All';
7 | 'SharePointLocation' = 'All';
8 | 'TeamsLocation' = 'All';
9 | 'Mode' = 'TestWithNotifications';
10 | }
11 |
12 |
13 | #Create New Policy
14 | new-dlpcompliancepolicy @params
15 |
16 |
17 | #Low Volume Rule
18 | $LowSensitiveInfo = @()
19 |
20 | $LowRulevalue = @{
21 | 'Name' = '';
22 | 'Comment' = "Helps detect the presence of information commonly considered to be subject to the compliance";
23 | 'Policy' = $PolicyName;
24 | 'ContentContainsSensitiveInformation' = $LowSensitiveInfo
25 | 'BlockAccess' = $false;
26 | 'AccessScope'='NotInOrganization';
27 | 'Disabled'=$false;
28 | 'ReportSeverityLevel' = 'Low';
29 | 'NotifyUser'=@('SiteAdmin', 'LastModifier', 'Owner') }
30 |
31 |
32 |
33 | #High Volume Rule
34 | $HighSensitiveInfo = @()
35 |
36 | $HighRulevalue = @{
37 | 'Name' = '';
38 | 'Comment' = "Helps detect the presence of information commonly considered to be subject to the compliance";
39 | 'Policy' = $PolicyName;
40 | 'ContentContainsSensitiveInformation' = $HighSensitiveInfo
41 | 'BlockAccess' = $false;
42 | 'ReportSeverityLevel' = 'High';
43 | 'AccessScope'='NotInOrganization';
44 | 'Disabled'=$false;
45 | 'GenerateIncidentReport'='SiteAdmin';
46 | 'IncidentReportContent'='All';
47 | 'NotifyAllowOverride'='FalsePositive,WithJustification';
48 | 'NotifyUser'=@('SiteAdmin', 'LastModifier', 'Owner')
49 | }
50 |
51 |
52 | #Create Rules for Policy
53 | New-dlpcompliancerule @HighRulevalue
54 | New-dlpcompliancerule @LowRulevalue
55 |
--------------------------------------------------------------------------------
/SECURITY.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## Security
4 |
5 | Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).
6 |
7 | If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below.
8 |
9 | ## Reporting Security Issues
10 |
11 | **Please do not report security vulnerabilities through public GitHub issues.**
12 |
13 | Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report).
14 |
15 | If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey).
16 |
17 | You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc).
18 |
19 | Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20 |
21 | * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22 | * Full paths of source file(s) related to the manifestation of the issue
23 | * The location of the affected source code (tag/branch/commit or direct URL)
24 | * Any special configuration required to reproduce the issue
25 | * Step-by-step instructions to reproduce the issue
26 | * Proof-of-concept or exploit code (if possible)
27 | * Impact of the issue, including how an attacker might exploit the issue
28 |
29 | This information will help us triage your report more quickly.
30 |
31 | If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs.
32 |
33 | ## Preferred Languages
34 |
35 | We prefer all communications to be in English.
36 |
37 | ## Policy
38 |
39 | Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd).
40 |
41 |
42 |
--------------------------------------------------------------------------------
/Utilities/IPValidationUtility.ps1:
--------------------------------------------------------------------------------
1 |
2 | using module "..\CAMP.psm1"
3 | <#
4 | This function returns list of parent labels and sublabels
5 | #>
6 |
7 | Function Get-LabelClassification {
8 | Param(
9 | $LogFile
10 | )
11 | $SubLabels = @{}
12 | $ParentLabels = @{}
13 | $ParentSubLabelAssociation = @{}
14 | $ParentNameForSubLabelAssociation = @{}
15 | try {
16 | foreach ($LabelDefined in $Config["GetLabel"]) {
17 | $Label = $LabelDefined
18 | if ($($Label.ParentId)) {
19 | $SubLabels.add($($Label.Name), $Label)
20 | if ($ParentSubLabelAssociation.ContainsKey($($Label.ParentId))) {
21 | $ParentSubLabelAssociation[$($Label.ParentId)].Add($($Label.Name)) #+= $($Label.Name)
22 | }
23 | else {
24 | $ParentSubLabelAssociation.add($($Label.ParentId), [System.Collections.ArrayList]@()) #$($Label.Name))
25 | $ParentSubLabelAssociation[$($Label.ParentId)].Add($($Label.Name))
26 | }
27 | }
28 | else {
29 | $ParentLabels.add($($Label.Name), $Label)
30 | }
31 |
32 | }
33 |
34 | # Setting parent name for the parent with sublabels by creating a hash table with key as
35 | # parent guid and value as parent name.
36 | if ($($($ParentSubLabelAssociation.Keys).count) -gt 0) {
37 | foreach ($ParentGUID in $($ParentSubLabelAssociation.Keys)) {
38 | foreach ($LabelDefined in $Config["GetLabel"]) {
39 | if ($($LabelDefined.Guid) -eq $ParentGUID) {
40 | $ParentNameForSubLabelAssociation[$ParentGUID] = $LabelDefined.Name
41 | }
42 | }
43 | }
44 | }
45 | }
46 | catch {
47 | Write-Host "Error:$(Get-Date) There was an issue while running CAMP. Please try running the tool again after some time." -ForegroundColor:Red
48 | $ErrorMessage = $_.ToString()
49 | $StackTraceInfo = $_.ScriptStackTrace
50 | Write-Log -IsError -ErrorMessage $ErrorMessage -StackTraceInfo $StackTraceInfo -LogFile $LogFile -ErrorAction:SilentlyContinue
51 | }
52 |
53 |
54 | $LabelClassification = New-Object -TypeName psobject
55 | $LabelClassification | Add-Member -MemberType NoteProperty -Name sublabels -Value $SubLabels
56 | $LabelClassification | Add-Member -MemberType NoteProperty -Name parentlabels -Value $ParentLabels
57 | $LabelClassification | Add-Member -MemberType NoteProperty -Name parentsublabelassociation -Value $ParentSubLabelAssociation
58 | $LabelClassification | Add-Member -MemberType NoteProperty -Name parentnameforsublabelassociation -Value $ParentNameForSubLabelAssociation
59 | return $LabelClassification
60 | }
61 |
62 |
--------------------------------------------------------------------------------
/Checks/check-ComplianceManager.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class ComplianceManager : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | ComplianceManager() {
10 | $this.Control = "Compliance Manager"
11 | $this.ParentArea = "Compliance Manager"
12 | $this.Area = "Compliance Manager"
13 | $this.Name = "Use Compliance Manager to manage your compliance posture"
14 | $this.PassText = "Your organization should use Compliance Manager to manage your compliance posture"
15 | $this.FailRecommendation = "Your organization should use Compliance Manager to manage your compliance posture"
16 | $this.Importance = "Compliance Manager is an end-to-end solution in the Microsoft 365 compliance center for managing and tracking compliance activities. It simplifies compliance and helps reduce risk. Compliance Manager translates complex regulatory requirements to specific controls and through compliance score, provides a quantifiable measure of compliance. It offers intuitive compliance management, a vast library of scalable assessments, and built-in automation.
17 | Its a great place to begin your compliance journey because it gives you an initial assessment of your compliance posture the first time you visit."
18 | $this.ExpandResults = $true
19 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
20 | {
21 | $this.Links = @{
22 | "Visit Compliance Manager" = "https://aka.ms/mcca-gcch-cm-compliance-manager"
23 | "Learn more about Compliance Manager" = "https://aka.ms/mcca-cm-docs-learn-more"
24 | "Compliance Manager Quickstart Guide" = "https://aka.ms/mcca-cm-docs-action"
25 |
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "Visit Compliance Manager" = "https://aka.ms/mcca-dod-cm-compliance-manager"
31 | "Learn more about Compliance Manager" = "https://aka.ms/mcca-cm-docs-learn-more"
32 | "Compliance Manager Quickstart Guide" = "https://aka.ms/mcca-cm-docs-action"
33 |
34 | }
35 | }else
36 | {
37 | $this.Links = @{
38 | "Visit Compliance Manager" = "https://aka.ms/mcca-cm-compliance-manager"
39 | "Learn more about Compliance Manager" = "https://aka.ms/mcca-cm-docs-learn-more"
40 | "Compliance Manager Quickstart Guide" = "https://aka.ms/mcca-cm-docs-action"
41 |
42 | }
43 | }
44 | }
45 |
46 | <#
47 |
48 | RESULTS
49 |
50 | #>
51 |
52 | GetResults($Config) {
53 |
54 | $ConfigObjectList = @()
55 |
56 | $ConfigObject = [CAMPCheckConfig]::new()
57 |
58 | $ConfigObject.SetResult([CAMPConfigLevel]::Recommendation, "Pass")
59 | $this.AddConfig($ConfigObject)
60 | $ConfigObjectList += $ConfigObject
61 |
62 | $this.Completed = $True
63 | }
64 |
65 | }
66 |
67 |
--------------------------------------------------------------------------------
/Utilities/IRMValidationUtility.ps1:
--------------------------------------------------------------------------------
1 |
2 | using module "..\CAMP.psm1"
3 | <#
4 | This function returns list of parent labels and sublabels
5 | #>
6 |
7 | Function Get-IRMConfigurationPolicy {
8 | Param(
9 | $Config,
10 | $Templates,
11 | $LogFile
12 | )
13 | $ConfigObjectList = @()
14 | try {
15 | $AnyPolicyEnabled = $false
16 | $IRMPolicy = @()
17 | foreach($Template in $templates)
18 | {
19 | $IRMPolicy += $Config["GetInsiderRiskPolicy"] | Where-Object { $_.InsiderRiskScenario -eq $Template }
20 |
21 | }
22 |
23 | foreach ($Policy in $IRMPolicy) {
24 | if ($($Policy.Mode) -eq "Enable") {
25 | if ($AnyPolicyEnabled -eq $false) {
26 | $AnyPolicyEnabled = $true
27 | }
28 |
29 | $ConfigObject = [CAMPCheckConfig]::new()
30 | $ConfigObject.Object = "Policy"
31 | $ConfigObject.ConfigItem = "$($Policy.Name)"
32 |
33 | $UsergroupsEnabled = ""
34 | $ExchangeLocation = $Policy.ExchangeLocation
35 | foreach ($Location in $ExchangeLocation) {
36 | if ($UsergroupsEnabled -eq "") {
37 | $UsergroupsEnabled += "$Location"
38 | }
39 | else {
40 | $UsergroupsEnabled += ", $Location"
41 | }
42 | }
43 | if ($($Policy.InsiderRiskScenario) -eq "HighValueEmployeeDataLeak") {
44 | $PolicyGroups = $Policy.CustomTags
45 | foreach ($PolicyGroup in $PolicyGroups) {
46 | $Group = $PolicyGroup.Split("""")#The policy group details come as string hence parsing to get group name
47 | if ($UsergroupsEnabled -eq "") {
48 | $UsergroupsEnabled += "$($Group[3])"
49 | }
50 | else {
51 | $UsergroupsEnabled += ", $($Group[3])"
52 | }
53 | }
54 | }
55 | $ConfigObject.ConfigData = "$UsergroupsEnabled"
56 |
57 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
58 | $ConfigObjectList += $ConfigObject
59 | }
60 | }
61 |
62 | if ($AnyPolicyEnabled -eq $false) {
63 | $ConfigObject = [CAMPCheckConfig]::new()
64 | $ConfigObject.Object = "Policy"
65 | $ConfigObject.ConfigItem = "No active policy defined"
66 | $ConfigObject.ConfigData = ""
67 | $ConfigObject.SetResult([CAMPConfigLevel]::OK, "Fail")
68 | $ConfigObjectList += $ConfigObject
69 | }
70 |
71 | }
72 | catch {
73 | Write-Host "Error:$(Get-Date) There was an issue while running CAMP. Please try running the tool again after some time." -ForegroundColor:Red
74 | $ErrorMessage = $_.ToString()
75 | $StackTraceInfo = $_.ScriptStackTrace
76 | Write-Log -IsError -ErrorMessage $ErrorMessage -StackTraceInfo $StackTraceInfo -LogFile $LogFile -ErrorAction:SilentlyContinue
77 | }
78 | return $ConfigObjectList
79 | }
80 |
81 |
--------------------------------------------------------------------------------
/Checks/check-DLP.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class DLP : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 | $SIT = $null
9 | $RemediationPolicyName = $null
10 |
11 | DLP($InfoParams) {
12 | $this.Control = $InfoParams["Control"]
13 | $this.ParentArea = $InfoParams["ParentArea"]
14 | $this.Area = $InfoParams["Area"]
15 | $this.Name = $InfoParams["Name"]
16 | $this.RemediationPolicyName = $InfoParams["RemediationPolicyName"]
17 | $this.PassText = $InfoParams["PassText"]
18 | $this.FailRecommendation = $InfoParams["FailRecommendation"]
19 | $this.Importance = $InfoParams["Importance"]
20 | $this.CheckType = [CheckType]::ObjectPropertyValue
21 | $this.ObjectType = "DLP Policy"
22 | $this.ItemName = "Sensitive Information Type"
23 | $this.DataType = "Remarks"
24 | $this.SIT = $InfoParams["SIT"]
25 | $this.Links = $InfoParams["Links"]
26 |
27 | }
28 |
29 | <#
30 |
31 | RESULTS
32 |
33 | #>
34 |
35 | GetResults($Config) {
36 | if (($Config["GetDlpComplianceRule"] -eq "Error") -or ($Config["GetDlpCompliancePolicy"] -eq "Error")) {
37 | $this.Completed = $false
38 | }
39 | else {
40 | if(($null -eq $($this.SIT)) -or ($($this.SIT) -eq ""))
41 | {
42 | $this.ExpandResults = $false
43 | $CheckNameDisplay = $this.RemediationPolicyName
44 | $CheckNameDisplayString = $CheckNameDisplay.Substring(5)
45 | $this.Importance += "
Note : We currently do not support SITs for DLP policies for $CheckNameDisplayString for the geolocations for which this report is generated. Please review your DLP policies to ensure you are protected.
"
46 | $ConfigObject = [CAMPCheckConfig]::new()
47 | $ConfigObject.SetResult([CAMPConfigLevel]::Recommendation, "Pass")
48 | $this.AddConfig($ConfigObject)
49 |
50 |
51 | }
52 | else
53 | {
54 | $SensitiveTypes = @{}
55 | foreach ($SIT in $this.SIT) {
56 | $SensitiveTypes[$SIT] = $null
57 | }
58 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
59 |
60 | ForEach ($UtilityFile in $UtilityFiles) {
61 | . $UtilityFile.FullName
62 | }
63 | $Name = "$($this.RemediationPolicyName)"
64 | if ($Name.length -gt 60) { $Name = $Name.substring(0, 60) }
65 |
66 | $LogFile = $this.LogFile
67 | $ConfigObjectList = Get-DLPPolicyValidation -SensitiveTypes $SensitiveTypes -Config $Config -Name $Name -LogFile $LogFile
68 | Foreach ($ConfigObject in $ConfigObjectList) {
69 | $this.AddConfig($ConfigObject)
70 | }
71 |
72 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
73 | if ($($hasremediation.count) -gt 0)
74 | {
75 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
76 | RemediationAvailable = $True
77 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
78 | }
79 | }
80 | $this.ExpandResults = $True
81 | }
82 | $this.Completed = $True
83 | }
84 |
85 | }
86 |
87 | }
--------------------------------------------------------------------------------
/Checks/check-IRM102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IRM102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IRM102() {
10 | $this.Control = "IRM-102"
11 | $this.ParentArea = "Insider Risk"
12 | $this.Area = "Insider Risk Management"
13 | $this.Name = "Create customized or use default insider risk management policies for departing employee data theft"
14 | $this.PassText = "Your organization has set up IRM policies for departing employee data theft"
15 | $this.FailRecommendation = "Your organization should set up IRM policies for departing employee data theft"
16 | $this.Importance = "Your organization should create an insider risk management policy to detect, investigate, and take action on departing employee data theft. Insider risk management in Microsoft 365 leverages an HR connector and selected indicators to alert you of any user activity related to data theft among departing employees."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Policy"
19 | $this.DataType = "User Groups"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
24 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-gcch-irm-compliance-center"
25 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
31 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-dod-irm-compliance-center"
32 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
33 | }
34 | }else
35 | {
36 | $this.Links = @{
37 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
38 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-irm-compliance-center"
39 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
40 | }
41 | }
42 | }
43 |
44 | <#
45 |
46 | RESULTS
47 |
48 | #>
49 |
50 | GetResults($Config) {
51 | if ($Config["GetInsiderRiskPolicy"] -eq "Error") {
52 | $this.Completed = $false
53 | }
54 | else {
55 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
56 |
57 | ForEach ($UtilityFile in $UtilityFiles) {
58 | . $UtilityFile.FullName
59 | }
60 |
61 | $Template = "IntellectualPropertyTheft"
62 | $LogFile = $this.LogFile
63 |
64 |
65 | $ConfigObjectList = Get-IRMConfigurationPolicy -Config $Config -Templates @($Template) -LogFile $LogFile
66 | Foreach ($ConfigObject in $ConfigObjectList) {
67 | $this.AddConfig($ConfigObject)
68 | }
69 |
70 |
71 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne '' }
72 | if ($($hasremediation.count) -gt 0) {
73 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
74 | RemediationAvailable = $True
75 | RemediationText = "You need to connect to Exchange Online Center PowerShell to execute the below commands. Please follow steps defined in Connect to Exchange Online Center PowerShell."
76 | }
77 | }
78 | $this.Completed = $True
79 | }
80 |
81 | }
82 |
83 | }
--------------------------------------------------------------------------------
/Checks/check-IRM103.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IRM103 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IRM103() {
10 | $this.Control = "IRM-103"
11 | $this.ParentArea = "Insider Risk"
12 | $this.Area = "Insider Risk Management"
13 | $this.Name = "Create customized or use default insider risk management policies for data leaks"
14 | $this.PassText = "Your organization has set up IRM policies for data leaks"
15 | $this.FailRecommendation = "Your organization should set up IRM policies for data leaks"
16 | $this.Importance = "Microsoft recommends that your organization create an insider risk management policy to detect, investigate, and take action on data leaks. Data leaks can include accidental oversharing of information outside your organization or data theft with malicious intent."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Policy"
19 | $this.DataType = "User Groups"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 |
24 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
25 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-gcch-irm-compliance-center"
26 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
27 | }
28 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
29 | {
30 | $this.Links = @{
31 |
32 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
33 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-dod-irm-compliance-center"
34 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
35 | }
36 | }else
37 | {
38 | $this.Links = @{
39 |
40 | "Getting started with Insider risk management" = "https://aka.ms/mcca-irm-docs-action"
41 | "Compliance Center - Insider Risk Management" = "https://aka.ms/mcca-irm-compliance-center"
42 | "Insider risk management policies" = "https://aka.ms/mcca-irm-docs-learn-more"
43 | }
44 | }
45 | }
46 |
47 | <#
48 |
49 | RESULTS
50 |
51 | #>
52 |
53 | GetResults($Config) {
54 | if ($Config["GetInsiderRiskPolicy"] -eq "Error") {
55 | $this.Completed = $false
56 | }
57 | else {
58 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
59 |
60 | ForEach ($UtilityFile in $UtilityFiles) {
61 | . $UtilityFile.FullName
62 | }
63 | #LeakOfInformation OR DisgruntledEmployeeDataLeak OR HighValueEmployeeDataLeak
64 | $Template = @("LeakOfInformation","DisgruntledEmployeeDataLeak","HighValueEmployeeDataLeak")
65 | $LogFile = $this.LogFile
66 |
67 |
68 | $ConfigObjectList = Get-IRMConfigurationPolicy -Config $Config -Templates $Template -LogFile $LogFile
69 | Foreach ($ConfigObject in $ConfigObjectList) {
70 | $this.AddConfig($ConfigObject)
71 | }
72 |
73 |
74 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne '' }
75 | if ($($hasremediation.count) -gt 0) {
76 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
77 | RemediationAvailable = $True
78 | RemediationText = "You need to connect to Exchange Online Center PowerShell to execute the below commands. Please follow steps defined in Connect to Exchange Online Center PowerShell."
