Public/CP_Common.ps1
|
# New-CP365Setup function New-CP365PhishSimSetup { [CmdletBinding( SupportsShouldProcess = $true, ConfirmImpact = 'Medium' )] param() begin { if (!(Test-SC365ConnectionStatus)) { throw [System.Exception] "You're not connected to Exchange Online - please connect prior to using this CmdLet" } #TODO: Change of Erroraction due to a bug in the ExoPhishSimOverride CmdLets $oldErrorAction = $ErrorActionPreference $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Continue Write-verbose "Reading Phishing Simulation Configuration from module ./ExoConfig/CloudCOnfig/PhishSim.json" $param = Get-CP365PhishSimConfig Write-Verbose "Phishing Simulation Configuration read successfully, see $param" $name = $param.name $comment = $param.comment $iPs = $param.PhishSim.IPs.IPv4AllowList $domains = $param.PhishSim.domains.AllowedDomains $simURLs = $param.PhishSim.SimURLs.SimURLs } process { Write-Verbose "Processing Phishing Simulation Setup" try { $PhishSimRule = Get-ExoPhishSimOverrideRule } catch { Write-Warning "As of Oktober 2026 this CmdLet will fail due to a bug on the underlying Microsoft CmdLet, as long as the list of allowed domains and IP addresses is empty!" Write-Warning "To avoid this error go to the M365 Portal Security --> Policies & Rules --> Thread Protection Rules -->Enhanced Delivery --> Phishing Simulation and add a random domain and a random IP address like 'none.net' and '127.0.0.1'" break } $PhishSimRuleID = $PhishSimRule.Identity if ($PhishSimRuleID) { $SetPhishSimOverrideParam = @{ Adddomains = $domains AddsenderIpRanges = $iPs Comment = $comment } Set-ExoPhishSimOverrideRule -Identity $PhishSimRuleID @SetPhishSimOverrideParam } else { $NewPhishSimOverrideParam = @{ Domains = $domains SenderIpRanges = $iPs Comment = $comment Name = 'Cyberpilot' Policy = 'Cyberpilot' } New-ExoPhishSimOverrideRule -Name $name @NewPhishSimOverrideParam } $TenantAllowBlockListItems = @{ Allow = $true Listtype = 'URL' ListSubType = 'AdvancedDelivery' Entries = $simURLs } #TODO: Read existing value and change just if not already present $ExistingTenantAllowBlockListItems = Get-TenantAllowBlockListItems -ListType URL -ListSubTypeAdvancedDelivery if ($ExistingTenantAllowBlockListItems.Value -eq $simURLs) { Write-Warning "Tenant Allow Block List Items $simUrls already exist" } else { Write-Verbose "Tenant Allow Block List Items $simUrls do not exist, creating them now" New-TenantAllowBlockListItems @TenantAllowBlockListItems } } end { $ErrorActionPreference = $oldErrorAction } } # Get-CP365PhishSimSetup # Remove-CP365PhishSimSetup <# .SYNOPSIS Removes the configured Cyberpilot phishing simulation settings. .DESCRIPTION Removes matching domains, sender IP ranges and Advanced Delivery URLs from the phishing simulation configuration. Unrelated entries and the inbound connector are preserved. Rules with no remaining entries are removed. Matching entries are removed even if they existed before setup. .EXAMPLE Remove-CP365Setup -WhatIf .EXAMPLE Remove-CP365Setup -Confirm #> function Remove-CP365PhishSimSetup { [CmdletBinding( SupportsShouldProcess = $true, ConfirmImpact = 'Medium' )] param() begin { if (!