Connect-MgGraph -Scopes "SecurityIncident.ReadWrite.All","SecurityAlert.ReadWrite.All"

# Get all high-severity open incidents
Get-MgSecurityIncident -Filter "severity eq 'high' and status eq 'active'" -All |
  Select-Object Id,DisplayName,Severity,Status,CreatedDateTime,LastUpdateDateTime,AssignedTo |
  Sort-Object CreatedDateTime -Descending |
  Format-Table -AutoSize

# Get all alerts for a specific incident
$IncidentId = "incident-id-here"
Get-MgSecurityIncidentAlert -IncidentId $IncidentId |
  Select-Object Id,Title,Severity,Category,ServiceSource,CreatedDateTime |
  Format-Table -AutoSize

# Update incident status and classification after investigation
Update-MgSecurityIncident -IncidentId $IncidentId `
  -Status "resolved" `
  -Classification "truePositive" `
  -Determination "malware" `
  -AssignedTo "analyst@contoso.com"
Write-Host "Incident resolved and classified."

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Trace all emails from a suspicious sender domain (last 10 days)
Get-MessageTrace `
  -SenderAddress "*@suspicious-domain.com" `
  -StartDate (Get-Date).AddDays(-10) `
  -EndDate (Get-Date) |
  Select-Object Received,SenderAddress,RecipientAddress,Subject,Status,MessageId |
  Export-Csv -Path "SuspiciousSenderTrace.csv" -NoTypeInformation

# Get detailed delivery events for a specific message
Get-MessageTraceDetail -MessageTraceId "message-trace-id" -RecipientAddress "victim@contoso.com" |
  Select-Object Date,Event,Action,Detail |
  Format-Table -AutoSize

# Find all recipients of a known-bad phishing message
$Recipients = Get-MessageTrace `
  -SenderAddress "attacker@phishing.com" `
  -StartDate (Get-Date).AddDays(-3) -EndDate (Get-Date) |
  Where-Object {$_.Status -eq "Delivered"} |
  Select-Object -ExpandProperty RecipientAddress
Write-Host "Delivered to $($Recipients.Count) recipients"

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get all anti-phishing policies
Get-AntiPhishPolicy | Select-Object Name,IsDefault,PhishThresholdLevel,EnableMailboxIntelligence,EnableSpoofIntelligence | Format-Table -AutoSize

# Harden the default anti-phishing policy
Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" `
  -PhishThresholdLevel 3 `
  -EnableMailboxIntelligence $true `
  -EnableMailboxIntelligenceProtection $true `
  -MailboxIntelligenceProtectionAction Quarantine `
  -EnableSpoofIntelligence $true `
  -AuthenticationFailAction Quarantine `
  -EnableFirstContactSafetyTips $true

# Get anti-spam policies
Get-HostedContentFilterPolicy | Select-Object Name,IsDefault,SpamAction,HighConfidenceSpamAction,BulkThreshold | Format-Table -AutoSize

# Harden the default anti-spam policy
Set-HostedContentFilterPolicy -Identity "Default" `
  -SpamAction MoveToJmf `
  -HighConfidenceSpamAction Quarantine `
  -PhishSpamAction Quarantine `
  -BulkThreshold 6 `
  -QuarantineRetentionPeriod 30

# Get spoof intelligence — who is currently spoofing your domains
Get-TenantAllowBlockListSpoofItems | Select-Object SpoofedUser,SendingInfrastructure,SpoofType,Action | Format-Table -AutoSize

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get Safe Links policies
Get-SafeLinksPolicy | Select-Object Name,EnableSafeLinksForEmail,EnableSafeLinksForTeams,ScanUrls,DeliverMessageAfterScan,AllowClickThrough | Format-Table -AutoSize

# Create a hardened Safe Links policy
New-SafeLinksPolicy -Name "Standard Safe Links" `
  -EnableSafeLinksForEmail $true `
  -EnableSafeLinksForTeams $true `
  -ScanUrls $true `
  -DeliverMessageAfterScan $true `
  -AllowClickThrough $false `
  -TrackClicks $true

# Get Safe Attachments policies
Get-SafeAttachmentPolicy | Select-Object Name,Enable,Action,Redirect,ActionOnError | Format-Table -AutoSize

