Skip to content

Commit 8e57cf6

Browse files
rosspa05rosspa05
committed
Created function for detailed explanation
1 parent c2e88c4 commit 8e57cf6

File tree

1 file changed

+36
-106
lines changed

1 file changed

+36
-106
lines changed

‎M365/MDO/MDOThreatPolicyChecker.ps1

+36-106
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,21 @@ begin {
107107
# Cache of members to reduce number of calls to Get-MgGroupMember
108108
$memberCache = @{}
109109

110+
function Write-DetailedExplanationOption {
111+
[CmdletBinding()]
112+
param(
113+
[Parameter(Mandatory = $true)]
114+
[string]$Message,
115+
[Parameter(Mandatory = $true)]
116+
[switch]$ShowDetailedExplanation
117+
)
118+
if ($ShowDetailedExplanation) {
119+
Write-Host "`t`t$message"
120+
} else {
121+
Write-Verbose $message
122+
}
123+
}
124+
110125
function Get-GroupObjectId {
111126
[OutputType([string])]
112127
param(
@@ -286,14 +301,9 @@ begin {
286301
foreach ($rule in $Rules) {
287302
$senderOrReceiver = $exceptSenderOrReceiver = $memberOf = $exceptMemberOf = $domainsIs = $exceptIfDomainsIs = $null
288303
$emailInRule = $emailExceptionInRule = $groupInRule = $groupExceptionInRule = $domainInRule = $domainExceptionInRule = $false
289-
304+
Write-Host " "
290305
if ($Outbound) {
291-
$message = "Checking outbound spam rule: `"$($rule.Name)`""
292-
if ($ShowDetailedExplanation) {
293-
Write-Host "`t`t$message"
294-
} else {
295-
Write-Verbose $message
296-
}
306+
Write-DetailedExplanationOption -Message "Checking outbound spam rule: `"$($rule.Name)`"" -ShowDetailedExplanation:$ShowDetailedExplanation
297307
$requestedProperties = 'From', 'ExceptIfFrom', 'FromMemberOf', 'ExceptIfFromMemberOf', 'SenderDomainIs', 'ExceptIfSenderDomainIs'
298308
$senderOrReceiver = $rule.From
299309
$exceptSenderOrReceiver = $rule.ExceptIfFrom
@@ -302,12 +312,7 @@ begin {
302312
$domainsIs = $rule.SenderDomainIs
303313
$exceptIfDomainsIs = $rule.ExceptIfSenderDomainIs
304314
} else {
305-
$message = "Checking rule: `"$($rule.Name)`""
306-
if ($ShowDetailedExplanation) {
307-
Write-Host "`n`t`t$message"
308-
} else {
309-
Write-Verbose $message
310-
}
315+
Write-DetailedExplanationOption -Message "Checking rule: `"$($rule.Name)`"" -ShowDetailedExplanation:$ShowDetailedExplanation
311316
$requestedProperties = 'SentTo', 'ExceptIfSentTo', 'SentToMemberOf', 'ExceptIfSentToMemberOf', 'RecipientDomainIs', 'ExceptIfRecipientDomainIs'
312317
$senderOrReceiver = $rule.SentTo
313318
$exceptSenderOrReceiver = $rule.ExceptIfSentTo
@@ -325,52 +330,27 @@ begin {
325330
Write-Verbose " "
326331

327332
if ($senderOrReceiver -and $Email -in $senderOrReceiver) {
328-
$message = "Included in rule as User. Other conditions must match also."
329-
if ($ShowDetailedExplanation) {
330-
Write-Host "`t`t$message"
331-
} else {
332-
Write-Verbose $message
333-
}
333+
Write-DetailedExplanationOption -Message "Included in rule as User. Other conditions must match also." -ShowDetailedExplanation:$ShowDetailedExplanation
334334
$emailInRule = $true
335335
}
336336
if ($exceptSenderOrReceiver -and $Email -in $exceptSenderOrReceiver) {
337-
$message = "Excluded from rule as User."
338-
if ($ShowDetailedExplanation) {
339-
Write-Host "`t`t$message"
340-
} else {
341-
Write-Verbose $message
342-
}
337+
Write-DetailedExplanationOption -Message "Excluded from rule as User." -ShowDetailedExplanation:$ShowDetailedExplanation
343338
$emailExceptionInRule = $true
344339
}
345340

