Repository navigation
Add Copilot data loss alert resolution report to AI baseline #2564
Description
Prerequisites
- This issue has an informative and human-readable title.
- Assignee should meet with issue author before starting work.
💡 Summary
This issue proposed to enhance the new SI baseline with a "Data Loss - Alert Resolution" report at the bottom of the HTML output.
Motivation and context
We are currently building DLP policies targeting Copilot and those create alerts, but there is currently no mechanism in the ScubaGear report that would indicate if those alerts are being followed-up on by the agency's security team.
Implementation notes
This is a sample script that I designed which will report some statistics indicating whether or not the organization is following-up on Copilot alerts. If the ratio of Unresolved Alerts to Total Alerts is high, the agency would know that they are probably not effectively reviewing the alerts.
# This script shows some stats regarding unresolved DLP policy alerts
# The query goes back 90 days and fetches the top 1000 records to avoid major processing delays
Connect-MgGraph -Scopes "SecurityAlert.Read.All"
$sinceUtc = (Get-Date).ToUniversalTime().AddDays(-90).ToString("yyyy-MM-ddTHH:mm:ssZ")
$uri = "https://graph.microsoft.com/v1.0/security/alerts_v2?`$filter=serviceSource eq 'dataLossPrevention' and createdDateTime ge $sinceUtc&`$orderby=createdDateTime desc&`$top=1000"
$allAlerts = @()
# Graph returns results in pages, so follow @odata.nextLink until there are no more
do {
$response = Invoke-MgGraphRequest -Method GET -Uri $uri -OutputType PSObject
$allAlerts += $response.value
$uri = $response.'@odata.nextLink'
} while ($uri)
$alerts = $allAlerts
# $alerts | Format-List
$open = $alerts | Where-Object { $_.status -eq 'new' }
[PSCustomObject]@{
"Total Alerts" = @($alerts).Count
"Unresolved Alerts" = @($open).Count
"Oldest unresolved Alert" = ($open | Sort-Object { [datetime]$_.createdDateTime } | Select-Object -First 1).createdDateTime
} | Format-List
Write-Information "Unresolved alert stats below:" -InformationAction Continue
$open |
Group-Object title |
Sort-Object Count -Descending |
Select-Object @{Name = 'Policy'; Expression = { $_.Name }},
@{Name = 'Alerts'; Expression = { $_.Count }},
@{Name = 'AlertPolicyId'; Expression = { $_.Group[0].alertPolicyId }} |
Format-Table -AutoSize
Acceptance criteria
- Developer has designed a prototype of the enhancement and gotten feedback from the team.
- Developer has tweaked the prototype based on the feedback.
- Developer has completed necessary testing.
Activity