{"id":29043,"date":"2023-05-29T06:04:06","date_gmt":"2023-05-29T06:04:06","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=29043"},"modified":"2023-05-29T06:04:12","modified_gmt":"2023-05-29T06:04:12","slug":"reportly","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/reportly\/","title":{"rendered":"Reportly : An AzureAD User Activity Report Tool"},"content":{"rendered":"\n

Reportly <\/strong>is an AzureAD user activity report tool.<\/p>\n\n\n\n

<\/a><\/h1>\n\n\n\n

About the tool<\/h2>\n\n\n\n

This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following:<\/p>\n\n\n\n

    \n
  1. Information about the user<\/li>\n\n\n\n
  2. Actions taken by the user<\/li>\n\n\n\n
  3. Actions taken on the user<\/li>\n\n\n\n
  4. User login and failure logs<\/li>\n<\/ol>\n\n\n\n

    Example_video<\/strong><\/p>\n\n\n\n

    Usage<\/h2>\n\n\n\n

    When running the tool, a link to authentication and a device code will show, follow the link and enter the code to authenticate. <\/a><\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Insert User principal name of a suspicious user.
    Insert start and end times in the following format: 2022-11-16
    I recommend a range of no longer then a week.<\/strong><\/p>\n\n\n\n

    After authentication, in order to create a full report choose the option “5” <\/a><\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    When the report will be ready the tool will print “Your report is ready!”. The reports are created in the executable’s directory.<\/p>\n\n\n\n

    <\/a><\/h1>\n\n\n\n

    Installation<\/h2>\n\n\n\n

    In order to use the tool you will need an AzureAD application with the following delegated<\/strong> microsoft graph api permissions:<\/p>\n\n\n\n