piaudonn / securitynotifications

Send security notifications to your users when something important happened on their accounts (such as new MFA methods, atypical travels, TAP usage...).

Me! Yeah! 🙌

Data Transaction Coordinator!

My NoHello or rather my HelloPlease philosophy is here: 🔗 https://github.com/piaudonn/knockknock

securitynotifications's Issues

[BUG] Deployment Fails when Storage account already exists in other RG

If you pick an existing storage account, the deployment fails if that account is in another RG than that selected during deployment

[Feature] Notify on atypical travel

Use risk info from Azure AD IDP to notify end users of atypical travels.

[Feature] Add Log Analytics Workspace Picker

Add log analytics workspace picker to select the workspace to perform KQL queries against

[Feature] Add Storage Account Picker to ARM deployment

Add picker to select an existing or create a new storage account to the ARM deployment GUI

[Feature] PowerShell to setup Exchange policy to restrict managed identity

Given that we are using managed identity to send email, that managed identity could by default send as any users. A policy in exchange online is needed to restrict it

[Feature] Review Module Naming conventions

Review naming conventions for all modules... Notification module to be renamed to include email as more notification modules may follow (like teams)

[BUG] Setup script fails if SEEN and RG is in a different sub than LA

The current script assumes that the Azure Subscription ID is the same for the RG of SEEN and the RG of the Log Analytics workspace. Because of that it cannot grant the RBAC Log Analytics Reader to the 3 modules.

Current workaround is to manually add the managed identities of the module into the Log Analytics Reader role of the LA workspace.

Proposed fix is to add a parameter for the sub ID of the LA workspace, assume it is the same when not provided and add a sub id parameter to the set RBAC function.

Go to work @piaudonn !

[Feature] Workbook with statistics

Workbooks

[Feature] PowerShell to copy template files, prompt for options like test email

[Feature] PowerShell script to setup API / RBAC Permissions

PowerShell script to setup required API / RBAC Permissions post deployment

[BUG] SEEN Configuration "Mail from", "Test Email" and others not configurable.

Describe the bug
After successfully deploying the solution via the ARM template it is not possible to set certain configuration options such as "Mail from, "Test Email", "Support Email", Support Phone" and "Admin Email". The fields are greyed out / inactive / not editable.

[Feature] Improve setup.ps1 script usability

If subscription and tenant IDs are not specified, offer a picker to the user by on the identity used to sign-in to the Graph API and the Azure Management API.

[Feature] Update Config LA to Support Test data in config file

Update config Logic app to read test mode parameters from the config file and handle appropriately

[Feature] Adapt Config file to handle test mode

• Per module support for test mode on/off
• Global setting for set test email

[Feature] Handle version check

Have the operators of the solution notified when a new version of SEEN is available.

[Feature] Enable diagnostic settings on the Email Notification LA

Lets enable it by default and create a toggle to disable it in advanced deployment mode.

[Feature] Workbook - Use ARM instead of Resource Graph

The resource graph latency is annoying. Too long to refresh when we start/stop a module from the workbook.

[Feature] Password Change Notification

Would there be a way to create a module for password changes in AzureAD

We have been looking at adopting SEEN at our company, but beyond the MFA notifications we would also like to notify on password changes