346341
if ($memberOf) {
347342
foreach ($groupEmail in $memberOf) {
348-
$message = "Checking if recipient is in Group $groupEmail"
349-
if ($ShowDetailedExplanation) {
350-
Write-Host "`t`t$message"
351-
} else {
352-
Write-Verbose $message
353-
}
343+
Write-DetailedExplanationOption -Message "Checking if recipient is in Group $groupEmail" -ShowDetailedExplanation:$ShowDetailedExplanation
354344
$groupObjectId = Get-GroupObjectId -GroupEmail $groupEmail
355345
if ([string]::IsNullOrEmpty($groupObjectId)) {
356346
Write-Host "The group in $($rule.Name) with email address $groupEmail does not exist." -ForegroundColor Yellow
357347
} else {
358348
$groupInRule = Test-IsInGroup -Email $Email -GroupObjectId $groupObjectId
359349
if ($groupInRule) {
360-
$message = "Group membership match: $($Email.ToString()) is a member of Group $($groupObjectId)"
361-
if ($ShowDetailedExplanation) {
362-
Write-Host "`t`t$message"
363-
} else {
364-
Write-Verbose $message
365-
}
350+
Write-DetailedExplanationOption -Message "Group membership match: $($Email.ToString()) is a member of Group $($groupObjectId)" -ShowDetailedExplanation:$ShowDetailedExplanation
366351
break
367352
} else {
368-
$message = "No Group match because $($Email.ToString()) is not a member of Group $($groupObjectId)"
369-
if ($ShowDetailedExplanation) {
370-
Write-Host "`t`t$message"
371-
} else {
372-
Write-Verbose $message
373-
}
353+
Write-DetailedExplanationOption -Message "No Group match because $($Email.ToString()) is not a member of Group $($groupObjectId)" -ShowDetailedExplanation:$ShowDetailedExplanation
374354
break
375355
}
376356
}
@@ -379,32 +359,17 @@ begin {
379359

380360
if ($exceptMemberOf) {
381361
foreach ($groupEmail in $exceptMemberOf) {
382-
$message = "Checking if recipient is in excluded Group $groupEmail"
383-
if ($ShowDetailedExplanation) {
384-
Write-Host "`t`t$message"
385-
} else {
386-
Write-Verbose $message
387-
}
362+
Write-DetailedExplanationOption -Message "Checking if recipient is in excluded Group $groupEmail" -ShowDetailedExplanation:$ShowDetailedExplanation
388363
$groupObjectId = Get-GroupObjectId -GroupEmail $groupEmail
389364
if ([string]::IsNullOrEmpty($groupObjectId)) {
390365
Write-Host "The group in $($rule.Name) with email address $groupEmail does not exist." -ForegroundColor Yellow
391366
} else {
392367
$groupExceptionInRule = Test-IsInGroup -Email $Email -GroupObjectId $groupObjectId
393368
if ($groupExceptionInRule) {
394-
$message = "Excluded from rule by group membership. $($Email.ToString()) is in excluded Group $($groupObjectId)"
395-
if ($ShowDetailedExplanation) {
396-
Write-Host "`t`t$message"
397-
} else {
398-
Write-Verbose $message
399-
}
369+
Write-DetailedExplanationOption -Message "Excluded from rule by group membership. $($Email.ToString()) is in excluded Group $($groupObjectId)" -ShowDetailedExplanation:$ShowDetailedExplanation
400370
break
401371
} else {
402-
$message = "$($Email.ToString()) is not excluded from rule by membership in Group $($groupObjectId)"
403-
if ($ShowDetailedExplanation) {
404-
Write-Host "`t`t$message"
405-
} else {
406-
Write-Verbose $message
407-
}
372+
Write-DetailedExplanationOption -Message "$($Email.ToString()) is not excluded from rule by membership in Group $($groupObjectId)" -ShowDetailedExplanation:$ShowDetailedExplanation
408373
break
409374
}
410375
}
@@ -414,21 +379,11 @@ begin {
414379
$temp = $Email.Host
415380
while ($temp.IndexOf(".") -gt 0) {
416381
if ($temp -in $domainsIs) {
417-
$message = "Domain is in rule: $temp. Other conditions must match also."
418-
if ($ShowDetailedExplanation) {
419-
Write-Host "`t`t$message"
420-
} else {
421-
Write-Verbose $message
422-
}
382+
Write-DetailedExplanationOption -Message "Domain is in rule: $temp. Other conditions must match also." -ShowDetailedExplanation:$ShowDetailedExplanation
423383
$domainInRule = $true
424384
}
425385
if ($temp -in $exceptIfDomainsIs) {
426-
$message = "Excluded from rule by domain: $temp"
427-
if ($ShowDetailedExplanation) {
428-
Write-Host "`t`t$message"
429-
} else {
430-
Write-Verbose $message
431-
}
386+
Write-DetailedExplanationOption -Message "Excluded from rule by domain: $temp" -ShowDetailedExplanation:$ShowDetailedExplanation
432387
$domainExceptionInRule = $true
433388
}
434389
$temp = $temp.Substring($temp.IndexOf(".") + 1)
@@ -439,47 +394,22 @@ begin {
439394
if (((($emailInRule -or (-not $senderOrReceiver)) -and ($domainInRule -or (-not $domainsIs)) -and ($groupInRule -or (-not $memberOf))) -and
440395
($emailInRule -or $domainInRule -or $groupInRule)) -and
441396
((-not $emailExceptionInRule) -and (-not $groupExceptionInRule) -and (-not $domainExceptionInRule))) {
442-
$message = "Policy match found: `"$($rule.Name)`""
443-
$messageDetail = "Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}."
444-
$messageDetail2 = "Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}."
445-
if ($ShowDetailedExplanation) {
446-
Write-Host "`t`t$message"
447-
Write-Host ("`t`t$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
448-
Write-Host ("`t`t$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
449-
} else {
450-
Write-Verbose $message
451-
Write-Verbose ("$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
452-
Write-Verbose ("$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
453-
}
397+
Write-DetailedExplanationOption -Message "Policy match found: `"$($rule.Name)`"" -ShowDetailedExplanation:$ShowDetailedExplanation
398+
Write-DetailedExplanationOption -Message "Included in rule as User: $emailInRule. Included in rule by Group membership: $groupInRule. Included in rule by Domain: $domainInRule." -ShowDetailedExplanation:$ShowDetailedExplanation
399+
Write-DetailedExplanationOption -Message "Excluded from rule as User: $emailExceptionInRule. Excluded from rule by group membership: $groupExceptionInRule. Excluded from rule by domain: $domainExceptionInRule." -ShowDetailedExplanation:$ShowDetailedExplanation
454400
return $rule
455401
} else {
456-
$message = "The rule/policy does not explicitly include the recipient because not all User, Group, and Domain properties which have values include the recipient. `n`t`tDue to the AND operator between the User, Group, and Domain inclusion properties, if any of those properties have non-null values (they are not empty), the recipient must be included in that property."
457-
$messageDetail = "Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}."
458-
$messageDetail2 = "Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}."
459-
if ($ShowDetailedExplanation) {
460-
Write-Host "`t`t$message"
461-
Write-Host ("`t`t$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
462-
Write-Host ("`t`t$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
463-
} else {
464-
Write-Verbose $message
465-
Write-Verbose ("$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
466-
Write-Verbose ("$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
467-
}
402+
Write-DetailedExplanationOption -Message "The rule/policy does not explicitly include the recipient because not all User, Group, and Domain properties which have values include the recipient. `n`t`tDue to the AND operator between the User, Group, and Domain inclusion properties, if any of those properties have non-null values (they are not empty), the recipient must be included in that property." -ShowDetailedExplanation:$ShowDetailedExplanation
403+
Write-DetailedExplanationOption -Message "Included in rule as User: $emailInRule. Included in rule by Group membership: $groupInRule. Included in rule by Domain: $domainInRule." -ShowDetailedExplanation:$ShowDetailedExplanation
404+
Write-DetailedExplanationOption -Message "Excluded from rule as User: $emailExceptionInRule. Excluded from rule by group membership: $groupExceptionInRule. Excluded from rule by domain: $domainExceptionInRule." -ShowDetailedExplanation:$ShowDetailedExplanation
468405
}
469406

470407
# Check for implicit inclusion (no mailboxes included at all), which is possible for Presets and SA/SL. They are included if not explicitly excluded. Only inbound
471408
if ((-not $Outbound) -and
472409
(((-not $senderOrReceiver) -and (-not $domainsIs) -and (-not $memberOf)) -and
473410
((-not $emailExceptionInRule) -and (-not $groupExceptionInRule) -and (-not $domainExceptionInRule)))) {
474-
$message = "The recipient is IMPLICITLY included. There are no recipients explicitly included in the policy, and the user is not explicitly excluded either in the User, Group, or Domain exclusion properties. `n`t`tImplicit inclusion is possible for Preset policies and Safe Attachments and Safe Links in which no explicit inclusions have been made."
475-
$messageDetail = "Rule of matching policy: `"$($rule.Name)`""
476-
if ($ShowDetailedExplanation) {
477-
Write-Host "`t`t$message"
478-
Write-Host "`t`t$messageDetail"
479-
} else {
480-
Write-Verbose $message
481-
Write-Verbose $messageDetail
482-
}
411+
Write-DetailedExplanationOption -Message "The recipient is IMPLICITLY included. There are no recipients explicitly included in the policy, and the user is not explicitly excluded either in the User, Group, or Domain exclusion properties. `n`t`tImplicit inclusion is possible for Preset policies and Safe Attachments and Safe Links in which no explicit inclusions have been made." -ShowDetailedExplanation:$ShowDetailedExplanation
412+
Write-DetailedExplanationOption -Message "Rule of matching policy: `"$($rule.Name)`"" -ShowDetailedExplanation:$ShowDetailedExplanation
483413
return $rule
484414
}
485415
}

0 commit comments

Comments
 (0)