├── .github └── FUNDING.yml ├── Blue_Team_App_O365_Azure.spl ├── LICENSE ├── README.md ├── blue-team-app-for-office-365-and-azure_147.tgz └── default ├── ReadMe.txt ├── app.conf ├── data └── ui │ ├── nav │ └── default.xml │ └── views │ ├── account_investigator_ai.xml │ ├── data_accessed_investigator.xml │ ├── email_forwarding.xml │ ├── email_forwarding_rules.xml │ ├── flow_rules.xml │ ├── forwarding_rule_investigator.xml │ ├── login_activity.xml │ ├── mail_rule_investigator_mri.xml │ ├── mail_rule_investigator_mri_clone.xml │ ├── oauth2_abuse.xml │ ├── oauth_abuse.xml │ ├── other_suspicious_activity.xml │ ├── permission_changes.xml │ └── power_automate_flows.xml ├── default ├── app.conf ├── data │ └── ui │ │ ├── nav │ │ └── default.xml │ │ └── views │ │ ├── account_investigator_ai.xml │ │ ├── data_accessed_investigator.xml │ │ ├── email_forwarding.xml │ │ ├── login_activity.xml │ │ ├── mail_rule_investigator_mri.xml │ │ ├── oauth2_abuse.xml │ │ ├── other_suspicious_activity.xml │ │ ├── permission_changes.xml │ │ └── power_automate_flows.xml ├── eventtypes.conf └── macros.conf ├── eventtypes.conf ├── macros.conf ├── metadata └── default.meta └── static ├── appIcon.png ├── appIconAlt.png ├── appIconAlt_2x.png ├── appIcon_2x.png ├── appLogo.png └── appLogo_2x.png /.github/FUNDING.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/.github/FUNDING.yml -------------------------------------------------------------------------------- /Blue_Team_App_O365_Azure.spl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/Blue_Team_App_O365_Azure.spl -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/README.md -------------------------------------------------------------------------------- /blue-team-app-for-office-365-and-azure_147.tgz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/blue-team-app-for-office-365-and-azure_147.tgz -------------------------------------------------------------------------------- /default/ReadMe.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/ReadMe.txt -------------------------------------------------------------------------------- /default/app.conf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/app.conf -------------------------------------------------------------------------------- /default/data/ui/nav/default.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/nav/default.xml -------------------------------------------------------------------------------- /default/data/ui/views/account_investigator_ai.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/account_investigator_ai.xml -------------------------------------------------------------------------------- /default/data/ui/views/data_accessed_investigator.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/data_accessed_investigator.xml -------------------------------------------------------------------------------- /default/data/ui/views/email_forwarding.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/email_forwarding.xml -------------------------------------------------------------------------------- /default/data/ui/views/email_forwarding_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/email_forwarding_rules.xml -------------------------------------------------------------------------------- /default/data/ui/views/flow_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/flow_rules.xml -------------------------------------------------------------------------------- /default/data/ui/views/forwarding_rule_investigator.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/forwarding_rule_investigator.xml -------------------------------------------------------------------------------- /default/data/ui/views/login_activity.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/login_activity.xml -------------------------------------------------------------------------------- /default/data/ui/views/mail_rule_investigator_mri.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/mail_rule_investigator_mri.xml -------------------------------------------------------------------------------- /default/data/ui/views/mail_rule_investigator_mri_clone.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/mail_rule_investigator_mri_clone.xml -------------------------------------------------------------------------------- /default/data/ui/views/oauth2_abuse.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/oauth2_abuse.xml -------------------------------------------------------------------------------- /default/data/ui/views/oauth_abuse.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/oauth_abuse.xml -------------------------------------------------------------------------------- /default/data/ui/views/other_suspicious_activity.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/other_suspicious_activity.xml -------------------------------------------------------------------------------- /default/data/ui/views/permission_changes.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/permission_changes.xml -------------------------------------------------------------------------------- /default/data/ui/views/power_automate_flows.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/data/ui/views/power_automate_flows.xml -------------------------------------------------------------------------------- /default/default/app.conf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/app.conf -------------------------------------------------------------------------------- /default/default/data/ui/nav/default.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/nav/default.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/account_investigator_ai.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/account_investigator_ai.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/data_accessed_investigator.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/data_accessed_investigator.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/email_forwarding.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/email_forwarding.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/login_activity.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/login_activity.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/mail_rule_investigator_mri.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/mail_rule_investigator_mri.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/oauth2_abuse.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/oauth2_abuse.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/other_suspicious_activity.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/other_suspicious_activity.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/permission_changes.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/permission_changes.xml -------------------------------------------------------------------------------- /default/default/data/ui/views/power_automate_flows.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/data/ui/views/power_automate_flows.xml -------------------------------------------------------------------------------- /default/default/eventtypes.conf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/default/eventtypes.conf -------------------------------------------------------------------------------- /default/default/macros.conf: -------------------------------------------------------------------------------- 1 | 2 | [ual] 3 | definition = index=* 4 | 5 | -------------------------------------------------------------------------------- /default/eventtypes.conf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/eventtypes.conf -------------------------------------------------------------------------------- /default/macros.conf: -------------------------------------------------------------------------------- 1 | 2 | [ual] 3 | definition = index=* 4 | 5 | -------------------------------------------------------------------------------- /default/metadata/default.meta: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/metadata/default.meta -------------------------------------------------------------------------------- /default/static/appIcon.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appIcon.png -------------------------------------------------------------------------------- /default/static/appIconAlt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appIconAlt.png -------------------------------------------------------------------------------- /default/static/appIconAlt_2x.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appIconAlt_2x.png -------------------------------------------------------------------------------- /default/static/appIcon_2x.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appIcon_2x.png -------------------------------------------------------------------------------- /default/static/appLogo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appLogo.png -------------------------------------------------------------------------------- /default/static/appLogo_2x.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/Blue-team-app-Office-365-and-Azure/HEAD/default/static/appLogo_2x.png --------------------------------------------------------------------------------