changed name of output functions with prefix 'CIS'

This commit is contained in:
DrIOS
2024-06-23 14:44:25 -05:00
parent a90df5bef4
commit e9bac2fe1c
34 changed files with 95 additions and 36 deletions

View File

@@ -4,11 +4,11 @@
.DESCRIPTION .DESCRIPTION
This sample function is not exported to the module and only return the data passed as parameter. This sample function is not exported to the module and only return the data passed as parameter.
.EXAMPLE .EXAMPLE
$null = Get-ExoOutput -PrivateData 'NOTHING TO SEE HERE' $null = Get-CISExoOutput -PrivateData 'NOTHING TO SEE HERE'
.PARAMETER PrivateData .PARAMETER PrivateData
The PrivateData parameter is what will be returned without transformation. The PrivateData parameter is what will be returned without transformation.
#> #>
function Get-ExoOutput { function Get-CISExoOutput {
[cmdletBinding()] [cmdletBinding()]
[OutputType([string])] [OutputType([string])]
param( param(
@@ -293,5 +293,5 @@ function Get-ExoOutput {
end { end {
Write-Verbose "Retuning data for Rec: $Rec" Write-Verbose "Retuning data for Rec: $Rec"
} }
} # end function Get-MgOutput } # end function Get-CISExoOutput

View File

@@ -0,0 +1,32 @@
function Get-CISMSTeamsOutput
{
<#
.SYNOPSIS
This is a sample Private function only visible within the module.
.DESCRIPTION
This sample function is not exported to the module and only return the data passed as parameter.
.EXAMPLE
$null = Get-MSTeamsOutput -PrivateData 'NOTHING TO SEE HERE'
.PARAMETER PrivateData
The PrivateData parameter is what will be returned without transformation.
#>
[cmdletBinding()]
[OutputType([string])]
param
(
[Parameter()]
[String]
$PrivateData
)
process
{
Write-Output $PrivateData
}
}

View File

@@ -1,4 +1,4 @@
function Get-MgOutput { function Get-CISMgOutput {
<# <#
.SYNOPSIS .SYNOPSIS
This is a sample Private function only visible within the module. This is a sample Private function only visible within the module.
@@ -7,7 +7,7 @@ function Get-MgOutput {
This sample function is not exported to the module and only return the data passed as parameter. This sample function is not exported to the module and only return the data passed as parameter.
.EXAMPLE .EXAMPLE
$null = Get-MgOutput -PrivateData 'NOTHING TO SEE HERE' $null = Get-CISMgOutput -PrivateData 'NOTHING TO SEE HERE'
.PARAMETER PrivateData .PARAMETER PrivateData
The PrivateData parameter is what will be returned without transformation. The PrivateData parameter is what will be returned without transformation.
@@ -81,5 +81,5 @@ function Get-MgOutput {
end { end {
Write-Verbose "Retuning data for Rec: $Rec" Write-Verbose "Retuning data for Rec: $Rec"
} }
} # end function Get-MgOutput } # end function Get-CISMgOutput

View File

@@ -17,7 +17,7 @@ function Test-AdministrativeAccountCompliance {
try { try {
# Retrieve admin roles, assignments, and user details including licenses # Retrieve admin roles, assignments, and user details including licenses
Write-Verbose "Retrieving admin roles, assignments, and user details including licenses" Write-Verbose "Retrieving admin roles, assignments, and user details including licenses"
$adminRoleAssignments = Get-MgOutput -Rec $recnum $adminRoleAssignments = Get-CISMgOutput -Rec $recnum
$adminRoleUsers = @() $adminRoleUsers = @()

View File

@@ -34,7 +34,7 @@ function Test-AntiPhishingPolicy {
try { try {
# Condition A: Ensure that an anti-phishing policy has been created # Condition A: Ensure that an anti-phishing policy has been created
$antiPhishPolicies = Get-ExoOutput -Rec $recnum $antiPhishPolicies = Get-CISExoOutput -Rec $recnum
# Condition B: Verify the anti-phishing policy settings using PowerShell # Condition B: Verify the anti-phishing policy settings using PowerShell
$validatedPolicies = $antiPhishPolicies | Where-Object { $validatedPolicies = $antiPhishPolicies | Where-Object {

