diff --git a/source/tests/Test-AdministrativeAccountCompliance.ps1 b/source/tests/Test-AdministrativeAccountCompliance.ps1 index 6bda22d..523ec11 100644 --- a/source/tests/Test-AdministrativeAccountCompliance.ps1 +++ b/source/tests/Test-AdministrativeAccountCompliance.ps1 @@ -1,6 +1,7 @@ function Test-AdministrativeAccountCompliance { [CmdletBinding()] param ( + # Aligned # Parameters can be added if needed ) begin { diff --git a/source/tests/Test-AntiPhishingPolicy.ps1 b/source/tests/Test-AntiPhishingPolicy.ps1 index 449f4c8..0aef681 100644 --- a/source/tests/Test-AntiPhishingPolicy.ps1 +++ b/source/tests/Test-AntiPhishingPolicy.ps1 @@ -1,6 +1,7 @@ function Test-AntiPhishingPolicy { [CmdletBinding()] param ( + # Aligned # Parameters can be added if needed ) diff --git a/source/tests/Test-AuditDisabledFalse.ps1 b/source/tests/Test-AuditDisabledFalse.ps1 index bd3ee04..205d05a 100644 --- a/source/tests/Test-AuditDisabledFalse.ps1 +++ b/source/tests/Test-AuditDisabledFalse.ps1 @@ -1,5 +1,6 @@ function Test-AuditDisabledFalse { [CmdletBinding()] + # Aligned param ( # Parameters can be added if needed ) diff --git a/source/tests/Test-AuditLogSearch.ps1 b/source/tests/Test-AuditLogSearch.ps1 index 3249872..ac45913 100644 --- a/source/tests/Test-AuditLogSearch.ps1 +++ b/source/tests/Test-AuditLogSearch.ps1 @@ -1,22 +1,39 @@ function Test-AuditLogSearch { [CmdletBinding()] param ( + # Aligned # Parameters can be added if needed ) begin { - # Dot source the class script + # Dot source the class script if necessary - $auditResults = @() + # Initialization code, if needed } process { # 3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled - # Pass if UnifiedAuditLogIngestionEnabled is True. Fail otherwise. + + # Retrieve the audit log configuration $auditLogConfig = Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled $auditLogResult = $auditLogConfig.UnifiedAuditLogIngestionEnabled - # Create an instance of CISAuditResult and populate it + # Prepare failure reasons and details based on compliance + $failureReasons = if (-not $auditLogResult) { + "Audit log search is not enabled" + } + else { + "N/A" + } + + $details = if ($auditLogResult) { + "UnifiedAuditLogIngestionEnabled: True" + } + else { + "UnifiedAuditLogIngestionEnabled: False" + } + + # Create and populate the CISAuditResult object $auditResult = [CISAuditResult]::new() $auditResult.Status = if ($auditLogResult) { "Pass" } else { "Fail" } $auditResult.ELevel = "E3" @@ -30,14 +47,12 @@ function Test-AuditLogSearch { $auditResult.IG2 = $true $auditResult.IG3 = $true $auditResult.Result = $auditLogResult - $auditResult.Details = "UnifiedAuditLogIngestionEnabled: $($auditLogConfig.UnifiedAuditLogIngestionEnabled)" - $auditResult.FailureReason = if (-not $auditLogResult) { "Audit log search is not enabled" } else { "N/A" } - - $auditResults += $auditResult + $auditResult.Details = $details + $auditResult.FailureReason = $failureReasons } end { - # Return auditResults - return $auditResults + # Return the audit result + return $auditResult } }