EntraTripwire

2.0.0

Detects an intruder who is already inside a Microsoft Entra ID tenant. Plants decoy users, application registrations and client secrets that no legitimate process should ever touch, watches the Microsoft Graph sign-in and directory audit logs for contact with them, and scores every touch through a calibrated false-positive suppression engine before it reaches a human,
Detects an intruder who is already inside a Microsoft Entra ID tenant. Plants decoy users, application registrations and client secrets that no legitimate process should ever touch, watches the Microsoft Graph sign-in and directory audit logs for contact with them, and scores every touch through a calibrated false-positive suppression engine before it reaches a human, so a deception deployment does not page its operator into switching it off. Answers "is someone in here right now?", which is a different question from "how could someone get in". Runs with no dependency and no tenant in DEMO mode against fixtures shipped inside the module; Microsoft.Graph.Authentication is loaded lazily and is only needed to connect a real tenant. Optional containment is dry-run by default, requires a High and non-degraded confidence band, and never acts on a signal it could not fully evaluate.
Show more

Minimum PowerShell version

7.2

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name EntraTripwire

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name EntraTripwire

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Eduard Arbona. Released under the MIT licence.

Package Details

Author(s)

  • Eduard Arbona

Tags

Entra EntraID AzureAD MicrosoftGraph Microsoft365 Security Deception Honeytoken Honeypot ThreatDetection DetectionEngineering IncidentResponse BlueTeam Windows Linux

Functions

Connect-EntraTripwire Disconnect-EntraTripwire Enable-TripwirePro Export-TripwireReport Get-TripwireBaseline Get-TripwireDecoy Get-TripwireLicense Get-TripwirePolicy Get-TripwireSummary Invoke-TripwireAnalysis Invoke-TripwireContainment Measure-TripwireConfidence New-TripwireDecoy Remove-TripwireDecoy Start-EntraTripwire Test-TripwireReadiness Watch-TripwireActivity

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

1.0.0 - First release. Decoy planting (users, application registrations, client secrets), detection across the sign-in and directory audit logs, the four-signal confidence engine with suppression and withheld-signal tracking, tenant baselining with impossible-travel detection, the containment plan, the self-contained HTML report, and DEMO mode against shipped fixtures. Full history: https://github.com/earbona23/entra-tripwire/blob/main/CHANGELOG.md

FileList

Version History

Version Downloads Last updated
2.0.0 (current version) 7 10/25/2026
1.0.0 13 10/18/2026