View File

@@ -35,7 +35,7 @@ function Test-AuditDisabledFalse {
# 6.1.1 (L1) Ensure 'AuditDisabled' organizationally is set to 'False' # 6.1.1 (L1) Ensure 'AuditDisabled' organizationally is set to 'False'
# Retrieve the AuditDisabled configuration (Condition B) # Retrieve the AuditDisabled configuration (Condition B)
$auditNotDisabled = Get-ExoOutput -Rec $recnum $auditNotDisabled = Get-CISExoOutput -Rec $recnum
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance
$failureReasons = if (-not $auditNotDisabled) { $failureReasons = if (-not $auditNotDisabled) {

View File

@@ -36,7 +36,7 @@ function Test-AuditLogSearch {
try { try {
# 3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled # 3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled
$auditLogResult = Get-ExoOutput -Rec $recnum $auditLogResult = Get-CISExoOutput -Rec $recnum
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance
$failureReasons = if (-not $auditLogResult) { $failureReasons = if (-not $auditLogResult) {

View File

@@ -35,7 +35,7 @@ function Test-BlockMailForwarding {
# 6.2.1 (L1) Ensure all forms of mail forwarding are blocked and/or disabled # 6.2.1 (L1) Ensure all forms of mail forwarding are blocked and/or disabled
# Step 1: Retrieve the transport rules that redirect messages # Step 1: Retrieve the transport rules that redirect messages
$transportRules,$nonCompliantSpamPolicies = Get-ExoOutput -Rec $recnum $transportRules,$nonCompliantSpamPolicies = Get-CISExoOutput -Rec $recnum
$transportForwardingBlocked = $transportRules.Count -eq 0 $transportForwardingBlocked = $transportRules.Count -eq 0
# Step 2: Check all anti-spam outbound policies # Step 2: Check all anti-spam outbound policies

View File

@@ -30,7 +30,7 @@ function Test-BlockSharedMailboxSignIn {
process { process {
try { try {
# Step: Retrieve shared mailbox details # Step: Retrieve shared mailbox details
$MBX = Get-ExoOutput -Rec $recnum $MBX = Get-CISExoOutput -Rec $recnum
# Step: Retrieve details of shared mailboxes from Azure AD (Condition B: Pass/Fail) # Step: Retrieve details of shared mailboxes from Azure AD (Condition B: Pass/Fail)
$sharedMailboxDetails = $MBX | ForEach-Object { Get-AzureADUser -ObjectId $_.ExternalDirectoryObjectId } $sharedMailboxDetails = $MBX | ForEach-Object { Get-AzureADUser -ObjectId $_.ExternalDirectoryObjectId }

View File

@@ -38,7 +38,7 @@ function Test-CommonAttachmentFilter {
# Condition B: Using Exchange Online PowerShell, verify that the `EnableFileFilter` property of the default malware filter policy is set to `True`. # Condition B: Using Exchange Online PowerShell, verify that the `EnableFileFilter` property of the default malware filter policy is set to `True`.
# Retrieve the attachment filter policy # Retrieve the attachment filter policy
$result = Get-ExoOutput -Rec $recnum $result = Get-CISExoOutput -Rec $recnum
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance
$failureReasons = if (-not $result) { $failureReasons = if (-not $result) {

View File

@@ -33,7 +33,7 @@ function Test-CustomerLockbox {
process { process {
try { try {
# Step: Retrieve the organization configuration (Condition C: Pass/Fail) # Step: Retrieve the organization configuration (Condition C: Pass/Fail)
$customerLockboxEnabled = Get-ExoOutput -Rec $recnum $customerLockboxEnabled = Get-CISExoOutput -Rec $recnum
# Step: Prepare failure reasons and details based on compliance (Condition A, B, & C: Fail) # Step: Prepare failure reasons and details based on compliance (Condition A, B, & C: Fail)
$failureReasons = if (-not $customerLockboxEnabled) { $failureReasons = if (-not $customerLockboxEnabled) {