# Create Safe Attachments policy with Dynamic Delivery
New-SafeAttachmentPolicy -Name "Standard Safe Attachments" `
  -Enable $true `
  -Action DynamicDelivery `
  -ActionOnError $false

# Block a malicious sender and URL in the Tenant Allow/Block List
New-TenantAllowBlockListItems -ListType Sender -Block -Entries "*@malicious-domain.com" -NoExpiration
New-TenantAllowBlockListItems -ListType Url -Block -Entries "malicious-site.com" -NoExpiration

# List all current block entries
Get-TenantAllowBlockListItems -ListType Sender | Format-Table -AutoSize

Connect-MgGraph -Scopes "Machine.ReadWrite.All","Alert.ReadWrite.All"

# Get all MDE-onboarded devices with risk scores
Invoke-MgGraphRequest -Method GET `
  "https://api.securitycenter.microsoft.com/api/machines" |
  Select-Object -ExpandProperty value |
  Select-Object computerDnsName,osPlatform,healthStatus,riskScore,onboardingStatus,lastSeen |
  Sort-Object riskScore -Descending |
  Export-Csv -Path "MDEDeviceInventory.csv" -NoTypeInformation

# Isolate a compromised device (full network isolation)
$MachineId = "machine-id-here"
Invoke-MgGraphRequest -Method POST `
  "https://api.securitycenter.microsoft.com/api/machines/$MachineId/isolate" `
  -Body @{ IsolationType = "Full"; Comment = "Isolated during ransomware investigation - INC001" }

# Run antivirus scan on a device
Invoke-MgGraphRequest -Method POST `
  "https://api.securitycenter.microsoft.com/api/machines/$MachineId/runAntiVirusScan" `
  -Body @{ ScanType = "Quick"; Comment = "Post-incident remediation scan" }

# Get all active high/medium severity MDE alerts
Invoke-MgGraphRequest -Method GET `
  "https://api.securitycenter.microsoft.com/api/alerts?`$filter=severity in ('High','Medium') and status ne 'Resolved'" |
  Select-Object -ExpandProperty value |
  Select-Object title,severity,status,machineId,firstEventTime |
  Sort-Object firstEventTime -Descending |
  Format-Table -AutoSize

// 1. Find phishing emails delivered to users in last 7 days
EmailEvents
| where Timestamp > ago(7d)
| where ThreatTypes has "Phish"
| where DeliveryAction == "Delivered"
| summarize DeliveredCount = count() by SenderFromDomain, SenderIPv4, RecipientEmailAddress
| sort by DeliveredCount desc

// 2. Users who clicked malicious URLs (Safe Links)
UrlClickEvents
| where Timestamp > ago(7d)
| where ActionType == "ClickBlocked" or ThreatTypes has_any ("Phish", "Malware")
| summarize ClickCount = count() by AccountUpn, Url, IsClickedThrough
| sort by ClickCount desc

// 3. Detect suspicious PowerShell (encoded commands, downloader)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has_any (
    "-enc", "-EncodedCommand", "bypass",
    "WebClient", "DownloadString", "IEX"
  )
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

// 4. Detect mass file renames (ransomware indicator)
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileRenamed"
| summarize RenamedFiles = count() by DeviceName, AccountName, bin(Timestamp, 5m)
| where RenamedFiles > 50
| sort by RenamedFiles desc

// 5. Detect lateral movement via PsExec
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "services.exe"
| where FileName =~ "PSEXESVC.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get mail traffic summary (last 7 days)
Get-MailTrafficSummaryReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Category,Total | Format-Table -AutoSize

# Get MDO protection report (malware + phishing detections)
Get-MailTrafficATPReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Date,Direction,EventType,MessageCount |
  Sort-Object Date -Descending | Format-Table -AutoSize

# Get Safe Links click verdicts (last 30 days) — export blocked clicks
Get-SafeLinksDetailReport -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) |
  Where-Object {$_.Verdict -ne "Allowed"} |
  Export-Csv -Path "SafeLinksClicks.csv" -NoTypeInformation

# Get top malware families detected in email (last 7 days)
Get-MailDetailMalwareReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Group-Object FileName |
  Select-Object Name,Count |
  Sort-Object Count -Descending -First 10 |
  Format-Table -AutoSize