79 | }
80 | }
81 | $this.Completed = $True
82 | }
83 |
84 | }
85 |
86 | }
--------------------------------------------------------------------------------
/Checks/check-IP103.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IP103 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IP103() {
10 | $this.Control = "IP-103"
11 | $this.ParentArea = "Microsoft Information Protection"
12 | $this.Area = "Information Protection"
13 | $this.Name = "Use IRM for Exchange Online"
14 | $this.PassText = "Your organization has enabled IRM for Exchange Online"
15 | $this.FailRecommendation = "Your organization should enable IRM for Exchange Online"
16 | $this.Importance = "Your organization should enable and use Azure Information Protection for Exchange Online. This configuration lets Exchange provide protection solutions, such as mail flow rules, data loss prevention policies that contain sets of conditions to filter email messages and take actions, and protection rules for Outlook clients."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "IRM Configuration"
19 | $this.DataType = "Setting"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "How to configure applications for Azure Rights Management" = "https://aka.ms/mcca-ip-docs-action-ARM"
24 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-gcch-ip-compliance-center"
25 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-gcch-ip-compliance-manager"
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "How to configure applications for Azure Rights Management" = "https://aka.ms/mcca-ip-docs-action-ARM"
31 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-dod-ip-compliance-center"
32 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-dod-ip-compliance-manager"
33 | }
34 | }else
35 | {
36 | $this.Links = @{
37 | "How to configure applications for Azure Rights Management" = "https://aka.ms/mcca-ip-docs-action-ARM"
38 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-ip-compliance-center"
39 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-ip-compliance-manager"
40 | }
41 | }
42 | }
43 |
44 | <#
45 |
46 | RESULTS
47 |
48 | #>
49 |
50 | GetResults($Config) {
51 | if ($Config["GetIRMConfiguration"] -eq "Error") {
52 | $this.Completed = $false
53 | }
54 | else {
55 | $ConfigObjectList = @()
56 | $IRMconfiguration = $Config["GetIRMConfiguration"]
57 | $ConfigObject = [CAMPCheckConfig]::new()
58 | $ConfigObject.Object = "IRM Configuration"
59 | $ConfigObject.ConfigItem = "AzureRMSLicensingEnabled"
60 | $ConfigObject.ConfigData = $IRMconfiguration.AzureRMSLicensingEnabled
61 |
62 | # Determine if AzureRMSLicensingEnabled is true in IRM Configuration
63 | If ($IRMconfiguration.AzureRMSLicensingEnabled -eq $true) {
64 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
65 | }
66 | Else {
67 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
68 | }
69 | $ConfigObjectList += $ConfigObject
70 | $this.AddConfig($ConfigObject)
71 |
72 |
73 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
74 | if ($($hasremediation.count) -gt 0)
75 | {
76 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
77 | RemediationAvailable = $True
78 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
79 | }
80 | }
81 | $this.Completed = $True
82 | }
83 |
84 | }
85 |
86 | }
--------------------------------------------------------------------------------
/Checks/check-RM102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class RM102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | RM102() {
10 | $this.Control = "RM-102"
11 | $this.ParentArea = "Microsoft Information Governance"
12 | $this.Area = "Records Management"
13 | $this.Name = "Automatically Apply Record Labels"
14 | $this.PassText = "Your organization is using auto apply record label policies"
15 | $this.FailRecommendation = "Your organization should use auto apply record label policies"
16 | $this.Importance = "Your organization should use records management to manage regulatory, legal, and business-critical records across corporate data. You can automatically apply record labels to content that matches certain conditions."
17 | $this.ExpandResults = $True
18 | $this.CheckType = [CheckType]::ObjectPropertyValue
19 | $this.ObjectType = "Policy Name"
20 | $this.ItemName = "Labels"
21 | $this.DataType = "Remarks"
22 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
23 | {
24 | $this.Links = @{
25 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
26 | "Compliance Center - Records Management" = "https://aka.ms/mcca-gcch-rm-compliance-center"
27 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
28 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-gcch-rm-compliance-manager"
29 | }
30 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
31 | {
32 | $this.Links = @{
33 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
34 | "Compliance Center - Records Management" = "https://aka.ms/mcca-dod-rm-compliance-center"
35 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
36 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-dod-rm-compliance-manager"
37 | }
38 | }else
39 | {
40 | $this.Links = @{
41 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
42 | "Compliance Center - Records Management" = "https://aka.ms/mcca-rm-compliance-center"
43 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
44 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-rm-compliance-manager"
45 | }
46 | }
47 | }
48 |
49 | <#
50 |
51 | RESULTS
52 |
53 | #>
54 |
55 | GetResults($Config) {
56 | if (($Config["GetRetentionComplianceRule"] -eq "Error") -or ($Config["GetRetentionCompliancePolicy"] -eq "Error") -or ($Config["GetComplianceTag"] -eq "Error")) {
57 | $this.Completed = $false
58 | }
59 | else {
60 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
61 |
62 | ForEach ($UtilityFile in $UtilityFiles) {
63 |
64 | . $UtilityFile.FullName
65 |
66 | }
67 |
68 | $LogFile = $this.LogFile
69 | $Mode= "Auto"
70 | $ConfigObjectList = Get-RMPolicyValidation -LogFile $LogFile -Mode $Mode
71 |
72 | Foreach ($ConfigObject in $ConfigObjectList) {
73 | $this.AddConfig($ConfigObject)
74 | }
75 |
76 |
77 |
78 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
79 | if ($($hasremediation.count) -gt 0)
80 | {
81 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
82 | RemediationAvailable = $True
83 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
84 | }
85 | }
86 | $this.Completed = $True
87 |
88 | }
89 |
90 | }
91 |
92 | }
93 |
94 |
--------------------------------------------------------------------------------
/Checks/check-IG102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IG102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IG102() {
10 | $this.Control = "IG-102"
11 | $this.ParentArea = "Microsoft Information Governance"
12 | $this.Area = "Information Governance"
13 | $this.Name = "Use Data Retention Labels and Policies"
14 | $this.PassText = "Your organization is using retention policies by publishing a retention label"
15 | $this.FailRecommendation = "Your organization should use retention policies by publishing a retention label"
16 | $this.Importance = "Your organization should apply retention labels to content when it matches specific conditions (such as containing specific keywords or types of sensitive information)."
17 | $this.ExpandResults = $True
18 | $this.CheckType = [CheckType]::ObjectPropertyValue
19 | $this.ObjectType = "Retention Policies"
20 | $this.ItemName = "Labels"
21 | $this.DataType = "Remarks"
22 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
23 | {
24 | $this.Links = @{
25 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
26 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
27 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-gcch-ig-compliance-center"
28 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-gcch-ig-compliance-manager"
29 | }
30 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
31 | {
32 | $this.Links = @{
33 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
34 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
35 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-dod-ig-compliance-center"
36 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-dod-ig-compliance-manager"
37 | }
38 | }else
39 | {
40 | $this.Links = @{
41 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
42 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
43 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-ig-compliance-center"
44 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-ig-compliance-manager"
45 | }
46 | }
47 | }
48 |
49 | <#
50 |
51 | RESULTS CC Admin, CC Analyst, CC Investigator and CC Viewer
52 | #>
53 |
54 | GetResults($Config) {
55 | if (($Config["GetRetentionComplianceRule"] -eq "Error") -or ($Config["GetRetentionCompliancePolicy"] -eq "Error")) {
56 | $this.Completed = $false
57 | }
58 | else {
59 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
60 |
61 | ForEach ($UtilityFile in $UtilityFiles) {
62 |
63 | . $UtilityFile.FullName
64 |
65 | }
66 |
67 | $LogFile = $this.LogFile
68 | $Mode = "Publish"
69 | $ConfigObjectList = Get-RetentionPolicyValidation -LogFile $LogFile -Mode $Mode
70 |
71 | Foreach ($ConfigObject in $ConfigObjectList) {
72 | $this.AddConfig($ConfigObject)
73 | }
74 |
75 |
76 |
77 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
78 | if ($($hasremediation.count) -gt 0)
79 | {
80 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
81 | RemediationAvailable = $True
82 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
83 | }
84 | }
85 | $this.Completed = $True
86 |
87 | }
88 |
89 | }
90 |
91 | }
--------------------------------------------------------------------------------
/Checks/check-IG101.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IG101 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IG101() {
10 | $this.Control = "IG-101"
11 | $this.ParentArea = "Microsoft Information Governance"
12 | $this.Area = "Information Governance"
13 | $this.Name = "Auto-Apply Retention Labels"
14 | $this.PassText = "Your organization is using auto-apply retention policies"
15 | $this.FailRecommendation = "Your organization should use auto-apply retention policies"
16 | $this.Importance = "Your organization should automatically apply retention labels to content when it matches specific conditions (such as containing specific keywords or types of sensitive information). Microsoft recommends that automatic labeling be implemented to decrease reliance on users for correct classification."