View File

@@ -36,7 +36,7 @@ function Test-EnableDKIM {
# 2.1.9 (L1) Ensure DKIM is enabled for all Exchange Online Domains # 2.1.9 (L1) Ensure DKIM is enabled for all Exchange Online Domains
# Retrieve DKIM configuration for all domains # Retrieve DKIM configuration for all domains
$dkimConfig = Get-ExoOutput -Rec $recnum $dkimConfig = Get-CISExoOutput -Rec $recnum
$dkimResult = ($dkimConfig | ForEach-Object { $_.Enabled }) -notcontains $false $dkimResult = ($dkimConfig | ForEach-Object { $_.Enabled }) -notcontains $false
$dkimFailedDomains = $dkimConfig | Where-Object { -not $_.Enabled } | ForEach-Object { $_.Domain } $dkimFailedDomains = $dkimConfig | Where-Object { -not $_.Enabled } | ForEach-Object { $_.Domain }

View File

@@ -31,7 +31,7 @@ function Test-ExternalSharingCalendars {
process { process {
try { try {
# Step: Retrieve sharing policies related to calendar sharing # Step: Retrieve sharing policies related to calendar sharing
$sharingPolicies = Get-ExoOutput -Rec $recnum $sharingPolicies = Get-CISExoOutput -Rec $recnum
# Step (Condition A & B: Pass/Fail): Check if calendar sharing is disabled in all applicable policies # Step (Condition A & B: Pass/Fail): Check if calendar sharing is disabled in all applicable policies
$isExternalSharingDisabled = $true $isExternalSharingDisabled = $true

View File

@@ -30,7 +30,7 @@ function Test-GlobalAdminsCount {
process { process {
try { try {
$globalAdmins = Get-MgOutput -Rec $recnum $globalAdmins = Get-CISMgOutput -Rec $recnum
# Step: Count the number of global admins # Step: Count the number of global admins
$globalAdminCount = $globalAdmins.Count $globalAdminCount = $globalAdmins.Count

View File

@@ -36,7 +36,7 @@ function Test-IdentifyExternalEmail {
# 6.2.3 (L1) Ensure email from external senders is identified # 6.2.3 (L1) Ensure email from external senders is identified
# Retrieve external sender tagging configuration # Retrieve external sender tagging configuration
$externalInOutlook = Get-ExoOutput -Rec $recnum $externalInOutlook = Get-CISExoOutput -Rec $recnum
$externalTaggingEnabled = ($externalInOutlook | ForEach-Object { $_.Enabled }) -contains $true $externalTaggingEnabled = ($externalInOutlook | ForEach-Object { $_.Enabled }) -contains $true
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance

View File

@@ -38,7 +38,7 @@ function Test-MailTipsEnabled {
# 6.5.2 (L2) Ensure MailTips are enabled for end users # 6.5.2 (L2) Ensure MailTips are enabled for end users
# Retrieve organization configuration for MailTips settings # Retrieve organization configuration for MailTips settings
$orgConfig = Get-ExoOutput -Rec $recnum $orgConfig = Get-CISExoOutput -Rec $recnum
# Check the MailTips settings (Conditions A, B, C, D) # Check the MailTips settings (Conditions A, B, C, D)
$allTipsEnabled = $orgConfig.MailTipsAllTipsEnabled -and $orgConfig.MailTipsGroupMetricsEnabled -and $orgConfig.MailTipsLargeAudienceThreshold -eq 25 $allTipsEnabled = $orgConfig.MailTipsAllTipsEnabled -and $orgConfig.MailTipsGroupMetricsEnabled -and $orgConfig.MailTipsLargeAudienceThreshold -eq 25

