Audit Avancé Microsoft 365 : Corréler Journaux et Logs Azure

# Architecture PowerShell pour la collecte multi-sources

function Initialize-M365AuditArchitecture {
    [CmdletBinding()]
    param(
        [switch]$EnableAllLogs,
        [int]$RetentionDays = 365
    )

    # Configuration des connexions multiples
    $connections = @{
        "ExchangeOnline" = @{ Module = "ExchangeOnlineManagement"; Scope = "https://outlook.office365.com" }
        "MicrosoftGraph" = @{ Module = "Microsoft.Graph"; Scopes = @("AuditLog.Read.All", "Directory.Read.All") }
        "SecurityCompliance" = @{ Module = "ExchangeOnlineManagement"; Scope = "https://ps.compliance.protection.outlook.com" }
        "AzureAD" = @{ Module = "AzureAD"; Scope = "https://graph.microsoft.com" }
    }

    # Activation des logs d'audit pour chaque service
    if ($EnableAllLogs) {
        Write-Host "🔧 Configuration des logs d'audit..." -ForegroundColor Cyan

        # Exchange Online Audit Logging
        Set-OrganizationConfig -AuditDisabled:$false
        Set-AdminAuditLogConfig -AdminAuditLogEnabled:$true -AdminAuditLogCmdlets "*" -AdminAuditLogParameters "*"

        # SharePoint Online Audit
        Set-SPOTenant -EnableAIPIntegration:$true

        # Microsoft Teams Audit
        Set-CsTeamsAuditConfiguration -AuditInformationRecordingEnabled:$true

        # Azure AD Premium P1/P2 features
        Update-MgDirectoryAuditLogRetention -Days $RetentionDays
    }

    # Vérification de la configuration
    $auditStatus = @{
        ExchangeAudit = (Get-OrganizationConfig).AuditDisabled -eq $false
        AdminAudit = (Get-AdminAuditLogConfig).AdminAuditLogEnabled
        UnifiedAuditLog = (Get-AdminAuditLogConfig).UnifiedAuditLogIngestionEnabled
        AzureADLogs = $true  # Toujours activé avec P1+
    }

    return $auditStatus
}

# Framework de corrélation multi-sources

class M365LogCorrelator {
    [hashtable]$EventSources
    [hashtable]$CorrelationRules
    [int]$TimeWindowMinutes

    M365LogCorrelator([int]$timeWindow = 30) {
        $this.TimeWindowMinutes = $timeWindow
        $this.EventSources = @{}
        $this.InitializeCorrelationRules()
    }

    [void] InitializeCorrelationRules() {
        $this.CorrelationRules = @{
            "SuspiciousLogin" = @{
                PrimaryEvent = @{
                    Source = "AzureAD"
                    EventType = "SignIn"
                    Conditions = @("RiskLevel -ne 'none'", "Status.ErrorCode -eq 0")
                }
                CorrelatedEvents = @(
                    @{
                        Source = "Exchange"
                        EventType = "MailboxLogin"
                        TimeWindow = 10
                        Conditions = @("same IP", "same user")
                    },
                    @{
                        Source = "SharePoint"
                        EventType = "FileDownloaded"
                        TimeWindow = 60
                        Conditions = @("same user", "volume > 100MB")
                    }
                )
            }
            "DataExfiltration" = @{
                PrimaryEvent = @{
                    Source = "SharePoint"
                    EventType = "FileDownloaded"
                    Conditions = @("FileSize -gt 10MB")
                }
                CorrelatedEvents = @(
                    @{
                        Source = "Exchange"
                        EventType = "Send"
                        TimeWindow = 30
                        Conditions = @("same user", "external recipient")
                    }
                )
            }
        }
    }

    [PSObject[]] CorrelateEvents([hashtable]$events, [string]$ruleName) {
        $rule = $this.CorrelationRules[$ruleName]
        $correlatedIncidents = @()

        # Récupérer les événements primaires
        $primaryEvents = $events[$rule.PrimaryEvent.Source] | Where-Object {
            $this.EvaluateConditions($_, $rule.PrimaryEvent.Conditions)
        }

        foreach ($primaryEvent in $primaryEvents) {
            $incident = [PSCustomObject]@{
                PrimaryEvent = $primaryEvent
                CorrelatedEvents = @()
                RiskScore = 1
                Timeline = @($primaryEvent)
            }

            # Rechercher les événements corrélés
            foreach ($correlationRule in $rule.CorrelatedEvents) {
                $timeStart = $primaryEvent.Timestamp.AddMinutes(-$correlationRule.TimeWindow)
                $timeEnd = $primaryEvent.Timestamp.AddMinutes($correlationRule.TimeWindow)

                $correlatedEvents = $events[$correlationRule.Source] | Where-Object {
                    $_.Timestamp -ge $timeStart -and $_.Timestamp -le $timeEnd -and
                    $this.EvaluateCorrelationConditions($_, $primaryEvent, $correlationRule.Conditions)
                }

                if ($correlatedEvents) {
                    $incident.CorrelatedEvents += $correlatedEvents
                    $incident.RiskScore += $correlatedEvents.Count
                    $incident.Timeline += $correlatedEvents
                }
            }

            # Trier la timeline
            $incident.Timeline = $incident.Timeline | Sort-Object Timestamp

            if ($incident.CorrelatedEvents.Count -gt 0) {
                $correlatedIncidents += $incident
            }
        }

        return $correlatedIncidents | Sort-Object RiskScore -Descending
    }

    [bool] EvaluateConditions([PSObject]$event, [string[]]$conditions) {
        foreach ($condition in $conditions) {
            if (-not (Invoke-Expression "`$event.$condition")) {
                return $false
            }
        }
        return $true
    }

    [bool] EvaluateCorrelationConditions([PSObject]$event, [PSObject]$primaryEvent, [string[]]$conditions) {
        foreach ($condition in $conditions) {
            switch ($condition) {
                "same IP" { if ($event.ClientIP -ne $primaryEvent.ClientIP) { return $false } }
                "same user" { if ($event.UserId -ne $primaryEvent.UserId) { return $false } }
                "external recipient" { if ($event.Recipients -notmatch "@(?!contoso\.com)") { return $false } }
                "volume > 100MB" { if (($event.FileSize / 1MB) -le 100) { return $false } }
            }
        }
        return $true
    }
}