Audit Avancé Microsoft 365 - Guide Pratique Cybersecurite

# Framework de corrélation multi-sources

class M365LogCorrelator {
    [hashtable]$EventSources
    [hashtable]$CorrelationRules
    [int]$TimeWindowMinutes

    M365LogCorrelator([int]$timeWindow = 30) {
        $this.TimeWindowMinutes = $timeWindow
        $this.EventSources = @{}
        $this.InitializeCorrelationRules()
    }

    [void] InitializeCorrelationRules() {
        $this.CorrelationRules = @{
            "SuspiciousLogin" = @{
                PrimaryEvent = @{
                    Source = "AzureAD"
                    EventType = "SignIn"
                    Conditions = @("RiskLevel -ne 'none'", "Status.ErrorCode -eq 0")
                }
                CorrelatedEvents = @(
                    @{
                        Source = "Exchange"
                        EventType = "MailboxLogin"
                        TimeWindow = 10
                        Conditions = @("same IP", "same user")
                    },
                    @{
                        Source = "SharePoint"
                        EventType = "FileDownloaded"
                        TimeWindow = 60
                        Conditions = @("same user", "volume > 100MB")
                    }
                )
            }
            "DataExfiltration" = @{
                PrimaryEvent = @{
                    Source = "SharePoint"
                    EventType = "FileDownloaded"
                    Conditions = @("FileSize -gt 10MB")
                }
                CorrelatedEvents = @(
                    @{
                        Source = "Exchange"
                        EventType = "Send"
                        TimeWindow = 30
                        Conditions = @("same user", "external recipient")
                    }
                )
            }
        }
    }

    [PSObject[]] CorrelateEvents([hashtable]$events, [string]$ruleName) {
        $rule = $this.CorrelationRules[$ruleName]
        $correlatedIncidents = @()

        # Récupérer les événements primaires
        $primaryEvents = $events[$rule.PrimaryEvent.Source] | Where-Object {
            $this.EvaluateConditions($_, $rule.PrimaryEvent.Conditions)
        }

        foreach ($primaryEvent in $primaryEvents) {
            $incident = [PSCustomObject]@{
                PrimaryEvent = $primaryEvent
                CorrelatedEvents = @()
                RiskScore = 1
                Timeline = @($primaryEvent)
            }

            # Rechercher les événements corrélés
            foreach ($correlationRule in $rule.CorrelatedEvents) {
                $timeStart = $primaryEvent.Timestamp.AddMinutes(-$correlationRule.TimeWindow)
                $timeEnd = $primaryEvent.Timestamp.AddMinutes($correlationRule.TimeWindow)

                $correlatedEvents = $events[$correlationRule.Source] | Where-Object {
                    $_.Timestamp -ge $timeStart -and $_.Timestamp -le $timeEnd -and
                    $this.EvaluateCorrelationConditions($_, $primaryEvent, $correlationRule.Conditions)
                }

                if ($correlatedEvents) {
                    $incident.CorrelatedEvents += $correlatedEvents
                    $incident.RiskScore += $correlatedEvents.Count
                    $incident.Timeline += $correlatedEvents
                }
            }

            # Trier la timeline
            $incident.Timeline = $incident.Timeline | Sort-Object Timestamp

            if ($incident.CorrelatedEvents.Count -gt 0) {
                $correlatedIncidents += $incident
            }
        }

        return $correlatedIncidents | Sort-Object RiskScore -Descending
    }

    [bool] EvaluateConditions([PSObject]$event, [string[]]$conditions) {
        foreach ($condition in $conditions) {
            if (-not (Invoke-Expression "`$event.$condition")) {
                return $false
            }
        }
        return $true
    }

    [bool] EvaluateCorrelationConditions([PSObject]$event, [PSObject]$primaryEvent, [string[]]$conditions) {
        foreach ($condition in $conditions) {
            switch ($condition) {
                "same IP" { if ($event.ClientIP -ne $primaryEvent.ClientIP) { return $false } }
                "same user" { if ($event.UserId -ne $primaryEvent.UserId) { return $false } }
                "external recipient" { if ($event.Recipients -notmatch "@(?!contoso\.com)") { return $false } }
                "volume > 100MB" { if (($event.FileSize / 1MB) -le 100) { return $false } }
            }
        }
        return $true
    }
}