17 | $this.ExpandResults = $True
18 | $this.CheckType = [CheckType]::ObjectPropertyValue
19 | $this.ObjectType = "Retention Policies"
20 | $this.ItemName = "Labels"
21 | $this.DataType = "Remarks"
22 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
23 | {
24 | $this.Links = @{
25 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
26 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
27 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-gcch-ig-compliance-center"
28 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-gcch-ig-compliance-manager"
29 | }
30 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
31 | {
32 | $this.Links = @{
33 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
34 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
35 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-dod-ig-compliance-center"
36 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-dod-ig-compliance-manager"
37 | }
38 | }else
39 | {
40 | $this.Links = @{
41 | "Learn More Overview of retention labels" = "https://aka.ms/mcca-ig-docs-learn-more"
42 | "Overview of retention policies" = "https://aka.ms/mcca-ig-docs-retention-policies"
43 | "Compliance Center - Information Governance" = "https://aka.ms/mcca-ig-compliance-center"
44 | "Compliance Manager - IG Actions" = "https://aka.ms/mcca-ig-compliance-manager"
45 | }
46 | }
47 | }
48 |
49 | <#
50 |
51 | RESULTS CC Admin, CC Analyst, CC Investigator and CC Viewer
52 | #>
53 |
54 | GetResults($Config) {
55 | if (($Config["GetRetentionComplianceRule"] -eq "Error") -or ($Config["GetRetentionCompliancePolicy"] -eq "Error")) {
56 | $this.Completed = $false
57 | }
58 | else {
59 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
60 |
61 | ForEach ($UtilityFile in $UtilityFiles) {
62 |
63 | . $UtilityFile.FullName
64 |
65 | }
66 |
67 | $LogFile = $this.LogFile
68 | $Mode = "Auto"
69 | $ConfigObjectList = Get-RetentionPolicyValidation -LogFile $LogFile -Mode $Mode
70 |
71 | Foreach ($ConfigObject in $ConfigObjectList) {
72 | $this.AddConfig($ConfigObject)
73 | }
74 |
75 |
76 |
77 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
78 | if ($($hasremediation.count) -gt 0)
79 | {
80 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
81 | RemediationAvailable = $True
82 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
83 | }
84 | }
85 | $this.Completed = $True
86 |
87 | }
88 |
89 | }
90 |
91 | }
--------------------------------------------------------------------------------
/Checks/check-RM101.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class RM101 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | RM101() {
10 | $this.Control = "RM-101"
11 | $this.ParentArea = "Microsoft Information Governance"
12 | $this.Area = "Records Management"
13 | $this.Name = "Declare Data as Records by Creating & Publishing a Record Label"
14 | $this.PassText = "Your organization is using record labels to declare data as records"
15 | $this.FailRecommendation = "Your organization should use record labels to declare data as records"
16 | $this.Importance = "Your organization should use records management to manage regulatory, legal, and business-critical records across corporate data. By using retention labels to declare records, you can implement a single, consistent records-management strategy across all of Office 365."
17 | $this.ExpandResults = $True
18 | $this.CheckType = [CheckType]::ObjectPropertyValue
19 | $this.ObjectType = "Policy Name"
20 | $this.ItemName = "Labels"
21 | $this.DataType = "Remarks"
22 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
23 | {
24 | $this.Links = @{
25 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
26 | "Compliance Center - Records Management" = "https://aka.ms/mcca-gcch-rm-compliance-center"
27 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
28 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-gcch-rm-compliance-manager"
29 | }
30 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
31 | {
32 | $this.Links = @{
33 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
34 | "Compliance Center - Records Management" = "https://aka.ms/mcca-dod-rm-compliance-center"
35 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
36 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-dod-rm-compliance-manager"
37 | }
38 | }else
39 | {
40 | $this.Links = @{
41 | "Overview of Records" = "https://aka.ms/mcca-rm-docs-records"
42 | "Compliance Center - Records Management" = "https://aka.ms/mcca-rm-compliance-center"
43 | "Records management in Microsoft 365" = "https://aka.ms/mcca-rm-docs-records-management"
44 | "Compliance Manager - RM Actions" = "https://aka.ms/mcca-rm-compliance-manager"
45 | }
46 | }
47 | }
48 |
49 | <#
50 |
51 | RESULTS
52 |
53 | #>
54 |
55 | GetResults($Config) {
56 | if (($Config["GetRetentionComplianceRule"] -eq "Error") -or ($Config["GetRetentionCompliancePolicy"] -eq "Error") -or ($Config["GetComplianceTag"] -eq "Error")) {
57 | $this.Completed = $false
58 | }
59 | else {
60 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
61 |
62 | ForEach ($UtilityFile in $UtilityFiles) {
63 |
64 | . $UtilityFile.FullName
65 |
66 | }
67 |
68 | $LogFile = $this.LogFile
69 | $Mode= "Publish"
70 | $ConfigObjectList = Get-RMPolicyValidation -LogFile $LogFile -Mode $Mode
71 |
72 | Foreach ($ConfigObject in $ConfigObjectList) {
73 | $this.AddConfig($ConfigObject)
74 | }
75 |
76 |
77 |
78 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
79 | if ($($hasremediation.count) -gt 0)
80 | {
81 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
82 | RemediationAvailable = $True
83 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
84 | }
85 | }
86 | $this.Completed = $True
87 |
88 | }
89 |
90 | }
91 |
92 | }
93 |
94 |
--------------------------------------------------------------------------------
/Checks/check-CC102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class CC102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | CC102() {
10 | $this.Control = "CC-102"
11 | $this.ParentArea = "Insider Risk"
12 | $this.Area = "Communication Compliance"
13 | $this.Name = "Monitor Communications for Offensive or Threatening Language"
14 | $this.PassText = "Your organization has defined policies to monitor internal communications"
15 | $this.FailRecommendation = "Your organization should define policies to monitor internal communications"
16 | $this.Importance = "Your organization should use communication compliance to monitor internal communication for offensive and threatening language. You can create a policy that uses pretrained classifier to detect content containing profanities or language that might be considered threatening or harrassment."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Policy"
19 | $this.DataType = "Policy Status"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
24 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-gcch-cc-compliance-center"
25 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-gcch-cc-compliance-manager"
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
31 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-dod-cc-compliance-center"
32 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-dod-cc-compliance-manager"
33 | }
34 | }else
35 | {
36 | $this.Links = @{
37 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
38 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-cc-compliance-center"
39 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-cc-compliance-manager"
40 |
41 | }
42 | }
43 | }
44 |
45 | <#
46 |
47 | RESULTS CC Admin, CC Analyst, CC Investigator and CC Viewer
48 | #>
49 |
50 | GetResults($Config) {
51 | if ($Config["GetSupervisoryReviewPolicyV2"] -eq "Error") {
52 | $this.Completed = $false
53 | }
54 | else {
55 | $ConfigObjectList = @()
56 | $PolicyExists = $False
57 | ForEach ($Policy in $Config["GetSupervisoryReviewPolicyV2"]) {
58 | $PolicyExists = $True
59 | $ConfigObject = [CAMPCheckConfig]::new()
60 | $ConfigObject.ConfigItem = "$($Policy.Name)"
61 | $ConfigObject.ConfigData = $($Policy.PolicyStatus)
62 | if ($($Policy.PolicyStatus) -ieq "Active") {
63 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
64 | }
65 | else {
66 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
67 |
68 | }
69 | $ConfigObjectList += $ConfigObject
70 | $this.AddConfig($ConfigObject)
71 |
72 | }
73 |
74 | If ($PolicyExists -eq $False) {
75 | $ConfigObject = [CAMPCheckConfig]::new()
76 |
77 | $ConfigObject.ConfigItem = "No Active Policy Defined"
78 | $ConfigObject.ConfigData = "No Active Policy Defined"
79 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
80 | $ConfigObjectList += $ConfigObject
81 | $this.AddConfig($ConfigObject)
82 | }
83 |
84 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
85 | if ($($hasremediation.count) -gt 0)
86 | {
87 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
88 | RemediationAvailable = $True
89 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
90 | }
91 | }
92 | $this.Completed = $True
93 | }
94 | }
95 |
96 | }
--------------------------------------------------------------------------------
/Checks/check-Audit101.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class Audit101 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | Audit101() {
10 |
11 | $this.Control = "Audit-101"
12 | $this.ParentArea = "Discovery & Response"
13 | $this.Area = "Audit"
14 | $this.Name = "Enable Auditing in Office 365"
15 | $this.PassText = "Your organisation has enabled auditing for your Office 365 tenant"
16 | $this.FailRecommendation = "Your organization should enable auditing for your Office 365 tenant"
17 | $this.Importance = "Your organization should enable auditing for your Office 365 tenant. When audit log search in the Security & Compliance Center is turned on, user and admin activity from your organization is recorded in the audit log and retained for 90 days, and up to one year depending on the license assigned to users."
18 | $this.ExpandResults = $True
19 | $this.ItemName = "Configuration"
20 | $this.DataType = "Setting"
21 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
22 | {
23 | $this.Links = @{
24 | "How to search Audit Log" = "https://aka.ms/mcca-aa-docs-action-audit-log"
25 | "Advanced Audit" = "https://aka.ms/mcca-aa-docs-learn-more-audit"
26 | "Compliance Center - Audit Log search" = "https://aka.ms/mcca-gcch-aa-compliance-center"
27 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-gcch-aa-compliance-manager"
28 | }
29 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
30 | {
31 | $this.Links = @{
32 | "How to search Audit Log" = "https://aka.ms/mcca-aa-docs-action-audit-log"
33 | "Advanced Audit" = "https://aka.ms/mcca-aa-docs-learn-more-audit"
34 | "Compliance Center - Audit Log search" = "https://aka.ms/mcca-dod-aa-compliance-center"
35 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-dod-aa-compliance-manager"
36 | }
37 | }else
38 | {
39 | $this.Links = @{
40 | "How to search Audit Log" = "https://aka.ms/mcca-aa-docs-action-audit-log"
41 | "Advanced Audit" = "https://aka.ms/mcca-aa-docs-learn-more-audit"
42 | "Compliance Center - Audit Log search" = "https://aka.ms/mcca-aa-compliance-center"
43 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-aa-compliance-manager"
44 | }
45 | }
46 |
47 | }
48 |
49 | <#
50 |
51 | RESULTS
52 |
53 | #>
54 |
55 | GetResults($Config) {
56 | if ($Config["GetAdminAuditLogConfig"] -eq "Error") {
57 | $this.Completed = $false
58 | }
59 | else {
60 | $ConfigObjectList = @()
61 | $Auditconfiguration = $Config["GetAdminAuditLogConfig"]
62 | $ConfigObject = [CAMPCheckConfig]::new()
63 | $ConfigObject.Object = "Configuration"
64 | $ConfigObject.ConfigItem = "Auditing in Office 365"
65 |
66 | # Determine if UnifiedAuditLogIngestionEnabled is true in Audit Configuration
67 | If ($($Auditconfiguration.UnifiedAuditLogIngestionEnabled) -eq $true) {
68 | $ConfigObject.ConfigData = "Enabled"
69 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
70 | }
71 | Else {
72 | $ConfigObject.ConfigData = "Disabled"
73 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
74 | $ConfigObject.RemediationAction = "Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled " + "$" + "true"
75 | Write-Host "$(Get-Date) Generating Remediation Action to enable Auditing" -ForegroundColor Yellow
76 |
77 | }
78 |
79 | $this.AddConfig($ConfigObject)
80 | $ConfigObjectList += $ConfigObject
81 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
82 | if ($($hasremediation.count) -gt 0)
83 | {
84 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
85 | RemediationAvailable = $True
86 | RemediationText = "You need to connect to Exchange Online Center PowerShell to execute the below commands. Please follow steps defined in Connect to Exchange Online Center PowerShell."
