sap8899/reportlyAzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and login logs to aid cloud incident investigation.
Reportly is an EntraID user activity report tool.
This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following:
When running the tool, a link to authentication and a device code will show, follow the link and enter the code to authenticate.
Insert User principal name of a suspicious user.
Insert start and end times in the following format: 2022-11-16
I recommend a range of no longer than a week.
When the report will be ready the tool will print "Your report is ready!". The reports are created in the executable's directory by default.
Attached an example report "report_example.html"
In order to use the tool you will need an EntraID application with the following delegated microsoft graph api permissions:
To create an application go to "App registration" tab and select "New registration" option.
Also, when creating the application, make sure you mark the following option as "yes":
Add a secret to the application.
After you created the application you need to fill the config.cfg file:
clientId = application id
clientSecret = application secret
tenantId = tenant id