View File

@@ -38,14 +38,14 @@ function Test-MailboxAuditingE3 {
$allFailures = @() $allFailures = @()
$recnum = "6.1.2" $recnum = "6.1.2"
$allUsers = Get-MgOutput -Rec $recnum $allUsers = Get-CISMgOutput -Rec $recnum
$processedUsers = @{} # Dictionary to track processed users $processedUsers = @{} # Dictionary to track processed users
} }
process { process {
if ($null -ne $allUsers) { if ($null -ne $allUsers) {
$mailboxes = Get-ExoOutput -Rec $recnum $mailboxes = Get-CISExoOutput -Rec $recnum
try { try {
foreach ($user in $allUsers) { foreach ($user in $allUsers) {
if ($processedUsers.ContainsKey($user.UserPrincipalName)) { if ($processedUsers.ContainsKey($user.UserPrincipalName)) {

View File

@@ -35,12 +35,12 @@ function Test-MailboxAuditingE5 {
$allFailures = @() $allFailures = @()
$processedUsers = @{} $processedUsers = @{}
$recnum = "6.1.3" $recnum = "6.1.3"
$allUsers = Get-MgOutput -Rec $recnum $allUsers = Get-CISMgOutput -Rec $recnum
} }
process { process {
if ($null -ne $allUsers) { if ($null -ne $allUsers) {
$mailboxes = Get-ExoOutput -Rec $recnum $mailboxes = Get-CISExoOutput -Rec $recnum
try { try {
foreach ($user in $allUsers) { foreach ($user in $allUsers) {
if ($processedUsers.ContainsKey($user.UserPrincipalName)) { if ($processedUsers.ContainsKey($user.UserPrincipalName)) {

View File

@@ -30,7 +30,7 @@ function Test-ManagedApprovedPublicGroups {
process { process {
try { try {
# Step: Retrieve all groups with visibility set to 'Public' # Step: Retrieve all groups with visibility set to 'Public'
$allGroups = Get-MgOutput -Rec $recnum $allGroups = Get-CISMgOutput -Rec $recnum
# Step: Determine failure reasons based on the presence of public groups # Step: Determine failure reasons based on the presence of public groups
$failureReasons = if ($null -ne $allGroups -and $allGroups.Count -gt 0) { $failureReasons = if ($null -ne $allGroups -and $allGroups.Count -gt 0) {

View File

@@ -34,7 +34,7 @@ function Test-ModernAuthExchangeOnline {
# 6.5.1 (L1) Ensure modern authentication for Exchange Online is enabled # 6.5.1 (L1) Ensure modern authentication for Exchange Online is enabled
# Check modern authentication setting in Exchange Online configuration (Condition A and B) # Check modern authentication setting in Exchange Online configuration (Condition A and B)
$orgConfig = Get-ExoOutput -Rec $recnum $orgConfig = Get-CISExoOutput -Rec $recnum
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance
$failureReasons = if (-not $orgConfig.OAuth2ClientProfileEnabled) { $failureReasons = if (-not $orgConfig.OAuth2ClientProfileEnabled) {

View File

@@ -38,7 +38,7 @@ function Test-NoWhitelistDomains {
# Retrieve transport rules that whitelist specific domains # Retrieve transport rules that whitelist specific domains
# Condition A: Checking for transport rules that whitelist specific domains # Condition A: Checking for transport rules that whitelist specific domains
$whitelistedRules = Get-ExoOutput -Rec $recnum $whitelistedRules = Get-CISExoOutput -Rec $recnum
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance
# Condition B: Prepare failure reasons based on the presence of whitelisted rules # Condition B: Prepare failure reasons based on the presence of whitelisted rules
$failureReasons = if ($whitelistedRules) { $failureReasons = if ($whitelistedRules) {

View File

@@ -34,7 +34,7 @@ function Test-NotifyMalwareInternal {
# 2.1.3 Ensure notifications for internal users sending malware is Enabled # 2.1.3 Ensure notifications for internal users sending malware is Enabled
# Retrieve all 'Custom' malware filter policies and check notification settings # Retrieve all 'Custom' malware filter policies and check notification settings
$malwareNotifications = Get-ExoOutput -Rec $recnum $malwareNotifications = Get-CISExoOutput -Rec $recnum
# Condition B: Using PowerShell, the `NotifyInternal` property in the anti-malware policy is set to `True` and includes at least one valid email address for notifications. # Condition B: Using PowerShell, the `NotifyInternal` property in the anti-malware policy is set to `True` and includes at least one valid email address for notifications.
$policiesToReport = @() $policiesToReport = @()