87 | }
88 | }
89 | $this.Completed = $True
90 | }
91 |
92 | }
93 |
94 | }
--------------------------------------------------------------------------------
/Checks/check-eDiscovery102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class eDiscovery102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | eDiscovery102() {
10 | $this.Control = "eDiscovery-102"
11 | $this.ParentArea = "Discovery & Response"
12 | $this.Area = "eDiscovery"
13 | $this.Name = "Use Advanced eDiscovery Cases to Support Legal Investigations"
14 | $this.PassText = "Your organization is using Advanced eDiscovery cases to support legal investigations"
15 | $this.FailRecommendation = "Your organization needs to review (or set up) Advanced eDiscovery cases"
16 | $this.Importance = "Your organization should use Advanced eDiscovery to manage the end-to-end workflow to preserve, collect, review, analyze, and export content that's responsive to your organization's internal and external investigations."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Case Name"
19 | $this.DataType = "Case Status"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Get started with Advanced eDiscovery" = "https://aka.ms/mcca-aed-docs-action"
24 | "Compliance Center - Advanced eDiscovery" = "https://aka.ms/mcca-gcch-aed-compliance-center"
25 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
26 | "Compliance Manager - eDiscovery" = "https://aka.ms/mcca-gcch-aed-compliance-manager"
27 | }
28 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
29 | {
30 | $this.Links = @{
31 | "Get started with Advanced eDiscovery" = "https://aka.ms/mcca-aed-docs-action"
32 | "Compliance Center - Advanced eDiscovery" = "https://aka.ms/mcca-dod-aed-compliance-center"
33 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
34 | "Compliance Manager - eDiscovery" = "https://aka.ms/mcca-dod-aed-compliance-manager"
35 | }
36 | }else
37 | {
38 | $this.Links = @{
39 | "Get started with Advanced eDiscovery" = "https://aka.ms/mcca-aed-docs-action"
40 | "Compliance Center - Advanced eDiscovery" = "https://aka.ms/mcca-aed-compliance-center"
41 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
42 | }
43 | }
44 | }
45 |
46 | <#
47 |
48 | RESULTS
49 |
50 | #>
51 |
52 | GetResults($Config) {
53 | if ($Config["GetComplianceCase"] -eq "Error") {
54 | $this.Completed = $false
55 | }
56 | else {
57 | $ConfigObjectList = @()
58 |
59 | $CasesPresent= $false
60 | $activecasepresent = $false
61 | ForEach ($CasesDefined in $Config["GetComplianceCase"]|Where-Object{$_.CaseType -eq "AdvancedEdiscovery"}) {
62 | $Cases = $CasesDefined
63 | $CasesPresent= $true
64 |
65 | if($($Cases.Status) -eq "Active")
66 | {
67 | $ConfigObject = [CAMPCheckConfig]::new()
68 | $ConfigObject.ConfigItem = "$($Cases.Name)"
69 | $ConfigObject.ConfigData = "$($Cases.Status)"
70 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
71 | $this.AddConfig($ConfigObject)
72 | $ConfigObjectList += $ConfigObject
73 | $activecasepresent= $true
74 | }
75 | $CasesPresent= $true
76 | }
77 | if(($activecasepresent -eq $false) -and ($CasesPresent -eq $true))
78 | {
79 | $ConfigObject = [CAMPCheckConfig]::new()
80 | $ConfigObject.ConfigItem = "No active case"
81 | $ConfigObject.ConfigData = ""
82 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
83 | $this.AddConfig($ConfigObject)
84 | $ConfigObjectList += $ConfigObject
85 | }
86 | elseif($CasesPresent -eq $false)
87 | {
88 | $ConfigObject = [CAMPCheckConfig]::new()
89 | $ConfigObject.ConfigItem = "No eDiscovery cases found"
90 | $ConfigObject.ConfigData = ""
91 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
92 | $this.AddConfig($ConfigObject)
93 | $ConfigObjectList += $ConfigObject
94 | }
95 |
96 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
97 | if ($($hasremediation.count) -gt 0)
98 | {
99 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
100 | RemediationAvailable = $True
101 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
102 | }
103 | }
104 | $this.Completed = $True
105 | }
106 | }}
107 |
--------------------------------------------------------------------------------
/Checks/check-CC103.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class CC103 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | CC103() {
10 | $this.Control = "CC-103"
11 | $this.ParentArea = "Insider Risk"
12 | $this.Area = "Communication Compliance"
13 | $this.Name = "Remediate Corporate Policy Violation"
14 | $this.PassText = "Your organization currently has no corporate policy violations"
15 | $this.FailRecommendation = "Your organization needs to remediate corporate policy violations"
16 | $this.Importance = "Your organization should use communication compliance to scan internal and external communications for policy matches so they can be examined by designated reviewers. Reviewers can investigate scanned communications and take appropriate remediation actions."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Communication Compliance Remediation"
19 | $this.DataType = "Items pending Review"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
24 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-gcch-cc-compliance-center"
25 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-gcch-cc-compliance-manager"
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
31 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-dod-cc-compliance-center"
32 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-dod-cc-compliance-manager"
33 | }
34 | }else
35 | {
36 | $this.Links = @{
37 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
38 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-cc-compliance-center"
39 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-cc-compliance-manager"
40 |
41 | }
42 | }
43 | }
44 |
45 | <#
46 |
47 | RESULTS CC Admin, CC Analyst, CC Investigator and CC Viewer
48 | #>
49 |
50 | GetResults($Config) {
51 | if (($Config["GetSupervisoryReviewOverallProgressReport"] -eq "Error") -or ($Config["GetSupervisoryReviewPolicyV2"] -eq "Error")) {
52 | $this.Completed = $false
53 | }
54 | else {
55 | $ConfigObjectList = @()
56 | $SupervisoryReviewOverallProgressReport = $Config["GetSupervisoryReviewOverallProgressReport"]
57 | if ( $null -eq $SupervisoryReviewOverallProgressReport) {
58 | $ConfigObject = [CAMPCheckConfig]::new()
59 | $ConfigObject.ConfigItem = "Communication Compliance Policy Matches"
60 |
61 | $supervisory = $Config["GetSupervisoryReviewPolicyV2"]
62 |
63 | if ($($supervisory.count) -eq 0) {
64 | $ConfigObject.ConfigData = "No communication Policy defined"
65 | }
66 | else {
67 | $ConfigObject.ConfigData = "User does not have access to policy review"
68 | }
69 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
70 | $ConfigObjectList += $ConfigObject
71 | $this.AddConfig($ConfigObject)
72 |
73 | }
74 | elseif ($($SupervisoryReviewOverallProgressReport.Pending) -eq 0) {
75 | $ConfigObject = [CAMPCheckConfig]::new()
76 | $ConfigObject.ConfigItem = "Communication Compliance Policy Matches"
77 | $ConfigObject.ConfigData = "None"
78 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
79 | $ConfigObjectList += $ConfigObject
80 | $this.AddConfig($ConfigObject)
81 |
82 | }
83 |
84 | else {
85 | $ConfigObject = [CAMPCheckConfig]::new()
86 | $ConfigObject.ConfigItem = "Communication Compliance Policy Matches"
87 | $ConfigObject.ConfigData = "$($SupervisoryReviewOverallProgressReport.Pending)"
88 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
89 | $ConfigObjectList += $ConfigObject
90 | $this.AddConfig($ConfigObject)
91 |
92 | }
93 |
94 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
95 | if ($($hasremediation.count) -gt 0)
96 | {
97 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
98 | RemediationAvailable = $True
99 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
100 | }
101 | }
102 | $this.Completed = $True
103 | }
104 | }
105 |
106 | }
--------------------------------------------------------------------------------
/Checks/check-eDiscovery101.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class eDiscovery101 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | eDiscovery101() {
10 | $this.Control = "eDiscovery-101"
11 | $this.ParentArea = "Discovery & Response"
12 | $this.Area = "eDiscovery"
13 | $this.Name = "Use Core eDiscovery Cases to Support Legal Investigations"
14 | $this.PassText = "Your organization is using Core eDiscovery cases to support legal investigations"
15 | $this.FailRecommendation = "Your organization needs to review (or set up) Core eDiscovery cases"
16 | $this.Importance = "Your organization should use Core eDiscovery cases to identify, hold, and export content found in Exchange Online mailboxes, Microsoft 365 Groups, Microsoft Teams, SharePoint Online and OneDrive for Business sites, and Skype for Business conversations, and Yammer teams."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Case Name"
