Private/Collect/Get-PpaAudit.ps1
|
# Get-PpaAudit.ps1 - collector for section 05 (Audit). # Reads Get-AdminAuditLogConfig (UnifiedAuditLogIngestionEnabled) and Get-OrganizationConfig # (AuditDisabled - the org-level mailbox auditing override, AUD-04) - both read-only # (Exchange Online). ASCII-only source. Depends on Invoke-PpaReadCmdlet.ps1. Set-StrictMode -Off function Get-PpaAudit { [CmdletBinding()] param() $rawAudit = Invoke-PpaReadCmdlet -Name 'Get-AdminAuditLogConfig' $rawOrg = Invoke-PpaReadCmdlet -Name 'Get-OrganizationConfig' $enabled = $null if ($rawAudit.Status -eq 'Ok' -and @($rawAudit.Data).Count -gt 0) { $enabled = [bool]($rawAudit.Data[0].UnifiedAuditLogIngestionEnabled) } # AUD-04: $null means "not read this session" (failed org read OR the property is # absent from the returned object) - distinct from $false, so the analyzer can # degrade to Verify manually instead of guessing a boolean. $mbxAuditDisabled = $null if ($rawOrg.Status -eq 'Ok' -and @($rawOrg.Data).Count -gt 0) { $org = $rawOrg.Data[0] if ($org.PSObject.Properties.Name -contains 'AuditDisabled' -and $null -ne $org.AuditDisabled) { $mbxAuditDisabled = [bool]$org.AuditDisabled } } # Both reads govern the outcome: orgStatus is part of the normalized output, so a # failed org read is honestly reported as Partial visibility. return [pscustomobject]@{ outcome = Resolve-PpaCollectorOutcome -ReadStatuses @($rawAudit.Status, $rawOrg.Status) -ItemCount (@($rawAudit.Data).Count) status = $rawAudit.Status error = $rawAudit.Error unifiedAuditEnabled = $enabled orgStatus = $rawOrg.Status mailboxAuditingDisabled = $mbxAuditDisabled } } |