Skip to content

Commit c2e88c4

Browse files
rosspa05rosspa05
committed
Message format improvements
1 parent ef0409d commit c2e88c4

File tree

1 file changed

+67
-41
lines changed

1 file changed

+67
-41
lines changed

‎M365/MDO/MDOThreatPolicyChecker.ps1

+67-41
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ param(
7878
[Parameter(Mandatory = $false, ParameterSetName = 'AppliedMDOEmail')]
7979
[switch]$ShowDetailedPolicies,
8080

81+
[Parameter(Mandatory = $false, ParameterSetName = 'AppliedCsv')]
82+
[Parameter(Mandatory = $false, ParameterSetName = 'AppliedEmail')]
83+
[Parameter(Mandatory = $false, ParameterSetName = 'AppliedMDOCsv')]
84+
[Parameter(Mandatory = $false, ParameterSetName = 'AppliedMDOEmail')]
85+
[switch]$ShowDetailedExplanation,
86+
8187
[Parameter(Mandatory = $false)]
8288
[switch]$SkipConnectionCheck,
8389

@@ -282,10 +288,11 @@ begin {
282288
$emailInRule = $emailExceptionInRule = $groupInRule = $groupExceptionInRule = $domainInRule = $domainExceptionInRule = $false
283289

284290
if ($Outbound) {
291+
$message = "Checking outbound spam rule: `"$($rule.Name)`""
285292
if ($ShowDetailedExplanation) {
286-
Write-Host "`n`t`tChecking outbound spam rule: `"$($rule.Name)`""
293+
Write-Host "`t`t$message"
287294
} else {
288-
Write-Verbose "Checking outbound spam rule: `"$($rule.Name)`""
295+
Write-Verbose $message
289296
}
290297
$requestedProperties = 'From', 'ExceptIfFrom', 'FromMemberOf', 'ExceptIfFromMemberOf', 'SenderDomainIs', 'ExceptIfSenderDomainIs'
291298
$senderOrReceiver = $rule.From
@@ -295,10 +302,11 @@ begin {
295302
$domainsIs = $rule.SenderDomainIs
296303
$exceptIfDomainsIs = $rule.ExceptIfSenderDomainIs
297304
} else {
305+
$message = "Checking rule: `"$($rule.Name)`""
298306
if ($ShowDetailedExplanation) {
299-
Write-Host "`n`t`tChecking rule: `"$($rule.Name)`""
307+
Write-Host "`n`t`t$message"
300308
} else {
301-
Write-Verbose "Checking rule: `"$($rule.Name)`""
309+
Write-Verbose $message
302310
}
303311
$requestedProperties = 'SentTo', 'ExceptIfSentTo', 'SentToMemberOf', 'ExceptIfSentToMemberOf', 'RecipientDomainIs', 'ExceptIfRecipientDomainIs'
304312
$senderOrReceiver = $rule.SentTo
@@ -317,46 +325,51 @@ begin {
317325
Write-Verbose " "
318326

319327
if ($senderOrReceiver -and $Email -in $senderOrReceiver) {
328+
$message = "Included in rule as User. Other conditions must match also."
320329
if ($ShowDetailedExplanation) {
321-
Write-Host "`t`tIncluded in rule as User. Other conditions must match also."
330+
Write-Host "`t`t$message"
322331
} else {
323-
Write-Verbose "Included in rule as User. Other conditions must match also."
332+
Write-Verbose $message
324333
}
325334
$emailInRule = $true
326335
}
327336
if ($exceptSenderOrReceiver -and $Email -in $exceptSenderOrReceiver) {
337+
$message = "Excluded from rule as User."
328338
if ($ShowDetailedExplanation) {
329-
Write-Host "`t`tExcluded from rule as User."
339+
Write-Host "`t`t$message"
330340
} else {
331-
Write-Verbose "Excluded from rule as User."
341+
Write-Verbose $message
332342
}
333343
$emailExceptionInRule = $true
334344
}
335345

336346
if ($memberOf) {
337347
foreach ($groupEmail in $memberOf) {
348+
$message = "Checking if recipient is in Group $groupEmail"
338349
if ($ShowDetailedExplanation) {
339-
Write-Host "`t`tChecking if recipient is in Group $groupEmail"
350+
Write-Host "`t`t$message"
340351
} else {
341-
Write-Verbose "Checking if recipient is in Group $groupEmail"
352+
Write-Verbose $message
342353
}
343354
$groupObjectId = Get-GroupObjectId -GroupEmail $groupEmail
344355
if ([string]::IsNullOrEmpty($groupObjectId)) {
345356
Write-Host "The group in $($rule.Name) with email address $groupEmail does not exist." -ForegroundColor Yellow
346357
} else {
347358
$groupInRule = Test-IsInGroup -Email $Email -GroupObjectId $groupObjectId
348359
if ($groupInRule) {
360+
$message = "Group membership match: $($Email.ToString()) is a member of Group $($groupObjectId)"
349361
if ($ShowDetailedExplanation) {
350-
Write-Host "`t`tGroup membership match: $($Email.ToString()) is a member of Group $($groupObjectId)"
362+
Write-Host "`t`t$message"
351363
} else {
352-
Write-Verbose "Group membership match: $($Email.ToString()) is a member of Group $($groupObjectId)"
364+
Write-Verbose $message
353365
}
354366
break
355367
} else {
368+
$message = "No Group match because $($Email.ToString()) is not a member of Group $($groupObjectId)"
356369
if ($ShowDetailedExplanation) {
357-
Write-Host "`t`tNo Group match because $($Email.ToString()) is not a member of Group $($groupObjectId)"
370+
Write-Host "`t`t$message"
358371
} else {
359-
Write-Verbose "No Group match because $($Email.ToString()) is not a member of Group $($groupObjectId)"
372+
Write-Verbose $message
360373
}
361374
break
362375
}
@@ -366,28 +379,31 @@ begin {
366379

367380
if ($exceptMemberOf) {
368381
foreach ($groupEmail in $exceptMemberOf) {
382+
$message = "Checking if recipient is in excluded Group $groupEmail"
369383
if ($ShowDetailedExplanation) {
370-
Write-Host "`t`tChecking if recipient is in excluded Group $groupEmail"
384+
Write-Host "`t`t$message"
371385
} else {
372-
Write-Verbose "Checking if recipient is in excluded Group $groupEmail"
386+
Write-Verbose $message
373387
}
374388
$groupObjectId = Get-GroupObjectId -GroupEmail $groupEmail
375389
if ([string]::IsNullOrEmpty($groupObjectId)) {
376390
Write-Host "The group in $($rule.Name) with email address $groupEmail does not exist." -ForegroundColor Yellow
377391
} else {
378392
$groupExceptionInRule = Test-IsInGroup -Email $Email -GroupObjectId $groupObjectId
379393
if ($groupExceptionInRule) {
394+
$message = "Excluded from rule by group membership. $($Email.ToString()) is in excluded Group $($groupObjectId)"
380395
if ($ShowDetailedExplanation) {
381-
Write-Host "`t`tExcluded from rule by group membership. $($Email.ToString()) is in excluded Group $($groupObjectId)"
396+
Write-Host "`t`t$message"
382397
} else {
383-
Write-Verbose "Excluded from rule by group membership. $($Email.ToString()) is in excluded Group $($groupObjectId)"
398+
Write-Verbose $message
384399
}
385400
break
386401
} else {
402+
$message = "$($Email.ToString()) is not excluded from rule by membership in Group $($groupObjectId)"
387403
if ($ShowDetailedExplanation) {
388-
Write-Host "`t`t$($Email.ToString()) is not excluded from rule by membership in Group $($groupObjectId)"
404+
Write-Host "`t`t$message"
389405
} else {
390-
Write-Verbose "$($Email.ToString()) is not excluded from rule by membership in Group $($groupObjectId)"
406+
Write-Verbose $message
391407
}
392408
break
393409
}
@@ -398,18 +414,20 @@ begin {
398414
$temp = $Email.Host
399415
while ($temp.IndexOf(".") -gt 0) {
400416
if ($temp -in $domainsIs) {
417+
$message = "Domain is in rule: $temp. Other conditions must match also."
401418
if ($ShowDetailedExplanation) {
402-
Write-Host "`t`tDomain is in rule: $temp. Other conditions must match also."
419+
Write-Host "`t`t$message"
403420
} else {
404-
Write-Verbose ("Domain is in rule: {0}. Other conditions must match also." -f $temp)
421+
Write-Verbose $message
405422
}
406423
$domainInRule = $true
407424
}
408425
if ($temp -in $exceptIfDomainsIs) {
426+
$message = "Excluded from rule by domain: $temp"
409427
if ($ShowDetailedExplanation) {
410-
Write-Host "`t`tExcluded from rule by domain: $temp"
428+
Write-Host "`t`t$message"
411429
} else {
412-
Write-Verbose "Excluded from rule by domain: $temp"
430+
Write-Verbose $message
413431
}
414432
$domainExceptionInRule = $true
415433
}
@@ -421,38 +439,46 @@ begin {
421439
if (((($emailInRule -or (-not $senderOrReceiver)) -and ($domainInRule -or (-not $domainsIs)) -and ($groupInRule -or (-not $memberOf))) -and
422440
($emailInRule -or $domainInRule -or $groupInRule)) -and
423441
((-not $emailExceptionInRule) -and (-not $groupExceptionInRule) -and (-not $domainExceptionInRule))) {
442+
$message = "Policy match found: `"$($rule.Name)`""
443+
$messageDetail = "Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}."
444+
$messageDetail2 = "Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}."
424445
if ($ShowDetailedExplanation) {
425-
Write-Host "`t`tPolicy match found: `"$($rule.Name)`""
426-
Write-Host ("`t`tIncluded in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}." -f $emailInRule, $groupInRule, $domainInRule)
427-
Write-Host ("`t`tExcluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}." -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
446+
Write-Host "`t`t$message"
447+
Write-Host ("`t`t$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
448+
Write-Host ("`t`t$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
428449
} else {
429-
Write-Verbose "Policy match found: `"$($rule.Name)`""
430-
Write-Verbose ("Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}." -f $emailInRule, $groupInRule, $domainInRule)
431-
Write-Verbose ("Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}." -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
450+
Write-Verbose $message
451+
Write-Verbose ("$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
452+
Write-Verbose ("$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
432453
}
433454
return $rule
434455
} else {
456+
$message = "The rule/policy does not explicitly include the recipient because not all User, Group, and Domain properties which have values include the recipient. `n`t`tDue to the AND operator between the User, Group, and Domain inclusion properties, if any of those properties have non-null values (they are not empty), the recipient must be included in that property."
457+
$messageDetail = "Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}."
458+
$messageDetail2 = "Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}."
435459
if ($ShowDetailedExplanation) {
436-
Write-Host "`t`tThe rule/policy does not explicitly include the recipient because not all User, Group, and Domain properties which have values include the recipient. Due to the AND operator between the User, Group, and Domain inclusion properties, if any of those properties have non-null values (they are not empty), the recipient must be included in that property."
437-
Write-Host ("`t`tIncluded in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}." -f $emailInRule, $groupInRule, $domainInRule)
438-
Write-Host ("`t`tExcluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}." -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
460+
Write-Host "`t`t$message"
461+
Write-Host ("`t`t$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
462+
Write-Host ("`t`t$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
439463
} else {
440-
Write-Verbose "The rule/policy does not explicitly include the recipient because not all User, Group, and Domain properties which have values include the recipient. Due to the AND operator between the User, Group, and Domain inclusion properties, if any of those properties have non-null values (they are not empty), the recipient must be included in that property."
441-
Write-Verbose ("Included in rule as User: {0}. Included in rule by Group membership: {1}. Included in rule by Domain: {2}." -f $emailInRule, $groupInRule, $domainInRule)
442-
Write-Verbose ("Excluded from rule as User: {0}. Excluded from rule by group membership: {1}. Excluded from rule by domain: {2}." -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
464+
Write-Verbose $message
465+
Write-Verbose ("$messageDetail" -f $emailInRule, $groupInRule, $domainInRule)
466+
Write-Verbose ("$messageDetail2" -f $emailExceptionInRule, $groupExceptionInRule, $domainExceptionInRule)
443467
}
444468
}
445469

446470
# Check for implicit inclusion (no mailboxes included at all), which is possible for Presets and SA/SL. They are included if not explicitly excluded. Only inbound
447471
if ((-not $Outbound) -and
448472
(((-not $senderOrReceiver) -and (-not $domainsIs) -and (-not $memberOf)) -and
449473
((-not $emailExceptionInRule) -and (-not $groupExceptionInRule) -and (-not $domainExceptionInRule)))) {
474+
$message = "The recipient is IMPLICITLY included. There are no recipients explicitly included in the policy, and the user is not explicitly excluded either in the User, Group, or Domain exclusion properties. `n`t`tImplicit inclusion is possible for Preset policies and Safe Attachments and Safe Links in which no explicit inclusions have been made."
475+
$messageDetail = "Rule of matching policy: `"$($rule.Name)`""
450476
if ($ShowDetailedExplanation) {
451-
Write-Host "`t`tThe recipient is IMPLICITLY included. There are no recipients explicitly included in the policy, and the user is not explicitly excluded either in the User, Group, or Domain exclusion properties. Implicit inclusion is possible for Preset policies and Safe Attachments and Safe Links in which no explicit inclusions have been made."
452-
Write-Host "`t`tRule of matching policy: `"$($rule.Name)`""
477+
Write-Host "`t`t$message"
478+
Write-Host "`t`t$messageDetail"
453479
} else {
454-
Write-Verbose "The recipient is IMPLICITLY included. There are no recipients explicitly included in the policy, and the user is not explicitly excluded either in the User, Group, or Domain exclusion properties. Implicit inclusion is possible for Preset policies and Safe Attachments and Safe Links in which no explicit inclusions have been made."
455-
Write-Verbose "Rule of matching policy: `"$($rule.Name)`""
480+
Write-Verbose $message
481+
Write-Verbose $messageDetail
456482
}
457483
return $rule
458484
}
@@ -785,7 +811,7 @@ process {
785811
$stEmailAddress = $email.ToString()
786812
# Initialize a variable to capture all policy details
787813
$allPolicyDetails = ""
788-
Write-Host "`n`nPolicies applied to $stEmailAddress..."
814+
Write-Host "`n`nPolicies applied to $stEmailAddress..." -ForegroundColor Yellow
789815

790816
if ( -not $OnlyMDOPolicies) {
791817
# Check the Strict EOP rules first as they have higher precedence

0 commit comments

Comments
 (0)