Preserve the audit log Preserving the unified audit log with the Microsoft Graph Audit Search API and the export_ual PowerShell script from github.com/royallan/export_ual. We sign in with MFA, export every record for Eli in the incident window, and get records.jsonl as primary evidence, records.csv as a sorted timeline, a manifest with the query and any gaps, and SHA-256 hashes. Then we verify the hashes and look for the inbox rule, mail access and sends in the timeline. W INVESTIGATION AND RESPONSE Preserve the audit log Ada Admin Eli Employee PRESERVE FIRST Export the log before it expires The audit log keeps 180 days with Audit Standard. An export keepsthe evidence for as long as the case needs it. export_ual uses the Graph Audit Search API. It pages through everyrecord and splits long periods into chunks. github.com/royallan/export_ual PowerShell 7. Interactive sign-in with MFA, or app-only with a certificate. BEFORE YOU RUN IT What you need PowerShell 7 (pwsh)Not Windows PowerShell 5.1. The script stops on older versions. Microsoft.Graph.AuthenticationInstall-Module Microsoft.Graph.Authentication -Scope CurrentUser Read access to the audit logThe View-Only Audit Logs or Audit Logs role, for example through the Audit Reader role group. Graph scope AuditLogsQuery.Read.AllAdmin consent may be needed the first time. Per-workload scopes also exist. ▣ PowerShell 7 Microsoft ada.admin@contoso.onmicrosoft.com Approve sign in request Open your Authenticator app, and enter thenumber shown to sign in. 47 ✓ Approved in Authenticator Microsoft ada.admin@contoso.onmicrosoft.com Sign in to all apps and websiteson this device? Yes lets your work account sign in to other apps on thisdevice, and registers the device with your organization. Consider No, this app only if you share this device. No, this app only Yes WHY TWO PROMPTS? 1 Windows asks to remember the account 2 Entra ID asks for MFA records.csv · Excel · filtered on operation createdDateTime (UTC)userPrincipalNameoperationserviceclientIpauditData Read the timeline in the CSV. Quote the JSONL. The auditData column holds the full record, with rule parameters, user agent and session ID. Good to know 1/7 INVESTIGATION AND RESPONSE Preserve the audit log We export every audit record for Eli in the incident window with the Graph Audit Search API, check what the files hold, verify the hashes, and find the inbox rule in the timeline. informasjonsbeskyttelse.no