View File

@@ -34,7 +34,7 @@ function Test-PasswordHashSync {
# 5.1.8.1 (L1) Ensure password hash sync is enabled for hybrid deployments # 5.1.8.1 (L1) Ensure password hash sync is enabled for hybrid deployments
# Retrieve password hash sync status (Condition A and C) # Retrieve password hash sync status (Condition A and C)
$passwordHashSync = Get-MgOutput -Rec $recnum $passwordHashSync = Get-CISMgOutput -Rec $recnum
$hashSyncResult = $passwordHashSync $hashSyncResult = $passwordHashSync
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance

View File

@@ -24,7 +24,7 @@ function Test-ReportSecurityInTeams {
$CsTeamsMessagingPolicy = Get-CsTeamsMessagingPolicy -Identity Global | Select-Object -Property AllowSecurityEndUserReporting $CsTeamsMessagingPolicy = Get-CsTeamsMessagingPolicy -Identity Global | Select-Object -Property AllowSecurityEndUserReporting
# Condition B: Verify that 'Monitor reported messages in Microsoft Teams' is checked in the Microsoft 365 Defender portal. # Condition B: Verify that 'Monitor reported messages in Microsoft Teams' is checked in the Microsoft 365 Defender portal.
# Condition C: Ensure the 'Send reported messages to' setting in the Microsoft 365 Defender portal is set to 'My reporting mailbox only' with the correct report email addresses. # Condition C: Ensure the 'Send reported messages to' setting in the Microsoft 365 Defender portal is set to 'My reporting mailbox only' with the correct report email addresses.
$ReportSubmissionPolicy = Get-ExoOutput -Rec $recnum $ReportSubmissionPolicy = Get-CISExoOutput -Rec $recnum
# Check if all the required settings are enabled # Check if all the required settings are enabled
$securityReportEnabled = $CsTeamsMessagingPolicy.AllowSecurityEndUserReporting -and $securityReportEnabled = $CsTeamsMessagingPolicy.AllowSecurityEndUserReporting -and
$ReportSubmissionPolicy.ReportJunkToCustomizedAddress -and $ReportSubmissionPolicy.ReportJunkToCustomizedAddress -and

View File

@@ -36,7 +36,7 @@ function Test-RestrictOutlookAddins {
# Check all mailboxes for custom policies with unallowed add-ins # Check all mailboxes for custom policies with unallowed add-ins
# Check Default Role Assignment Policy # Check Default Role Assignment Policy
$customPolicyFailures, $defaultPolicy = Get-ExoOutput -Rec $recnum $customPolicyFailures, $defaultPolicy = Get-CISExoOutput -Rec $recnum
$defaultPolicyRoles = $defaultPolicy.AssignedRoles | Where-Object { $_ -in $relevantRoles } $defaultPolicyRoles = $defaultPolicy.AssignedRoles | Where-Object { $_ -in $relevantRoles }
# Condition A: Verify that the roles MyCustomApps, MyMarketplaceApps, and MyReadWriteMailboxApps are unchecked under Other roles. # Condition A: Verify that the roles MyCustomApps, MyMarketplaceApps, and MyReadWriteMailboxApps are unchecked under Other roles.

View File

@@ -34,7 +34,7 @@ function Test-RestrictStorageProvidersOutlook {
# 6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web # 6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web
# Retrieve all OwaMailbox policies # Retrieve all OwaMailbox policies
$owaPolicies = Get-ExoOutput -Rec $recnum $owaPolicies = Get-CISExoOutput -Rec $recnum
# Condition A: Check if AdditionalStorageProvidersAvailable is set to False # Condition A: Check if AdditionalStorageProvidersAvailable is set to False
$nonCompliantPolicies = $owaPolicies | Where-Object { $_.AdditionalStorageProvidersAvailable } $nonCompliantPolicies = $owaPolicies | Where-Object { $_.AdditionalStorageProvidersAvailable }

