ShadowTraceOps-CommunityEdition - PowerShell-based Microsoft security investigation

项目说明

Shadow Trace Ops — Community Edition V1

!PowerShell
!Microsoft Graph
!Community Edition
!Status

> A PowerShell-based in and defensive gap assessment framework for Microsoft security en.

---

O

Shadow Trace Ops is a read-only in framework designed to help analysts correlate Microsoft security telemetry, accelerate in, standardize pivots, and identify potential defensive gaps.

The framework combines:

* In reporting
* KQL playbooks
* Guided analyst pivots
* Pop-out in blades
* Telemetry correlation
* Executi reporting
* Defensive gap discovery
* Source-health
* Microsoft Graph API collection

The goal is not just to answer:

> "What happened?"

But also:

> "What are we missing that allowed this to happen?"

---

Core Focus Areas

Shadow Trace Ops focuses on in and telemetry correlation across:

* Microsoft XDR
* Entra ID
* Defender for Endpoint
* Defender for Office 365
* Defender for Cloud Apps
* OAuth and application activity
* Authentication and identity telemetry
* Endpoint and XDR context
* Email and URL in
* Ad Hunting / KQL workflows
* Defensive gap

---

Key Features

In Report

The In Report is designed for analysts and responders.

Features include:

* User-focused in workflow
* Identity and authentication analysis
* Endpoint and XDR context
* Cloud activity review
* OAuth and app activity analysis
* Email and URL in context
* Source health
* Potential defensive gap identification
* In timelines
* Analyst workflow tracking
* Embedded KQL pivots
* Pop-out in playbooks

---

Executi

The Executi is designed for:

* CISOs
* Directors
* Leadership
* Incident stakeholders
* Security management

The Executi focuses on:

* Exposure metrics
* Telemetry co
* Defensive gaps
* Recommended priorities
* Risk
* Priority timelines
* Executi guidance
* Readiness and operational concerns

The Executi intentionally does not include analyst playbook pop-outs.

---

Pop-Out In Playbooks

The In Report includes embedded in playbooks with:

* Guided pivots
* In flow
* KQL references
* Analyst recommendations
* Triage direction
* Threat hunting guidance
* Operational context

The goal is to help analysts mo in faster and more consistently.

---

KQL Side Panels

KQL templates are integrated directly into the in workflow.

Features include:

* User UPN auto-population
* In queries
* Identity pivots
* Endpoint pivots
* OAuth pivots
* Email and URL pivots
* Cloud in pivots
* Copy-to-clipboard functionality

---

Source Health

Source Health helps analysts understand:

* What data was successfully collected
* What failed
* What telemetry is una
* What permissions may be missing
* What workloads may not be onboarded
* Whether in confidence is reduced

This helps prevent false assumptions based on empty sections or una telemetry.

---

Why This Exists

Many in require analysts to constantly pi:

* Entra ID
* Microsoft Defender XDR
* Ad Hunting
* Cloud App Security
* Sign-in logs
* OAuth permissions
* Email telemetry
* Endpoint telemetry
* KQL queries
* Manual notes
* Executi

Shadow Trace Ops was designed to help bring those pivots together into a guided in experience.

---

Current Community Edition Goals

The Community Edition is focused on:

* Accelerating in
* Improving in consistency
* Standardizing pivots
* Improving analyst workflow
* Identifying defensive gaps
* Improving into telemetry readiness
* Supporting Microsoft security in

---

What This Tool Does NOT Do

Shadow Trace Ops does not:

* Automatically remediate users
* Disable accounts
* Revoke sessions
* Quarantine devices
* Change policies
* Replace Microsoft security tooling
* Replace analyst
* Confirm compromise by itself

The framework is read-only and ad.

---

Screenshots

> Add screenshots here.

Recommended screenshots:

* In dashboard
* Playbook pop-out blade
* KQL side panel
* Executi
* Timeline view
* Gap analysis section

---

Architecture

---

Folder Structure

---

Requirements

Local Requirements

* Windows 10 or Windows 11
* PowerShell 5.1+
* Microsoft Graph PowerShell SDK
* Internet access
* Access to a Microsoft tenant

---

Recommended Microsoft Graph Permissions

Some permissions may require administrator consent.

---

Installation

Clone or Download

Or download the ZIP and extract locally.

---

Install Microsoft Graph PowerShell SDK

---

Na to the Toolkit Folder

---

Unblock the Script

---

Set Execution Policy for Current Session

---

Launch the Tool

---

Running an In

Step 1 — Connect Services

Click:

Authenticate to Microsoft Graph.

---

Step 2 — Enter User UPN

Example:

---

Step 3 — Choose Lookback Window

Recommended:

A:

* 7 days
* 30 days
* 90 days

---

Step 4 — Run In

Click:

The framework collects:

* Identity risk
* Authentication context
* OAuth activity
* XDR alerts/incidents
* Endpoint context
* Cloud activity
* Email and URL telemetry
* Potential gaps
* Source health

---

Step 5 — Export Reports

Generate:

* In Report
* Executi

Reports are saved to:

---

In Workflow

Recommended analyst flow:

---

Operational Notes

Important Guidance

A zero value in a section does not always mean:

It may indicate:

* No matching telemetry
* Missing permissions
* Table a issues
* Retention limitations
* Source-health problems
* Licensing gaps
* Workload onboarding gaps

Always important findings in Microsoft security portals.

---

Current Release Status

Community Edition V1

Current baseline:

Locked behaviors:

* In Report with working pop-out playbook blades
* KQL side panels
* Analyst workflow layout
* Separate Executi
* Executi exposure and gap reporting
* No analyst pop-outs in Executi

---

Planned Future Enhancements

Potential future directions:

* Expanded hunting automation
* Additional telemetry normalization
* Microsoft Sentinel integration
* More dynamic executi
* In workflow customization
* Additional playbook co
* Threat-intelligence enrichment
* Timeline enhancements
* In graphing impro
* Case-management export

---

Community Release Positioning

Shadow Trace Ops Community Edition should be considered:

This release is intended to:

* gather community feedback
* impro workflow
* test in concepts
* impro correlation
* evol guidance

---

Contributing

Feedback, ideas, testing, and operational suggestions are welcome.

Areas where feedback is especially :

* In workflow
* KQL pivots
* Telemetry quality
* Executi
* Gap analysis
* Analyst usability
* Source health
* Microsoft workload co

---

Disclaimer

Shadow Trace Ops is a read-only ad in framework.

All findings should be by qualified analysts using the appropriate Microsoft security portals, logs, policies, and operational procedures.

The framework does not confirm compromise by itself.

The framework does not perform remediation.

Use in accordance with your organization's security, privacy, legal, and change-management requirements.

---

Author

Shadow Trace Ops — Community Edition V1

Built from real-world in workflow challenges, telemetry correlation problems, and defensive gap analysis concepts within Microsoft security en.

Licensing

Shadow Suite Community Edition is licensed under the Business Source License 1.1 (BSL).

Permitted:

Restricted without written authorization:

See LICENSE.md and NOTICE.md for full details.

⚠️ Disclaimer
This tool is provided for educational, testing, and security purposes only.

Use of this tool should be limited to:

Authorized en
Lab or appro systems
The author assumes no liability or responsibility for:

Misuse of this tool
Damage to systems
Unauthorized or improper use
By using this tool, you agree to use it in a lawful and responsible manner.
This project is not affiliated with or endorsed by Microsoft.

⚖️ Professional Disclaimer
This project is an independent work de in a personal capacity.

The views, opinions, code, and content expressed in this repository are solely my own and do not reflect the views, policies, or positions of any current or future employer, client, or affiliated organization.

No employer, past, present, or future, has re, approved, endorsed, or is in any way associated with these works.

This project was de outside the scope of any employment and without the use of proprietary, confidential, or restricted resources.

All code/language in this repository is provided under the terms of the included MIT License.

项目信息

开发语言：PowerShell

Star 数：8

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PowerShell-based Microsoft security investigation and defensive gap assessment framework focused on Microsoft XDR, Entra ID, KQL pivots, analyst workflow, and executive exposure reporting.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。