Quick Start: Audit Logging - Week 3

<# .SYNOPSIS Quick Start: Audit Logging .DESCRIPTION Enables and configures Unified Audit Log voor compliance monitoring. VOLLEDIG GEAUTOMATISEERD. ENABLES: - Unified Audit Log ingestion - Mailbox auditing (all mailboxes) - Azure AD audit logs - Exchange admin audit logging - SharePoint audit logging .NOTES Filename: 06-audit-logging.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-10-16 Related JSON: content/quick-start/06-audit-logging.json CIS: 3.1.1 Priority: Week 2 #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement, Microsoft.Graph.Identity.DirectoryManagement [CmdletBinding()] param( [Parameter(HelpMessage = "Monitor audit logging status")] [switch]$Monitoring, [Parameter(HelpMessage = "Enable Unified Audit Log")] [switch]$Remediation, [Parameter(HelpMessage = "Full implementation (UAL + Mailbox + SharePoint)")] [switch]$Implementation, [Parameter(HelpMessage = "Preview changes")] [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Quick Start: Audit Logging" -ForegroundColor Cyan Write-Host "WEEK 2 - CIS 3.1.1" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Test-Compliance { [CmdletBinding()] param() $result = Invoke-Monitoring return $result.isCompliant } function Invoke-Revert { Write-Host "`nReverting configuration for: $PolicyName..." -ForegroundColor Cyan # Revert implementation Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`n[OK] Revert completed" -ForegroundColor Green } function Invoke-Monitoring { <# .SYNOPSIS Monitors audit logging configuration #> [CmdletBinding()] param() try { Write-Host "`nMonitoring:" -ForegroundColor Yellow $result = @{ isCompliant = $false timestamp = Get-Date unifiedAuditEnabled = $false mailboxAuditEnabled = 0 totalMailboxes = 0 recentAuditEntries = 0 azureADLogsEnabled = $false } # Check Unified Audit Log Write-Host "Checking Unified Audit Log..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false $auditConfig = Get-AdminAuditLogConfig $result.unifiedAuditEnabled = $auditConfig.UnifiedAuditLogIngestionEnabled if ($result.unifiedAuditEnabled) { Write-Host " [OK] Unified Audit Log: ENABLED" -ForegroundColor Green # Test recent entries try { $testSearch = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 10 if ($testSearch) { $result.recentAuditEntries = $testSearch.Count Write-Host " Recent entries (24h): $($testSearch.Count)" -ForegroundColor Gray } } catch { Write-Host " ⚠️ Could not test recent entries" -ForegroundColor Yellow } } else { Write-Host " [FAIL] Unified Audit Log: DISABLED" -ForegroundColor Red } # Check mailbox auditing Write-Host "`nChecking mailbox auditing..." -ForegroundColor Gray $mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties AuditEnabled $result.totalMailboxes = $mailboxes.Count $result.mailboxAuditEnabled = ($mailboxes | Where-Object { $_.AuditEnabled -eq $true }).Count if ($result.mailboxAuditEnabled -eq $result.totalMailboxes) { Write-Host " [OK] Mailbox auditing: $($result.mailboxAuditEnabled)/$($result.totalMailboxes) enabled" -ForegroundColor Green } else { Write-Host " ⚠️ Mailbox auditing: $($result.mailboxAuditEnabled)/$($result.totalMailboxes) enabled" -ForegroundColor Yellow } # Check Azure AD diagnostic settings Write-Host "`nChecking Azure AD audit logs..." -ForegroundColor Gray try { Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome $diagnosticSettings = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?`$top=1" if ($diagnosticSettings) { $result.azureADLogsEnabled = $true Write-Host " [OK] Azure AD audit logs: Available" -ForegroundColor Green } } catch { Write-Host " ⚠️ Azure AD audit logs: Could not verify" -ForegroundColor Yellow } # Determine compliance if ($result.unifiedAuditEnabled -and $result.mailboxAuditEnabled -gt 0) { $result.isCompliant = $true } # Summary Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "SUMMARY:" -ForegroundColor Cyan Write-Host " Unified Audit Log: $(if ($result.unifiedAuditEnabled) { 'ENABLED [OK]' } else { 'DISABLED [FAIL]' })" -ForegroundColor $(if ($result.unifiedAuditEnabled) { 'Green' } else { 'Red' }) Write-Host " Mailbox Auditing: $($result.mailboxAuditEnabled)/$($result.totalMailboxes)" -ForegroundColor $(if ($result.mailboxAuditEnabled -eq $result.totalMailboxes) { 'Green' } else { 'Yellow' }) Write-Host " Recent Entries (24h): $($result.recentAuditEntries)" -ForegroundColor White Write-Host " Azure AD Logs: $(if ($result.azureADLogsEnabled) { 'Available [OK]' } else { 'Unknown' })" -ForegroundColor $(if ($result.azureADLogsEnabled) { 'Green' } else { 'Gray' }) if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green } else { Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red } return $result } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } function Invoke-Remediation { <# .SYNOPSIS Enables Unified Audit Log #> [CmdletBinding(SupportsShouldProcess)] param() try { Write-Host "`nRemediation:" -ForegroundColor Yellow Connect-ExchangeOnline -ShowBanner:$false Write-Host "Enabling Unified Audit Log..." -ForegroundColor Gray if ($PSCmdlet.ShouldProcess("Unified Audit Log", "Enable")) { Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true Write-Host " [OK] Unified Audit Log enabled" -ForegroundColor Green Write-Host " Note: Takes up to 24 hours to fully propagate" -ForegroundColor Yellow } Write-Host "`n[OK] Remediation completed" -ForegroundColor Green } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } function Invoke-Implementation { <# .SYNOPSIS Full implementation: UAL + Mailbox Audit + Azure AD logging #> [CmdletBinding(SupportsShouldProcess)] param() try { Write-Host "`nImplementation: COMPLETE Audit Logging Setup..." -ForegroundColor Yellow Connect-ExchangeOnline -ShowBanner:$false # STEP 1: Enable Unified Audit Log Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 1: Enable Unified Audit Log" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("UAL", "Enable")) { Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true Write-Host " [OK] Unified Audit Log enabled" -ForegroundColor Green } # STEP 2: Enable mailbox auditing for all mailboxes Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 2: Enable Mailbox Auditing" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host " Enabling mailbox audit by default..." -ForegroundColor Gray if ($PSCmdlet.ShouldProcess("Organization Config", "Enable mailbox audit by default")) { # Enable org-wide mailbox auditing Set-OrganizationConfig -AuditDisabled $false Write-Host " [OK] Organization-wide mailbox auditing enabled" -ForegroundColor Green # Enable for existing mailboxes that don't have it Write-Host " Checking individual mailboxes..." -ForegroundColor Gray $mailboxes = Get-EXOMailbox -ResultSize Unlimited -Properties AuditEnabled | Where-Object { $_.AuditEnabled -eq $false } if ($mailboxes) { Write-Host " Found $($mailboxes.Count) mailboxes with auditing disabled" -ForegroundColor Yellow Write-Host " Enabling auditing (this may take a while)..." -ForegroundColor Gray $count = 0 foreach ($mailbox in $mailboxes) { try { Set-Mailbox -Identity $mailbox.UserPrincipalName -AuditEnabled $true -ErrorAction SilentlyContinue $count++ if ($count % 10 -eq 0) { Write-Host " Progress: $count/$($mailboxes.Count)" -ForegroundColor Gray } } catch { Write-Host " ⚠️ Failed for $($mailbox.UserPrincipalName)" -ForegroundColor Yellow } } Write-Host " [OK] Enabled auditing for $count mailboxes" -ForegroundColor Green } else { Write-Host " [OK] All mailboxes already have auditing enabled" -ForegroundColor Green } } # STEP 3: Enable SharePoint auditing Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 3: Enable SharePoint Audit Log" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("SharePoint", "Enable audit log")) { try { # SharePoint auditing is enabled via organization config Write-Host " SharePoint auditing is controlled by Unified Audit Log" -ForegroundColor Gray Write-Host " [OK] SharePoint auditing enabled (via UAL)" -ForegroundColor Green } catch { Write-Host " ⚠️ Could not verify SharePoint auditing" -ForegroundColor Yellow } } # STEP 4: Configure admin audit log settings Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "STEP 4: Configure Admin Audit Log Settings" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan if ($PSCmdlet.ShouldProcess("Admin Audit Log", "Configure")) { # Set admin audit log age limit to maximum (90 days by default, extendable with E5) Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -LogLevel Verbose Write-Host " [OK] Admin audit log: Enabled (Verbose mode)" -ForegroundColor Green } Write-Host "`n========================================" -ForegroundColor Green Write-Host "[OK] IMPLEMENTATION COMPLETED!" -ForegroundColor Green Write-Host "========================================" -ForegroundColor Green Write-Host "`nEnabled:" -ForegroundColor Cyan Write-Host " [OK] Unified Audit Log ingestion" -ForegroundColor White Write-Host " [OK] Organization-wide mailbox auditing" -ForegroundColor White Write-Host " [OK] SharePoint audit logging" -ForegroundColor White Write-Host " [OK] Admin audit log (Verbose)" -ForegroundColor White Write-Host "`nNext steps:" -ForegroundColor Yellow Write-Host " 1. Wait 24h for full propagation" -ForegroundColor White Write-Host " 2. Test: Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date)" -ForegroundColor Gray Write-Host " 3. Configure retention policy (90 days default, up to 10 years with E5)" -ForegroundColor White Write-Host " 4. Set up SIEM integration if required" -ForegroundColor White } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red throw } } # MAIN EXECUTION try { if ($Implementation) { if ($WhatIf) { Write-Host "WhatIf: Would enable all audit logging" -ForegroundColor Yellow } else { Invoke-Implementation } } elseif ($Remediation) { if ($WhatIf) { Write-Host "WhatIf: Would enable Unified Audit Log" -ForegroundColor Yellow } else { Invoke-Remediation } } elseif ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result.isCompliant) { 0 } else { 1 }) } else { Write-Host "Available parameters:" -ForegroundColor Yellow Write-Host " -Monitoring : Check audit logging status" -ForegroundColor Gray Write-Host " -Remediation : Enable Unified Audit Log" -ForegroundColor Gray Write-Host " -Implementation : Full setup (UAL + Mailbox + SharePoint)" -ForegroundColor Gray Write-Host " -WhatIf : Preview changes" -ForegroundColor Gray } } catch { Write-Error "Script execution failed: $_" exit 2 } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }