Beherrschen der PowerShell Graph API: Leicht verständliche Einblicke

# اسم المستأجر الخاص بك (يمكن أن يكون شيئًا أكثر وصفًا أيضًا)
$TenantName        = "contoso.onmicrosoft.com"

# حيث يتم تصدير الشهادة بدون المفتاح الخاص
$CerOutputPath     = "C:\Temp\PowerShellGraphCert.cer"

# المتجر الذي تريد أن تكون فيه
$StoreLocation     = "Cert:\CurrentUser\My"

# تاريخ انتهاء الصلاحية للشهادة الجديدة
$ExpirationDate    = (Get-Date).AddYears(2)


# رش متكتل لسهولة القراءة
$CreateCertificateSplat = @{
    FriendlyName      = "AzureApp"
    DnsName           = $TenantName
    CertStoreLocation = $StoreLocation
    NotAfter          = $ExpirationDate
    KeyExportPolicy   = "Exportable"
    KeySpec           = "Signature"
    Provider          = "Microsoft Enhanced RSA and AES Cryptographic Provider"
    HashAlgorithm     = "SHA256"
}

# إنشاء شهادة
$Certificate = New-SelfSignedCertificate @CreateCertificateSplat

# الحصول على مسار الشهادة
$CertificatePath = Join-Path -Path $StoreLocation -ChildPath $Certificate.Thumbprint

# تصدير الشهادة بدون المفتاح الخاص
Export-Certificate -Cert $CertificatePath -FilePath $CerOutputPath | Out-Null

# حدد AppId و secret و scope واسم المستأجر الخاص بك وعنوان URL لنقطة النهاية
$AppId = '2d10909e-0396-49f2-ba2f-854b77c1e45b'
$AppSecret = 'abcdefghijklmnopqrstuv12345'
$Scope = "https://graph.microsoft.com/.default"
$TenantName = "contoso.onmicrosoft.com"

$Url = "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token"

# أضف System.Web لترميز عناوين URL
Add-Type -AssemblyName System.Web

# قم بإنشاء الجسم
$Body = @{
    client_id = $AppId
	client_secret = $AppSecret
	scope = $Scope
	grant_type = 'client_credentials'
}

# انتشل المعلمات لـ Invoke-Restmethod للحصول على شيفرة نظيفة
$PostSplat = @{
    ContentType = 'application/x-www-form-urlencoded'
    Method = 'POST'
    # قم بإنشاء سلسلة عن طريق الانضمام إلى bodylist بواسطة '&'
    Body = $Body
    Uri = $Url
}

# اطلب الرمز!
$Request = Invoke-RestMethod @PostSplat

$TenantName = "<your tenant name>.onmicrosoft.com"
$AppId = "<your application id"
$Certificate = Get-Item Cert:\CurrentUser\My\<self signed and uploaded cert thumbprint>
$Scope = "https://graph.microsoft.com/.default"

# إنشاء تجزئة base64 للشهادة
$CertificateBase64Hash = [System.Convert]::ToBase64String($Certificate.GetCertHash())

# إنشاء الطابع الزمني JWT للانتهاء
$StartDate = (Get-Date "1970-01-01T00:00:00Z" ).ToUniversalTime()
$JWTExpirationTimeSpan = (New-TimeSpan -Start $StartDate -End (Get-Date).ToUniversalTime().AddMinutes(2)).TotalSeconds
$JWTExpiration = [math]::Round($JWTExpirationTimeSpan,0)

# إنشاء الطابع الزمني لبداية صلاحية JWT
$NotBeforeExpirationTimeSpan = (New-TimeSpan -Start $StartDate -End ((Get-Date).ToUniversalTime())).TotalSeconds
$NotBefore = [math]::Round($NotBeforeExpirationTimeSpan,0)

# إنشاء رأس JWT
$JWTHeader = @{
    alg = "RS256"
    typ = "JWT"
    # استخدام CertificateBase64Hash واستبدال / تجريد لمطابقة ترميز base64 للويب
    x5t = $CertificateBase64Hash -replace '\+','-' -replace '/','_' -replace '='
}

# إنشاء حمولة JWT
$JWTPayLoad = @{
    # أي الطرف المستهدف مسموح له باستخدام هذا JWT
    aud = "https://login.microsoftonline.com/$TenantName/oauth2/token"

    # الطابع الزمني للانتهاء
    exp = $JWTExpiration

    # المصدر = تطبيقك
    iss = $AppId

    # معرف JWT: معرف توجيه عشوائي
    jti = [guid]::NewGuid()

    # غير مراد استخدامه قبل
    nbf = $NotBefore

    # موضوع JWT
    sub = $AppId
}

# تحويل رأس وحمولة إلى base64
$JWTHeaderToByte = [System.Text.Encoding]::UTF8.GetBytes(($JWTHeader | ConvertTo-Json))
$EncodedHeader = [System.Convert]::ToBase64String($JWTHeaderToByte)

$JWTPayLoadToByte =  [System.Text.Encoding]::UTF8.GetBytes(($JWTPayload | ConvertTo-Json))
$EncodedPayload = [System.Convert]::ToBase64String($JWTPayLoadToByte)

# انضم إلى رأس و Payload بـ "." لإنشاء JWT صالح (غير موقع) 
$JWT = $EncodedHeader + "." + $EncodedPayload

# الحصول على كائن المفتاح الخاص لشهادتك
$PrivateKey = $Certificate.PrivateKey

# تعريف توقيع RSA وخوارزمية التجزئة
$RSAPadding = [Security.Cryptography.RSASignaturePadding]::Pkcs1
$HashAlgorithm = [Security.Cryptography.HashAlgorithmName]::SHA256

# إنشاء توقيع لـ JWT
$Signature = [Convert]::ToBase64String(
    $PrivateKey.SignData([System.Text.Encoding]::UTF8.GetBytes($JWT),$HashAlgorithm,$RSAPadding)
) -replace '\+','-' -replace '/','_' -replace '='

# انضمام التوقيع إلى JWT بـ "."
$JWT = $JWT + "." + $Signature

# إنشاء تجزئة مع معلمات الجسم
$Body = @{
    client_id = $AppId
    client_assertion = $JWT
    client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
    scope = $Scope
    grant_type = "client_credentials"

}

$Url = "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token"

# استخدام JWT المولدة ذاتيًا كترخيص
$Header = @{
    Authorization = "Bearer $JWT"
}

# فرز المعلمات لـ Invoke-Restmethod للحصول على كود نظيف أكثر
$PostSplat = @{
    ContentType = 'application/x-www-form-urlencoded'
    Method = 'POST'
    Body = $Body
    Uri = $Url
    Headers = $Header
}

$Request = Invoke-RestMethod @PostSplat

# إنشاء رأس
$Header = @{
    Authorization = "$($Request.token_type) $($Request.access_token)"
}

$Uri = "https://graph.microsoft.com/v1.0/security/alerts"

# جلب جميع التنبيهات الأمانية
$SecurityAlertsRequest = Invoke-RestMethod -Uri $Uri -Headers $Header -Method Get -ContentType "application/json"

$SecurityAlerts = $SecurityAlertsRequest.Value

$SecurityAlerts | select eventDateTime,Title

eventDateTime                title
-------------                -----
2019-08-05T17:59:47.6271981Z Atypical travel
2019-08-05T08:23:01.7325708Z Anonymous IP address
2019-08-05T08:23:55.5000456Z Anonymous IP address
2019-08-04T22:06:51.063797Z  Anonymous IP address
2019-08-04T21:56:10.981437Z  Anonymous IP address
2019-08-08T09:30:00Z         Creation of forwarding/redirect rule
2019-07-19T13:30:00Z         eDiscovery search started or exported
2019-07-19T08:00:00Z         eDiscovery search started or exported

"id":  "censored",
    "azureTenantId":  "censored",
    "azureSubscriptionId":  "censored",
    "riskScore":  null,
    "tags":  [

             ],
    "activityGroupName":  null,
    "assignedTo":  null,
    "category":  "AnonymousLogin",
    "closedDateTime":  null,
    "comments":  [

                 ],
    "confidence":  null,
    "createdDateTime":  "2019-08-08T09:46:59.65722253Z",
    "description":  "Sign-in from an anonymous IP address (e.g. Tor browser, anonymizer VPNs)",
    "detectionIds":  [

                     ],
    "eventDateTime":  "2019-08-08T09:46:59.65722253Z",
    "feedback":  null,
    "lastModifiedDateTime":  "2019-08-08T09:54:30.7256251Z",
    "recommendedActions":  [

                           ],
    "severity":  "medium",
    "sourceMaterials":  [

                        ],
    "status":  "newAlert",
    "title":  "Anonymous IP address",
    "vendorInformation":  {
                              "provider":  "IPC",
                              "providerVersion":  null,
                              "subProvider":  null,
                              "vendor":  "Microsoft"
                          },
    "cloudAppStates":  [

                       ],
    "fileStates":  [

                   ],
    "hostStates":  [

                   ],
    "historyStates":  [

                      ],
    "malwareStates":  [

                      ],
    "networkConnections":  [

                           ],
    "processes":  [

                  ],
    "registryKeyStates":  [

                          ],
    "triggers":  [

                 ],
    "userStates":  [
                       {
                           "aadUserId":  "censored",
                           "accountName":  "john.doe",
                           "domainName":  "contoso.com",
                           "emailRole":  "unknown",
                           "isVpn":  null,
                           "logonDateTime":  "2019-08-08T09:45:59.6174156Z",
                           "logonId":  null,
                           "logonIp":  "censored",
                           "logonLocation":  "Denver, Colorado, US",
                           "logonType":  null,
                           "onPremisesSecurityIdentifier":  null,
                           "riskScore":  null,
                           "userAccountType":  null,
                           "userPrincipalName":  "[email protected]"
                       }
                   ],
    "vulnerabilityStates":  [

                            ]
}

$Uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns"

# جلب جميع تنبيهات الأمان
$AuditLogRequest = Invoke-RestMethod -Uri $Uri -Headers $Header -Method Get -ContentType "application/json"

$AuditLogs = @()
$AuditLogs+=$AuditLogRequest.value

while($AuditLogRequest.'@odata.nextLink' -ne $null) {
    $AuditLogRequest += Invoke-RestMethod -Uri $AuditLogRequest.'@odata.nextLink' -Headers $Header -Method Get -ContentType "application/json"
}