View File

@@ -35,7 +35,7 @@ function Test-RestrictTenantCreation {
# 5.1.2.3 (L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' # 5.1.2.3 (L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'
# Retrieve the tenant creation policy # Retrieve the tenant creation policy
$tenantCreationPolicy = Get-MgOutput -Rec $recnum $tenantCreationPolicy = Get-CISMgOutput -Rec $recnum
$tenantCreationResult = -not $tenantCreationPolicy.AllowedToCreateTenants $tenantCreationResult = -not $tenantCreationPolicy.AllowedToCreateTenants
# Prepare failure reasons and details based on compliance # Prepare failure reasons and details based on compliance

View File

@@ -28,7 +28,7 @@ function Test-SafeAttachmentsPolicy {
} }
process { process {
$safeAttachmentPolicies = Get-ExoOutput -Rec $recnum $safeAttachmentPolicies = Get-CISExoOutput -Rec $recnum
if ($safeAttachmentPolicies -ne 1) { if ($safeAttachmentPolicies -ne 1) {
try { try {
# Check if any Safe Attachments policy is enabled (Condition A) # Check if any Safe Attachments policy is enabled (Condition A)

View File

@@ -31,7 +31,7 @@ function Test-SafeAttachmentsTeams {
} }
process { process {
$atpPolicyResult = Get-ExoOutput -Rec $recnum $atpPolicyResult = Get-CISExoOutput -Rec $recnum
if ($atpPolicyResult -ne 1) { if ($atpPolicyResult -ne 1) {
try { try {
# Condition A: Check Safe Attachments for SharePoint # Condition A: Check Safe Attachments for SharePoint

View File

@@ -42,7 +42,7 @@ function Test-SafeLinksOfficeApps {
process { process {
# 2.1.1 (L2) Ensure Safe Links for Office Applications is Enabled # 2.1.1 (L2) Ensure Safe Links for Office Applications is Enabled
# Retrieve all Safe Links policies # Retrieve all Safe Links policies
$misconfiguredDetails = Get-ExoOutput -Rec $recnum $misconfiguredDetails = Get-CISExoOutput -Rec $recnum
# Misconfigured details returns 1 if EXO Commands needed for the test are not available # Misconfigured details returns 1 if EXO Commands needed for the test are not available
if ($misconfiguredDetails -ne 1) { if ($misconfiguredDetails -ne 1) {
try { try {

View File

@@ -38,7 +38,7 @@ function Test-SpamPolicyAdminNotify {
# 2.1.6 Ensure Exchange Online Spam Policies are set to notify administrators # 2.1.6 Ensure Exchange Online Spam Policies are set to notify administrators
# Retrieve the default hosted outbound spam filter policy # Retrieve the default hosted outbound spam filter policy
$hostedOutboundSpamFilterPolicy = Get-ExoOutput -Rec $recnum $hostedOutboundSpamFilterPolicy = Get-CISExoOutput -Rec $recnum
# Check if both settings are enabled (Condition A and Condition B for pass) # Check if both settings are enabled (Condition A and Condition B for pass)
$bccSuspiciousOutboundMailEnabled = $hostedOutboundSpamFilterPolicy.BccSuspiciousOutboundMail $bccSuspiciousOutboundMailEnabled = $hostedOutboundSpamFilterPolicy.BccSuspiciousOutboundMail

View File

@@ -0,0 +1,27 @@
$ProjectPath = "$PSScriptRoot\..\..\.." | Convert-Path
$ProjectName = ((Get-ChildItem -Path $ProjectPath\*\*.psd1).Where{
($_.Directory.Name -match 'source|src' -or $_.Directory.Name -eq $_.BaseName) -and
$(try { Test-ModuleManifest $_.FullName -ErrorAction Stop } catch { $false } )
}).BaseName
Import-Module $ProjectName
InModuleScope $ProjectName {
Describe Get-PrivateFunction {
Context 'Default' {
BeforeEach {
$return = Get-PrivateFunction -PrivateData 'string'
}
It 'Returns a single object' {
($return | Measure-Object).Count | Should -Be 1
}
It 'Returns a string based on the parameter PrivateData' {
$return | Should -Be 'string'
}
}
}
}