(Test-SC365ConnectionStatus)) { throw [System.Exception] "You're not connected to Exchange Online - please connect prior to using this CmdLet" } #TODO: Change of Erroraction due to a bug in the ExoPhishSimOverride CmdLets $oldErrorAction = $ErrorActionPreference $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Continue $param = Get-CP365PhishSimConfig $iPs = $param.PhishSim.IPs.IPv4AllowList $domains = $param.PhishSim.domains.AllowedDomains $simURLs = $param.PhishSim.SimURLs.SimURLs } process { Write-Verbose "Removing Phishing Simulation Setup" $PhishSimRules = @(Get-ExoPhishSimOverrideRule -ErrorAction Stop) foreach ($PhishSimRule in $PhishSimRules) { $RemoveDomains = @($PhishSimRule.Domains | Where-Object { $_ -in $domains }) $RemoveSenderIpRanges = @($PhishSimRule.SenderIpRanges | Where-Object { $_ -in $iPs }) if ($RemoveDomains.Count -eq 0 -and $RemoveSenderIpRanges.Count -eq 0) { Write-Verbose "No Cyberpilot entries found in phishing simulation rule $($PhishSimRule.Identity)" continue } $RemainingDomains = @($PhishSimRule.Domains | Where-Object { $_ -notin $domains }) $RemainingSenderIpRanges = @($PhishSimRule.SenderIpRanges | Where-Object { $_ -notin $iPs }) if ($RemainingDomains.Count -eq 0 -and $RemainingSenderIpRanges.Count -eq 0) { if ($PSCmdlet.ShouldProcess($PhishSimRule.Identity, 'Remove Cyberpilot phishing simulation override rule')) { Remove-ExoPhishSimOverrideRule -Identity $PhishSimRule.Identity -Confirm:$false -ErrorAction Stop } } else { $SetPhishSimOverrideParam = @{ Identity = $PhishSimRule.Identity } if ($RemoveDomains.Count -gt 0) { $SetPhishSimOverrideParam.RemoveDomains = $RemoveDomains } if ($RemoveSenderIpRanges.Count -gt 0) { $SetPhishSimOverrideParam.RemoveSenderIpRanges = $RemoveSenderIpRanges } if ($PSCmdlet.ShouldProcess($PhishSimRule.Identity, 'Remove Cyberpilot domains and sender IP ranges')) { Set-ExoPhishSimOverrideRule @SetPhishSimOverrideParam -Confirm:$false -ErrorAction Stop } } } $ExistingTenantAllowBlockListItems = @( Get-TenantAllowBlockListItems -ListType URL -ListSubType AdvancedDelivery -ErrorAction Stop | Where-Object { $_.Value -in $simURLs } ) if ($ExistingTenantAllowBlockListItems.Count -gt 0) { $TenantAllowBlockListItems = @{ ListType = 'URL' ListSubType = 'AdvancedDelivery' Ids = $ExistingTenantAllowBlockListItems.Identity } if ($PSCmdlet.ShouldProcess(($ExistingTenantAllowBlockListItems.Value -join ', '), 'Remove Cyberpilot Advanced Delivery URLs')) { Remove-TenantAllowBlockListItems @TenantAllowBlockListItems -ErrorAction Stop } } else { Write-Verbose "No Cyberpilot Advanced Delivery URLs found" } } end { $ErrorActionPreference = $oldErrorAction Write-Verbose "Finished processing Phishing Simulation Setup removal" } } # SIG # Begin signature block # MIIVyAYJKoZIhvcNAQcCoIIVuTCCFbUCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCO3FkM9hHV7knf # CsPkd1HileO4DO+Fp0bEKiUgbwEApaCCEgQwggVvMIIEV6ADAgECAhBI/JO0YFWU # jTanyYqJ1pQWMA0GCSqGSIb3DQEBDAUAMHsxCzAJBgNVBAYTAkdCMRswGQYDVQQI # DBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoM # EUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU2Vy # dmljZXMwHhcNMjEwNTI1MDAwMDAwWhcNMjgxMjMxMjM1OTU5WjBWMQswCQYDVQQG # EwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMS0wKwYDVQQDEyRTZWN0aWdv # IFB1YmxpYyBDb2RlIFNpZ25pbmcgUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQCN55QSIgQkdC7/FiMCkoq2rjaFrEfUI5ErPtx94jGgUW+s # hJHjUoq14pbe0IdjJImK/+8Skzt9u7aKvb0Ffyeba2XTpQxpsbxJOZrxbW6q5KCD # J9qaDStQ6Utbs7hkNqR+Sj2pcaths3OzPAsM79szV+W+NDfjlxtd/R8SPYIDdub7 # P2bSlDFp+m2zNKzBenjcklDyZMeqLQSrw2rq4C+np9xu1+j/2iGrQL+57g2extme # me/G3h+pDHazJyCh1rr9gOcB0u/rgimVcI3/uxXP/tEPNqIuTzKQdEZrRzUTdwUz # T2MuuC3hv2WnBGsY2HH6zAjybYmZELGt2z4s5KoYsMYHAXVn3m3pY2MeNn9pib6q # RT5uWl+PoVvLnTCGMOgDs0DGDQ84zWeoU4j6uDBl+m/H5x2xg3RpPqzEaDux5mcz # mrYI4IAFSEDu9oJkRqj1c7AGlfJsZZ+/VVscnFcax3hGfHCqlBuCF6yH6bbJDoEc # QNYWFyn8XJwYK+pF9e+91WdPKF4F7pBMeufG9ND8+s0+MkYTIDaKBOq3qgdGnA2T # OglmmVhcKaO5DKYwODzQRjY1fJy67sPV+Qp2+n4FG0DKkjXp1XrRtX8ArqmQqsV/ # AZwQsRb8zG4Y3G9i/qZQp7h7uJ0VP/4gDHXIIloTlRmQAOka1cKG8eOO7F/05QID # AQABo4IBEjCCAQ4wHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYD # VR0OBBYEFDLrkpr/NZZILyhAQnAgNpFcF4XmMA4GA1UdDwEB/wQEAwIBhjAPBgNV # HRMBAf8EBTADAQH/MBMGA1UdJQQMMAoGCCsGAQUFBwMDMBsGA1UdIAQUMBIwBgYE # VR0gADAIBgZngQwBBAEwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21v # ZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEE # KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZI # hvcNAQEMBQADggEBABK/oe+LdJqYRLhpRrWrJAoMpIpnuDqBv0WKfVIHqI0fTiGF # OaNrXi0ghr8QuK55O1PNtPvYRL4G2VxjZ9RAFodEhnIq1jIV9RKDwvnhXRFAZ/ZC # J3LFI+ICOBpMIOLbAffNRk8monxmwFE2tokCVMf8WPtsAO7+mKYulaEMUykfb9gZ # pk+e96wJ6l2CxouvgKe9gUhShDHaMuwV5KZMPWw5c9QLhTkg4IUaaOGnSDip0TYl # d8GNGRbFiExmfS9jzpjoad+sPKhdnckcW67Y8y90z7h+9teDnRGWYpquRRPaf9xH # +9/DUp/mBlXpnYzyOmJRvOwkDynUWICE5EV7WtgwggYaMIIEAqADAgECAhBiHW0M # UgGeO5B5FSCJIRwKMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYTAkdCMRgwFgYD # VQQKEw9TZWN0aWdvIExpbWl0ZWQxLTArBgNVBAMTJFNlY3RpZ28gUHVibGljIENv # ZGUgU2lnbmluZyBSb290IFI0NjAeFw0yMTAzMjIwMDAwMDBaFw0zNjAzMjEyMzU5 # NTlaMFQxCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxKzAp # BgNVBAMTIlNlY3RpZ28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYwggGiMA0G # CSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCbK51T+jU/jmAGQ2rAz/V/9shTUxjI # ztNsfvxYB5UXeWUzCxEeAEZGbEN4QMgCsJLZUKhWThj/yPqy0iSZhXkZ6Pg2A2NV # DgFigOMYzB2OKhdqfWGVoYW3haT29PSTahYkwmMv0b/83nbeECbiMXhSOtbam+/3 # 6F09fy1tsB8je/RV0mIk8XL/tfCK6cPuYHE215wzrK0h1SWHTxPbPuYkRdkP05Zw # mRmTnAO5/arnY83jeNzhP06ShdnRqtZlV59+8yv+KIhE5ILMqgOZYAENHNX9SJDm # +qxp4VqpB3MV/h53yl41aHU5pledi9lCBbH9JeIkNFICiVHNkRmq4TpxtwfvjsUe # dyz8rNyfQJy/aOs5b4s+ac7IH60B+Ja7TVM+EKv1WuTGwcLmoU3FpOFMbmPj8pz4 # 4MPZ1f9+YEQIQty/NQd/2yGgW+ufflcZ/ZE9o1M7a5Jnqf2i2/uMSWymR8r2oQBM # dlyh2n5HirY4jKnFH/9gRvd+QOfdRrJZb1sCAwEAAaOCAWQwggFgMB8GA1UdIwQY # MBaAFDLrkpr/NZZILyhAQnAgNpFcF4XmMB0GA1UdDgQWBBQPKssghyi47G9IritU # pimqF6TNDDAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADATBgNV # HSUEDDAKBggrBgEFBQcDAzAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQQBMEsG # A1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1B1 # YmxpY0NvZGVTaWduaW5nUm9vdFI0Ni5jcmwwewYIKwYBBQUHAQEEbzBtMEYGCCsG # AQUFBzAChjpodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2Rl # U2lnbmluZ1Jvb3RSNDYucDdjMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0 # aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEABv+C4XdjNm57oRUgmxP/BP6YdURh # w1aVcdGRP4Wh60BAscjW4HL9hcpkOTz5jUug2oeunbYAowbFC2AKK+cMcXIBD0Zd # OaWTsyNyBBsMLHqafvIhrCymlaS98+QpoBCyKppP0OcxYEdU0hpsaqBBIZOtBajj # cw5+w/KeFvPYfLF/ldYpmlG+vd0xqlqd099iChnyIMvY5HexjO2AmtsbpVn0OhNc # WbWDRF/3sBp6fWXhz7DcML4iTAWS+MVXeNLj1lJziVKEoroGs9Mlizg0bUMbOalO # hOfCipnx8CaLZeVme5yELg09Jlo8BMe80jO37PU8ejfkP9/uPak7VLwELKxAMcJs # zkyeiaerlphwoKx1uHRzNyE6bxuSKcutisqmKL5OTunAvtONEoteSiabkPVSZ2z7 # 6mKnzAfZxCl/3dq3dUNw4rg3sTCggkHSRqTqlLMS7gjrhTqBmzu1L90Y1KWN/Y5J # KdGvspbOrTfOXyXvmPL6E52z1NZJ6ctuMFBQZH3pwWvqURR8AgQdULUvrxjUYbHH # j95Ejza63zdrEcxWLDX6xWls/GDnVNueKjWUH3fTv1Y8Wdho698YADR7TNx8X8z2 # Bev6SivBBOHY+uqiirZtg0y9ShQoPzmCcn63Syatatvx157YK9hlcPmVoa1oDE5/ # L9Uo2bC5a4CH2RwwggZvMIIE16ADAgECAhBIqMP3CCLHOHtOKuaWNyeFMA0GCSqG # SIb3DQEBDAUAMFQxCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0 # ZWQxKzApBgNVBAMTIlNlY3RpZ28gUHVibGljIENvZGUgU2lnbmluZyBDQSBSMzYw # HhcNMjYwNDE1MDAwMDAwWhcNMjcwNzE0MjM1OTU5WjBmMQswCQYDVQQGEwJERTEP # MA0GA1UECAwGQmF5ZXJuMSIwIAYDVQQKDBlTRVBQbWFpbCBEZXV0c2NobGFuZCBH # bWJIMSIwIAYDVQQDDBlTRVBQbWFpbCBEZXV0c2NobGFuZCBHbWJIMIICIjANBgkq # hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvAFzE8MbJpvQt+IdIh1M+bKYsJBFDk4b # 9ySe25IrCi00B9o5XmQtIw42MqyIKbUq1tDARtp9KTQedEP9W+rflAF2l+0Z046J # kiqumU9/enbqWLDyln1aS/p7HOgwZFMhnsR9zH0MfFckiklUmkzJO+vmzYAK7ZmD # xajNLJs0gkGRU2/BecAx/TSvLXMaKONsKZCyMKQCnwo1mCY/tFl5EgUz7YQFrPOR # BQGfQke/hkdBfQDqNRsi/J6+KhJWc6LvgQihdRg/INQbQsTxlow18NWvyFsjjueH # 7kG6HR4YKfbv07xgrsIh8xvq9ZJ1SBhLXmkg4SdoQGASjqR6o3keAX+bDRFf+hml # WWJp/FqVHR5QomF3vbK2/bbz4jAclYSPx/sPasNJ0YnKFkgmowZ7Ysa0KA0/egBg # tI4gJ+8V7zrqIVEG3rMQh9KCdMnJqP2aM9o4gUzQvE1M4x606liX9EWwdLLS+fe7 # 9o+Fzo5oH4wBE/En6hQQkzseHHu+TXCDd6zUUZ/PlTK0gTaDIRXt6UzPNqJ4RiRC # W2pNFcPt078qqVTuwKUXoE4ufxGgXKFrZlCYST/9eG1TnW2oq19nz8A333GCsL3g # poNIKvfmDyGMMNzvx2aeqn2v6e75z8kH19iGSNZ51xT+WgS9F1aIvjz08/T7XAv7 # iDPF1/gPIp8CAwEAAaOCAakwggGlMB8GA1UdIwQYMBaAFA8qyyCHKLjsb0iuK1Sm # KaoXpM0MMB0GA1UdDgQWBBS30/Tq+alF3j2BY5up8n5zpAU23DAOBgNVHQ8BAf8E # BAMCB4AwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAzBKBgNVHSAE # QzBBMDUGDCsGAQQBsjEBAgEDAjAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3Rp # Z28uY29tL0NQUzAIBgZngQwBBAEwSQYDVR0fBEIwQDA+oDygOoY4aHR0cDovL2Ny # bC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcmww # eQYIKwYBBQUHAQEEbTBrMEQGCCsGAQUFBzAChjhodHRwOi8vY3J0LnNlY3RpZ28u # Y29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBUjM2LmNydDAjBggrBgEFBQcw # AYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wHgYDVR0RBBcwFYETc3VwcG9ydEBz # ZXBwbWFpbC5jaDANBgkqhkiG9w0BAQwFAAOCAYEAi7fmb5UYoemWG3CC4K2UZWVr # R6GOfi8gbJKgjPbKO4zrCrU/x6cOdyp6scKZfUEGFDf8KH6pP4pAQv1Hsbi49gU2 # kxoUWLlCiipn05qJY663DHx9hlStej/ZdEatou0wyCDiG5xD7kmG+1t6iLyyCBgE # B88tJpzTjI61qXmBTS/FGEOAsB4SDEW1ngA7bc5FOv4IUKA43hp8M+N3GeYFzDqw # JELYEfVVYheBW3o7q4VrCdfFEuaQihOtvfDfYpP6ANgekNn8HdsMT8rx9D1I50Rl # i/qQFo2BOuPyb2SIQPzJvCs5wgi5qgp1nHiN6igumu2Cz7BmGjOazGUgCSUY5Qwy # E8+F+R2tVM+2O15rfX01+e56ZfojBEiEjMwfPHs3fa3V3gokWWNwUMkton/v0R/n # l2zjmOr2okohOINZEDh9frg21zUCN5ZD8Y4zQWuiJLCvvvBZs0JR4c9xl2k2wtw/ # QLPhGU69zM3smGpRoLE8M6zvUvSU7jXjvefazUniMYIDGjCCAxYCAQEwaDBUMQsw # CQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSswKQYDVQQDEyJT # ZWN0aWdvIFB1YmxpYyBDb2RlIFNpZ25pbmcgQ0EgUjM2AhBIqMP3CCLHOHtOKuaW # NyeFMA0GCWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAw # GQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisG # AQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIOG/ZdLoGJnjm42xqjqTQj2LWHBG7L9F # LFF0QwZtlIJAMA0GCSqGSIb3DQEBAQUABIICADKianPkgn4GPyTAwRkABDxMCWHY # AglPtdILpJn/h1Cb2RwP5owlcXV4yO3bdlErxc0svoI7e7e49nRgULyChRU8oodY # d227uS5LTQWsax2EKKG4Zz8uFKkfG8JQBn8jfXN1n/hreUxPXqQr4DX3ZCxsUI7u # aQP3Vk7dhVqSXFbjhOkleBnbIp2jRZ4VoQfvejk3Oriw5n6ywkL0EpQfl9Zu6/8F # BfX6gWoBfBBYSz+W+QzuBxhA8EjsR7Y60dMjAxBcDcw2w5TAGkqkd9xSS/+y5uet # a8sWtNjOOXc2p/fxHH/T9KBVt561Y/owfURKDEuELicEKVQW0s1bH1ZYcKdEj+jb # nkRO+rsl+GJyovkA766rTfHUO+pFAKPP/fwgXG88LKJHG9eOF3K4Yqa7wx8ZtjkK # VDDwpH/BW4kogWdPK+mqzcBUOhJNFcXZNT9N7JcU42/ZZwRijeqhHEUDYrWD4NDK # 05uRa4ox3AqU91FWMHtbuVL7/X2wdXytkiZBjIVA8YXrxWACCu2ioRi9uUDP70HH # mkxZwVoVgUIYcbPxA12CH0tuaiPinhYLE29SqV3Ttr+Y4qFig/S1f5Wnc/cK6/4c # FQ4KjVpnvJ+bcp9azaHDf2m4WsqDjgxXKbVTPReJj1prKw3SN7OBYBW94CA0nXHj # 51JPaBpGYSmZ9vup # SIG # End signature block |