search

invictus-ir / Microsoft-Extractor-Suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
https://microsoft-365-extractor-suite.readthedocs.io/en/latest/
GNU General Public License v2.0
481 stars 68 forks source link

Update Get-UALGraph.ps1 #81

Closed angry-bender closed 4 months ago

angry-bender commented 4 months ago

Not a single file, but similar to the changes i suggested in #76. Would also fix up #75. Up to @JoeyInvictus and the project team, if a significantly large number of small JSON files would be okay, or if they should be combined after the data has been acquired

angry-bender commented 4 months ago

One issue i see in this approach for #76 and #75 is that it adds in the @odata.context, count and next link at the start of each of these JSON files, followed by the array of values

image

angry-bender commented 4 months ago

Could be worth seeing if we can increase the @odata.count in the body for the request, something im not that strong in tbh. Else for a smaller tenancy, with >400,000 UAL records, were looking at about 3,500 individual JSON files

angry-bender commented 4 months ago

Damn, seems like this method wont work either as it returns a this error after a large amount of requests to acquire

invoke-MgGraphRequest : There were not enough free threads in the ThreadPool to complete the operation.
At line:4 char:25
+ ... $response = invoke-MgGraphRequest -Method Get -Uri $apiUrl -ContentTy ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Invoke-MgGraphRequest], InvalidOperationException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest