{"id":28482858,"url":"https://github.com/azuread/azure-ad-incident-response-powershell-module","last_synced_at":"2025-06-28T01:31:33.707Z","repository":{"id":41078581,"uuid":"377864354","full_name":"AzureAD/Azure-AD-Incident-Response-PowerShell-Module","owner":"AzureAD","description":"The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.","archived":false,"fork":false,"pushed_at":"2023-06-16T12:51:47.000Z","size":127,"stargazers_count":435,"open_issues_count":3,"forks_count":48,"subscribers_count":22,"default_branch":"main","last_synced_at":"2025-06-07T21:02:54.966Z","etag":null,"topics":["azuread","incident-response","powershell","powershell-module"],"latest_commit_sha":null,"homepage":"https://www.powershellgallery.com/packages/AzureADIncidentResponse/","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AzureAD.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-06-17T14:44:50.000Z","updated_at":"2025-05-20T22:38:00.000Z","dependencies_parsed_at":"2024-06-13T21:06:58.573Z","dependency_job_id":null,"html_url":"https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/AzureAD/Azure-AD-Incident-Response-PowerShell-Module","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AzureAD%2FAzure-AD-Incident-Response-PowerShell-Module","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AzureAD%2FAzure-AD-Incident-Response-PowerShell-Module/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AzureAD%2FAzure-AD-Incident-Response-PowerShell-Module/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AzureAD%2FAzure-AD-Incident-Response-PowerShell-Module/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AzureAD","download_url":"https://codeload.github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AzureAD%2FAzure-AD-Incident-Response-PowerShell-Module/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262361136,"owners_count":23299041,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azuread","incident-response","powershell","powershell-module"],"created_at":"2025-06-07T21:02:55.377Z","updated_at":"2025-06-28T01:31:33.702Z","avatar_url":"https://github.com/AzureAD.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure AD Incident Response PowerShell Module\n\n[![PSGallery Version](https://img.shields.io/powershellgallery/v/AzureADIncidentResponse.svg?style=flat\u0026logo=powershell\u0026label=PSGallery%20Version)](https://www.powershellgallery.com/packages/AzureADIncidentResponse) \n[![PSGallery Downloads](https://img.shields.io/powershellgallery/dt/AzureADIncidentResponse.svg?style=flat\u0026logo=powershell\u0026label=PSGallery%20Downloads)](https://www.powershellgallery.com/packages/AzureADIncidentResponse)\n\nThe Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.\n \n \n## Why use the module?\n \nThe module meets these development goals:\n \n  * Provide tooling that is quick and easy to install and use:\n      * Complex configuration steps are not desirable in a compromise situation \n      * Detailed help and examples are included as fundamentals\n  * Provide cmdlets that robustly get you the data you need:\n    * Combine IR specific data from a number of sources\n    * Give inbuilt options for displaying or capturing results\n    * Pagination and retry logic as default\n  * Make the module a community project for ongoing improvement\n  * Help bridge the gap between on-premises and cloud environments and knowledge\n    * Cmdlets to make connections and correlations\n    * Provide familiarity for those unfamiliar with cloud automation\n  * Security Operations Centre (SOC) friendly\n \n \n## How do I install the module?\n \nThe module can be found here:\n \n  https://www.powershellgallery.com/packages/AzureADIncidentResponse\n \n \nPlease use the latest version. The module has a number of prerequisites that will be automatically installed:\n \n  * MSAL.ps PowerShell module\n  * AzureAD PowerShell module\n  * MSOnline PowerShell module\n \nFrom within PowerShell you need to run:\n```PowerShell \n  Install-Module -Name AzureADIncidentResponse -AcceptLicense\n```\n\n  `Tip: you may need to trust the PowerShell gallery repository for this action to complete successfully.`\n\n \nIf you encounter an install issue with one of the dependent modules, MSAL.ps, see here for remediation steps:\n \n  https://github.com/AzureAD/MSAL.PS/blob/master/README.md#install-from-the-powershell-gallery\n \n \n`NB - one of the cmdlets in the module, Get-AzureADIRPrivilegedUserOnPremCorrelation, makes use of the Windows Server Active Directory module. If you wish to use that cmdlet, then the AzureADIncidentResponse module will need to be installed on a domain joined Windows Server, with connectivity to the internet. The domain will typically be the one in which the Azure AD connect server is installed. The ActiveDirectory PowerShell module will also need to be installed on the target server.` \n\n\n## Contributing\n\nThis project welcomes contributions and suggestions.  Most contributions require you to agree to a\nContributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us\nthe rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.\n\nWhen you submit a pull request, a CLA bot will automatically determine whether you need to provide\na CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions\nprovided by the bot. You will only need to do this once across all repos using our CLA.\n\nThis project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).\nFor more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or\ncontact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.\n\n\n## Trademarks\n\nThis project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft \ntrademarks or logos is subject to and must follow \n[Microsoft's Trademark \u0026 Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).\nUse of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.\nAny use of third-party trademarks or logos are subject to those third-party's policies.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fazuread%2Fazure-ad-incident-response-powershell-module","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fazuread%2Fazure-ad-incident-response-powershell-module","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fazuread%2Fazure-ad-incident-response-powershell-module/lists"}