19 | $this.DataType = "Case Status"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Get started with Core eDiscovery" = "https://aka.ms/mcca-ced-docs-action"
24 | "Compliance Center - Core eDiscovery" = "https://aka.ms/mcca-gcch-ced-compliance-center"
25 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
26 | "Compliance Manager - eDiscovery" = "https://aka.ms/mcca-gcch-aed-compliance-manager"
27 | }
28 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
29 | {
30 | $this.Links = @{
31 | "Get started with Core eDiscovery" = "https://aka.ms/mcca-ced-docs-action"
32 | "Compliance Center - Core eDiscovery" = "https://aka.ms/mcca-dod-ced-compliance-center"
33 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
34 | "Compliance Manager - eDiscovery" = "https://aka.ms/mcca-dod-aed-compliance-manager"
35 | }
36 | }else
37 | {
38 | $this.Links = @{
39 | "Get started with Core eDiscovery" = "https://aka.ms/mcca-ced-docs-action"
40 | "Compliance Center - Core eDiscovery" = "https://aka.ms/mcca-ced-compliance-center"
41 | "eDiscovery in Microsoft 365" = "https://aka.ms/mcca-aed-docs-learn-more"
42 | }
43 | }
44 | }
45 |
46 | <#
47 |
48 | RESULTS
49 |
50 | #>
51 |
52 | GetResults($Config) {
53 | if ($Config["GetComplianceCaseCore"] -eq "Error") {
54 | $this.Completed = $false
55 | }
56 | else {
57 | $ConfigObjectList = @()
58 |
59 | $CasesPresent= $false
60 | $activecasepresent = $false
61 | ForEach ($CasesDefined in $Config["GetComplianceCaseCore"]) {
62 | $Cases = $CasesDefined
63 | $CasesPresent= $true
64 |
65 | if($($Cases.Status) -eq "Active")
66 | {
67 | $ConfigObject = [CAMPCheckConfig]::new()
68 | $ConfigObject.ConfigItem = "$($Cases.Name)"
69 | $ConfigObject.ConfigData = "$($Cases.Status)"
70 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
71 | $this.AddConfig($ConfigObject)
72 | $ConfigObjectList += $ConfigObject
73 | $activecasepresent= $true
74 | }
75 | $CasesPresent= $true
76 | }
77 | if(($activecasepresent -eq $false) -and ($CasesPresent -eq $true))
78 | {
79 | $ConfigObject = [CAMPCheckConfig]::new()
80 | $ConfigObject.ConfigItem = "No active case"
81 | $ConfigObject.ConfigData = ""
82 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
83 | $this.AddConfig($ConfigObject)
84 | $ConfigObjectList += $ConfigObject
85 | }
86 | elseif($CasesPresent -eq $false)
87 | {
88 | $ConfigObject = [CAMPCheckConfig]::new()
89 | $ConfigObject.ConfigItem = "No eDiscovery cases found"
90 | $ConfigObject.ConfigData = ""
91 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
92 | $this.AddConfig($ConfigObject)
93 | $ConfigObjectList += $ConfigObject
94 | }
95 |
96 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
97 | if ($($hasremediation.count) -gt 0)
98 | {
99 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
100 | RemediationAvailable = $True
101 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
102 | }
103 | }
104 | $this.Completed = $True
105 | }
106 | }
107 |
108 | }
109 |
--------------------------------------------------------------------------------
/Checks/check-Audit102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class Audit102 : CAMPCheck {
4 | <#
5 | this is to valide if tenant has high serverity alert policies or not
6 |
7 | #>
8 |
9 | Audit102() {
10 | $this.Control = "Audit-102"
11 | $this.ParentArea = "Discovery & Response"
12 | $this.Area = "Audit"
13 | $this.Name = "Configure Alert Policies"
14 | $this.PassText = "Your organization has configured alert policies"
15 | $this.FailRecommendation = "Your organization should configure alert policies"
16 | $this.Importance = "Your organization should configure alert policies to send notifications on activities that are indicators of a potential security issue or data breach. Office 365 provides built-in alert policies that are turned on by default."
17 | $this.CheckType = [CheckType]::ObjectPropertyValue
18 | $this.ExpandResults = $True
19 | $this.ObjectType = "Alert Policy"
20 | $this.ItemName = "Severity"
21 | $this.DataType = "Email notifications"
22 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
23 | {
24 | $this.Links = @{
25 | "Turn on audit log search" = "https://aka.ms/mcca-aa-docs-action-turn-on"
26 | "Security & Compliance Console : Alert Policies" = "https://aka.ms/mcca-gcch-aa-2-compliance-center"
27 | "Learn more about alert policies" = "https://aka.ms/mcca-aa-docs-learn-more"
28 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-gcch-aa-compliance-manager"
29 | }
30 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
31 | {
32 | $this.Links = @{
33 | "Turn on audit log search" = "https://aka.ms/mcca-aa-docs-action-turn-on"
34 | "Security & Compliance Console : Alert Policies" = "https://aka.ms/mcca-dod-aa-2-compliance-center"
35 | "Learn more about alert policies" = "https://aka.ms/mcca-aa-docs-learn-more"
36 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-dod-aa-compliance-manager"
37 | }
38 | }else
39 | {
40 | $this.Links = @{
41 | "Turn on audit log search" = "https://aka.ms/mcca-aa-docs-action-turn-on"
42 | "Security & Compliance Console : Alert Policies" = "https://aka.ms/mcca-aa-2-compliance-center"
43 | "Learn more about alert policies" = "https://aka.ms/mcca-aa-docs-learn-more"
44 | "Compliance Manager - Audit Actions" = "https://aka.ms/mcca-aa-compliance-manager"
45 | }
46 | }
47 | }
48 |
49 | <#
50 |
51 | RESULTS
52 |
53 | #>
54 |
55 | GetResults($Config) {
56 | if ($Config["GetProtectionAlert"] -eq "Error") {
57 | $this.Completed = $false
58 | }
59 | else {
60 | $ConfigObjectList = @()
61 | $PoliciesExist = $false
62 | ForEach ($AlertPolicy in $Config["GetProtectionAlert"]) {
63 |
64 | $ConfigObject = [CAMPCheckConfig]::new()
65 | $ConfigObject.Object = "$($AlertPolicy.Name)"
66 | $ConfigObject.ConfigItem = "$($AlertPolicy.Severity)"
67 | if($($AlertPolicy.Disabled) -eq $false)
68 | {
69 | $PoliciesExist = $True
70 | if($($AlertPolicy.NotificationEnabled) -eq $True)
71 | {
72 | $ConfigObject.ConfigData = $($AlertPolicy.NotifyUser)
73 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
74 | $this.AddConfig($ConfigObject)
75 |
76 | }else{
77 | $ConfigObject.ConfigData = "Email notifications not enabled"
78 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
79 | $this.AddConfig($ConfigObject)
80 |
81 | }
82 |
83 | }else{
84 | $ConfigObject.ConfigData = "Alert policy not enabled"
85 | $ConfigObject.SetResult([CAMPConfigLevel]::Informational, "Pass")
86 | $this.AddConfig($ConfigObject)
87 |
88 |
89 | }
90 | }
91 | If ($PoliciesExist -eq $False) {
92 | $ConfigObject = [CAMPCheckConfig]::new()
93 | $ConfigObject.Object = "No active high severity policies were found"
94 | $ConfigObject.ConfigItem = "No active high severity policies"
95 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
96 | $ConfigObjectList += $ConfigObject
97 | $this.AddConfig($ConfigObject)
98 | }
99 |
100 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
101 | if ($($hasremediation.count) -gt 0)
102 | {
103 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
104 | RemediationAvailable = $True
105 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
106 | }
107 | }
108 | $this.Completed = $True
109 | }
110 |
111 | }
112 |
113 | }
--------------------------------------------------------------------------------
/Checks/check-IP102.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class IP102 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | IP102() {
10 | $this.Control = "IP-102"
11 | $this.ParentArea = "Microsoft Information Protection"
12 | $this.Area = "Information Protection"
13 | $this.Name = "Auto-apply client side sensitivity labels"
14 | $this.PassText = "Your organization is using auto-apply client side sensitivity labels"
15 | $this.FailRecommendation = "Your organization should use client side sensitivity labels"
16 | $this.Importance = "Your organization should automatically apply client side sensitivity labels based on sensitive information types or other criteria. Microsoft recommends that automatic labeling be implemented to decrease reliance on users for correct classification."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Labels"
19 | $this.DataType = "Remarks"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Overview of sensitivity labels " = "https://aka.ms/mcca-ip-docs-sensitivity-labels"
24 | "How to apply a sensitivity label to content automatically" = "https://aka.ms/mcca-ip-docs-action-apply-sensitivity-labels"
25 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-gcch-ip-compliance-center"
26 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-gcch-ip-compliance-manager"
27 | }
28 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
29 | {
30 | $this.Links = @{
31 | "Overview of sensitivity labels " = "https://aka.ms/mcca-ip-docs-sensitivity-labels"
32 | "How to apply a sensitivity label to content automatically" = "https://aka.ms/mcca-ip-docs-action-apply-sensitivity-labels"
33 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-dod-ip-compliance-center"
34 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-dod-ip-compliance-manager"
35 | }
36 | }else
37 | {
38 | $this.Links = @{
39 | "Overview of sensitivity labels " = "https://aka.ms/mcca-ip-docs-sensitivity-labels"
40 | "How to apply a sensitivity label to content automatically" = "https://aka.ms/mcca-ip-docs-action-apply-sensitivity-labels"
41 | "Compliance Center - Information Protection" = "https://aka.ms/mcca-ip-compliance-center"
42 | "Compliance Manager - IP Actions" = "https://aka.ms/mcca-ip-compliance-manager"
43 | }
44 | }
45 | }
46 |
47 | <#
48 |
49 | RESULTS
50 |
51 | #>
52 |
53 | GetResults($Config) {
54 | if ($Config["GetLabel"] -eq "Error") {
55 | $this.Completed = $false
56 | }
57 | else {
58 | $ConfigObjectList = @()
59 | $AutoApplyExist = $false
60 |
61 | ForEach ($LabelsDefined in $Config["GetLabel"]) {
62 | $Labels = $LabelsDefined
63 |
64 | if ($($Labels.Conditions)) {
65 | if ($($Labels.Disabled) -eq $false) {
66 | $Workload = $Labels.Workload
67 |
68 | if ((((@($Workload) -like 'Exchange').Count -lt 1)) -and (((@($Workload) -like 'SharePoint').Count -lt 1))) {
69 | $ConfigObject = [CAMPCheckConfig]::new()
70 | $ConfigObject.ConfigItem = "$($Labels.DisplayName)"
71 | $ConfigObject.ConfigData = "Enabled Workloads: Office Apps"
72 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Pass")
73 | $ConfigObjectList += $ConfigObject
74 | $AutoApplyExist = $true
75 | $this.AddConfig($ConfigObject)
76 |
77 |
78 | }
79 | else {
80 | $ConfigObject = [CAMPCheckConfig]::new()
81 | $ConfigObject.ConfigItem = "$($Labels.DisplayName)"
82 | $ConfigObject.ConfigData = "Only Enabled Workload: $($Labels.Workload)"
83 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
84 | $ConfigObjectList += $ConfigObject
85 | $this.AddConfig($ConfigObject)
86 |
87 | }
88 | }
89 | else {
90 | $ConfigObject = [CAMPCheckConfig]::new()
91 | $ConfigObject.ConfigItem = "$($Labels.DisplayName)"
92 | $ConfigObject.ConfigData = "Label is not enabled"
93 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
94 | $ConfigObjectList += $ConfigObject
95 | $this.AddConfig($ConfigObject)
96 |
97 | }
98 |
99 | }
100 |
101 | }
102 |
103 |
104 | If ($AutoApplyExist -eq $False) {
105 | $ConfigObject = [CAMPCheckConfig]::new()
106 | $ConfigObject.Object = "No Active Policy defined"
107 | $ConfigObject.ConfigItem = "No Auto Apply Policy"
108 | $ConfigObject.SetResult([CAMPConfigLevel]::Ok, "Fail")
109 | $ConfigObjectList += $ConfigObject
110 | $this.AddConfig($ConfigObject)
111 | }
112 |
113 |
114 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne ''}
115 | if ($($hasremediation.count) -gt 0)
116 | {
117 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
118 | RemediationAvailable = $True
119 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
120 | }
121 | }
122 | $this.Completed = $True
123 | }
124 | }
125 |
126 | }
--------------------------------------------------------------------------------
/Checks/check-CC101.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class CC101 : CAMPCheck {
4 | <#
5 |
6 |
7 | #>
8 |
9 | CC101() {
10 | $this.Control = "CC-101"
11 | $this.ParentArea = "Insider Risk"
12 | $this.Area = "Communication Compliance"
13 | $this.Name = "Enable Communication Compliance in O365"
14 | $this.PassText = "Your organization has enabled Communication Compliance in O365"
15 | $this.FailRecommendation = "Your organization should enable Communication Compliance in O365"
16 | $this.Importance = "Your organization should use communication compliance to scan internal and external communications for policy matches so they can be examined by designated reviewers."
17 | $this.ExpandResults = $True
18 | $this.ItemName = "Role"
19 | $this.DataType = "Role Groups ( Having 1 or more members)"
20 | if($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovGCCHigh")
21 | {
22 | $this.Links = @{
23 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
24 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-gcch-cc-compliance-center"
25 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-gcch-cc-compliance-manager"
26 | }
27 | }elseif ($this.ExchangeEnvironmentNameForCheck -ieq "O365USGovDoD")
28 | {
29 | $this.Links = @{
30 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
31 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-dod-cc-compliance-center"
32 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-dod-cc-compliance-manager"
33 | }
34 | }else
35 | {
36 | $this.Links = @{
37 | "Communication compliance in Microsoft 365" = "https://aka.ms/mcca-cc-docs-learn-more"
38 | "Compliance Center - Communication Compliance" = "https://aka.ms/mcca-cc-compliance-center"
39 | "Compliance Manager - CC Actions" = "https://aka.ms/mcca-cc-compliance-manager"
40 | }
41 | }
42 | }
43 |
44 | <#
45 |
46 | RESULTS CC Admin, CC Analyst, CC Investigator and CC Viewer
47 | #>
48 |
49 | GetResults($Config) {
50 |
51 | try {
52 | $SreviewAdminRoleGroups = Get-RoleGroup -ErrorAction:SilentlyContinue | Where-Object { $_.Roles -Like "*Supervisory Review Administrator*" -and $null -ne $_.Members }
53 | $CaseManagementRoleGroups = Get-RoleGroup -ErrorAction:SilentlyContinue | Where-Object { $_.Roles -Like "*Case Management*" -and $null -ne $_.Members }
54 | $ComplianceAdministratorRoleGroups = Get-RoleGroup -ErrorAction:SilentlyContinue | Where-Object { $_.Roles -Like "*Compliance Administrator*" -and $null -ne $_.Members }
55 |
56 | }
57 | catch {
58 | $SreviewAdminRoleGroups = "Error"
59 | $CaseManagementRoleGroups = "Error"
60 | $ComplianceAdministratorRoleGroups = "Error"
61 | }
62 | if (($SreviewAdminRoleGroups -eq "Error") -or ($CaseManagementRoleGroups -eq "Error") -or ($ComplianceAdministratorRoleGroups -eq "Error")) {
63 | $this.Completed = $false
64 | }
65 | else {
66 | $UtilityFiles = Get-ChildItem "$PSScriptRoot\..\Utilities"
67 |
68 | ForEach ($UtilityFile in $UtilityFiles) {
69 | . $UtilityFile.FullName
70 | }
71 | $LogFile = $this.LogFile
72 |
73 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $SreviewAdminRoleGroups -Role "Supervisory Review Administrator" -LogFile $LogFile
74 | Foreach ($ConfigObject in $ConfigObjectList) {
75 | $this.AddConfig($ConfigObject)
76 | }
77 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $CaseManagementRoleGroups -Role "Case Management" -LogFile $LogFile
78 | Foreach ($ConfigObject in $ConfigObjectList) {
79 | $this.AddConfig($ConfigObject)
80 | }
81 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $ComplianceAdministratorRoleGroups -Role "Compliance Administrator" -LogFile $LogFile
82 | Foreach ($ConfigObject in $ConfigObjectList) {
83 | $this.AddConfig($ConfigObject)
84 | }
85 | # New roles post CC july release
86 | #$CCAdminRoleGroups = Get-RoleGroup | Where-Object {$_.Roles -Like "*Communication Compliance Admin*" -and $_.Members -ne $null}
87 | #$CCAnalystRoleGroups = Get-RoleGroup | Where-Object {$_.Roles -Like "*Communication Compliance Analyst*" -and $_.Members -ne $null}
88 | #$CCInvesRoleGroups = Get-RoleGroup | Where-Object {$_.Roles -Like "*Communication Compliance Investigator*" -and $_.Members -ne $null}
89 | #$CCViewRoleGroups = Get-RoleGroup | Where-Object {$_.Roles -Like "*Communication Compliance Viewer*" -and $_.Members -ne $null}
90 |
91 | <#
92 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $CCAdminRoleGroups -Role "Communication Compliance Admin"
93 | Foreach ($ConfigObject in $ConfigObjectList)
94 | {
95 | $this.AddConfig($ConfigObject)
96 | }
97 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $CCAnalystRoleGroups -Role "Communication Compliance Analyst"
98 | Foreach ($ConfigObject in $ConfigObjectList)
99 | {
100 | $this.AddConfig($ConfigObject)
101 | }
102 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $CCInvesRoleGroups -Role "Communication Compliance Investigator"
103 | Foreach ($ConfigObject in $ConfigObjectList)
104 | {
105 | $this.AddConfig($ConfigObject)
106 | }
107 | $ConfigObjectList = Get-RoleGroupwithMembers -RoleGroups $CCViewRoleGroups -Role "Communication Compliance Viewer"
108 | Foreach ($ConfigObject in $ConfigObjectList)
109 | {
110 | $this.AddConfig($ConfigObject)
111 | }#>
112 |
113 | $hasRemediation = $this.Config | Where-Object { $_.RemediationAction -ne '' }
114 | if ($($hasremediation.count) -gt 0) {
115 | $this.CAMPRemediationInfo = New-Object -TypeName CAMPRemediationInfo -Property @{
116 | RemediationAvailable = $True
117 | RemediationText = "You need to connect to Security & Compliance Center PowerShell to execute the below commands. Please follow steps defined in Connect to Security & Compliance Center PowerShell."
118 | }
119 | }
120 | $this.Completed = $True
121 | }
122 |
123 | }
124 |
125 | }
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.rsuser
8 | *.suo
9 | *.user
10 | *.userosscache
11 | *.sln.docstates
12 |
13 | # User-specific files (MonoDevelop/Xamarin Studio)
14 | *.userprefs
15 |
16 | # Mono auto generated files
17 | mono_crash.*
18 |
19 | # Build results
20 | [Dd]ebug/
21 | [Dd]ebugPublic/
22 | [Rr]elease/
23 | [Rr]eleases/
24 | x64/
25 | x86/
26 | [Aa][Rr][Mm]/
27 | [Aa][Rr][Mm]64/
28 | bld/
29 | [Bb]in/
30 | [Oo]bj/
31 | [Ll]og/
32 | [Ll]ogs/
33 |
34 | # Visual Studio 2015/2017 cache/options directory
35 | .vs/
36 | # Uncomment if you have tasks that create the project's static files in wwwroot
37 | #wwwroot/
38 |
39 | # Visual Studio 2017 auto generated files
40 | Generated\ Files/
41 |
42 | # MSTest test Results
43 | [Tt]est[Rr]esult*/
44 | [Bb]uild[Ll]og.*
45 |
46 | # NUnit
47 | *.VisualState.xml
48 | TestResult.xml
49 | nunit-*.xml
50 |
51 | # Build Results of an ATL Project
52 | [Dd]ebugPS/
53 | [Rr]eleasePS/
54 | dlldata.c
55 |
56 | # Benchmark Results
57 | BenchmarkDotNet.Artifacts/
58 |
59 | # .NET Core
60 | project.lock.json
61 | project.fragment.lock.json
62 | artifacts/
63 |
64 | # StyleCop
65 | StyleCopReport.xml
66 |
67 | # Files built by Visual Studio
68 | *_i.c
69 | *_p.c
70 | *_h.h
71 | *.ilk
72 | *.meta
73 | *.obj
74 | *.iobj
75 | *.pch
76 | *.pdb
77 | *.ipdb
78 | *.pgc
79 | *.pgd
80 | *.rsp
81 | *.sbr
82 | *.tlb
83 | *.tli
84 | *.tlh
85 | *.tmp
86 | *.tmp_proj
87 | *_wpftmp.csproj
88 | *.log
89 | *.vspscc
90 | *.vssscc
91 | .builds
92 | *.pidb
93 | *.svclog
94 | *.scc
95 |
96 | # Chutzpah Test files
97 | _Chutzpah*
98 |
99 | # Visual C++ cache files
100 | ipch/
101 | *.aps
102 | *.ncb
103 | *.opendb
104 | *.opensdf
105 | *.sdf
106 | *.cachefile
107 | *.VC.db
108 | *.VC.VC.opendb
109 |
110 | # Visual Studio profiler
111 | *.psess
112 | *.vsp
113 | *.vspx
114 | *.sap
115 |
116 | # Visual Studio Trace Files
117 | *.e2e
118 |
119 | # TFS 2012 Local Workspace
120 | $tf/
121 |
122 | # Guidance Automation Toolkit
123 | *.gpState
124 |
125 | # ReSharper is a .NET coding add-in
126 | _ReSharper*/
127 | *.[Rr]e[Ss]harper
128 | *.DotSettings.user
129 |
130 | # TeamCity is a build add-in
131 | _TeamCity*
132 |
133 | # DotCover is a Code Coverage Tool
134 | *.dotCover
135 |
136 | # AxoCover is a Code Coverage Tool
137 | .axoCover/*
138 | !.axoCover/settings.json
139 |
140 | # Visual Studio code coverage results
141 | *.coverage
142 | *.coveragexml
143 |
144 | # NCrunch
145 | _NCrunch_*
146 | .*crunch*.local.xml
147 | nCrunchTemp_*
148 |
149 | # MightyMoose
150 | *.mm.*
151 | AutoTest.Net/
152 |
153 | # Web workbench (sass)
154 | .sass-cache/
155 |
156 | # Installshield output folder
157 | [Ee]xpress/
158 |
159 | # DocProject is a documentation generator add-in
160 | DocProject/buildhelp/
161 | DocProject/Help/*.HxT
162 | DocProject/Help/*.HxC
163 | DocProject/Help/*.hhc
164 | DocProject/Help/*.hhk
165 | DocProject/Help/*.hhp
166 | DocProject/Help/Html2
167 | DocProject/Help/html
168 |
169 | # Click-Once directory
170 | publish/
171 |
172 | # Publish Web Output
173 | *.[Pp]ublish.xml
174 | *.azurePubxml
175 | # Note: Comment the next line if you want to checkin your web deploy settings,
176 | # but database connection strings (with potential passwords) will be unencrypted
177 | *.pubxml
178 | *.publishproj
179 |
180 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
181 | # checkin your Azure Web App publish settings, but sensitive information contained
182 | # in these scripts will be unencrypted
183 | PublishScripts/
184 |
185 | # NuGet Packages
186 | *.nupkg
187 | # NuGet Symbol Packages
188 | *.snupkg
189 | # The packages folder can be ignored because of Package Restore
190 | **/[Pp]ackages/*
191 | # except build/, which is used as an MSBuild target.
192 | !**/[Pp]ackages/build/
193 | # Uncomment if necessary however generally it will be regenerated when needed
194 | #!**/[Pp]ackages/repositories.config
195 | # NuGet v3's project.json files produces more ignorable files
196 | *.nuget.props
197 | *.nuget.targets
198 |
199 | # Microsoft Azure Build Output
200 | csx/
201 | *.build.csdef
202 |
203 | # Microsoft Azure Emulator
204 | ecf/
205 | rcf/
206 |
207 | # Windows Store app package directories and files
208 | AppPackages/
209 | BundleArtifacts/
210 | Package.StoreAssociation.xml
211 | _pkginfo.txt
212 | *.appx
213 | *.appxbundle
214 | *.appxupload
215 |
216 | # Visual Studio cache files
217 | # files ending in .cache can be ignored
218 | *.[Cc]ache
219 | # but keep track of directories ending in .cache
220 | !?*.[Cc]ache/
221 |
222 | # Others
223 | ClientBin/
224 | ~$*
225 | *~
226 | *.dbmdl
227 | *.dbproj.schemaview
228 | *.jfm
229 | *.pfx
230 | *.publishsettings
231 | orleans.codegen.cs
232 |
233 | # Including strong name files can present a security risk
234 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
235 | #*.snk
236 |
237 | # Since there are multiple workflows, uncomment next line to ignore bower_components
238 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
239 | #bower_components/
240 |
241 | # RIA/Silverlight projects
242 | Generated_Code/
243 |
244 | # Backup & report files from converting an old project file
245 | # to a newer Visual Studio version. Backup files are not needed,
246 | # because we have git ;-)
247 | _UpgradeReport_Files/
248 | Backup*/
249 | UpgradeLog*.XML
250 | UpgradeLog*.htm
251 | ServiceFabricBackup/
252 | *.rptproj.bak
253 |
254 | # SQL Server files
255 | *.mdf
256 | *.ldf
257 | *.ndf
258 |
259 | # Business Intelligence projects
260 | *.rdl.data
261 | *.bim.layout
262 | *.bim_*.settings
263 | *.rptproj.rsuser
264 | *- [Bb]ackup.rdl
265 | *- [Bb]ackup ([0-9]).rdl
266 | *- [Bb]ackup ([0-9][0-9]).rdl
267 |
268 | # Microsoft Fakes
269 | FakesAssemblies/
270 |
271 | # GhostDoc plugin setting file
272 | *.GhostDoc.xml
273 |
274 | # Node.js Tools for Visual Studio
275 | .ntvs_analysis.dat
276 | node_modules/
277 |
278 | # Visual Studio 6 build log
279 | *.plg
280 |
281 | # Visual Studio 6 workspace options file
282 | *.opt
283 |
284 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
285 | *.vbw
286 |
287 | # Visual Studio LightSwitch build output
288 | **/*.HTMLClient/GeneratedArtifacts
289 | **/*.DesktopClient/GeneratedArtifacts
290 | **/*.DesktopClient/ModelManifest.xml
291 | **/*.Server/GeneratedArtifacts
292 | **/*.Server/ModelManifest.xml
293 | _Pvt_Extensions
294 |
295 | # Paket dependency manager
296 | .paket/paket.exe
297 | paket-files/
298 |
299 | # FAKE - F# Make
300 | .fake/
301 |
302 | # CodeRush personal settings
303 | .cr/personal
304 |
305 | # Python Tools for Visual Studio (PTVS)
306 | __pycache__/
307 | *.pyc
308 |
309 | # Cake - Uncomment if you are using it
310 | # tools/**
311 | # !tools/packages.config
312 |
313 | # Tabs Studio
314 | *.tss
315 |
316 | # Telerik's JustMock configuration file
317 | *.jmconfig
318 |
319 | # BizTalk build output
320 | *.btp.cs
321 | *.btm.cs
322 | *.odx.cs
323 | *.xsd.cs
324 |
325 | # OpenCover UI analysis results
326 | OpenCover/
327 |
328 | # Azure Stream Analytics local run output
329 | ASALocalRun/
330 |
331 | # MSBuild Binary and Structured Log
332 | *.binlog
333 |
334 | # NVidia Nsight GPU debugger configuration file
335 | *.nvuser
336 |
337 | # MFractors (Xamarin productivity tool) working folder
338 | .mfractor/
339 |
340 | # Local History for Visual Studio
341 | .localhistory/
342 |
343 | # BeatPulse healthcheck temp database
344 | healthchecksdb
345 |
346 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
347 | MigrationBackup/
348 |
349 | # Ionide (cross platform F# VS Code tools) working folder
350 | .ionide/
351 |
--------------------------------------------------------------------------------
/Remediation/RemediationAction.ps1:
--------------------------------------------------------------------------------
1 | using module "..\CAMP.psm1"
2 |
3 | class Action : RemediationAction
4 | {
5 |
6 | $OutputDirectory=$null
7 | $DisplayReport=$True
8 |
9 | Action()
10 | {
11 | $this.Name="Action"
12 | }
13 |
14 | RunOutput($Checks,$Collection)
15 | {
16 | <#
17 |
18 | OUTPUT GENERATION / Header
19 |
20 | #>
21 |
22 | # Obtain the tenant domain and date for the report
23 | #$TenantDomain = ($Collection["AcceptedDomains"] | Where-Object {$_.InitialDomain -eq $True}).DomainName
24 |
25 | # Misc
26 | $ReportTitle = "Configuration Analyzer for Microsoft Purview Remediation Report"
27 |
28 |
29 |
30 |
31 | # Output start
32 | $output = "
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
90 | $($ReportTitle)
91 |
92 |
93 |
94 |
95 |
106 |
107 |
108 |
$($ReportTitle)
109 |
This report details recommended remediations based on your CAMP report.