cisagov / Sparrow

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

cisagov/Sparrow Issues

One more time
Closed 2 years ago
How do I ingest the csv files into the dashboard?
Closed 2 years ago2
Errors connecting to Exchange environment
Closed 2 years ago
Error running in GCC High
Closed 2 years ago
Having issues running the script for Sparrow ps1
Closed 2 years ago
Aviary dashboard that works with live o365 data in Splunk
Closed 2 years ago
Run via Taskmanager
Closed 3 years ago1
How to Upload Dashboard
Closed 3 years ago3
Delete
Closed 3 years ago
Issue while running sparrow.ps1
Closed 3 years ago1
Expand Script to use Azure AD Logs and Azure Activity logs instead of Unified Audit Log
Closed 3 years ago
New-ExoPSSession : Access is denied
Closed 3 years ago3
AppId's in PSLogin_Operations_Export query not in results
Closed 3 years ago5
Add docs on how to setup/retreive credentials
Closed 3 years ago2
Unable to get the SaveAs property of the Workbook class
Closed 3 years ago18
Zero KB CSV files after running script. Good or bad?
Closed 3 years ago2
Automated Execution (Scheduled Task)
Closed 3 years ago2
detection to gather all azure app ids, and process via loop for sharepoint and exo investigation is missing
Closed 3 years ago
Choose your Azure Environment [AzureCloud]
Closed 3 years ago17
Document requirement to turn on Unified Audit Log before using Sparrow
Closed 3 years ago1
What exactly is the expected powershell output?
Closed 3 years ago7
Readme Update - Explicit Export Information
Closed 3 years ago1
"Choose Your Environment" comes up blank if AzureADPreview is installed instead of AzureAD module
Closed 3 years ago1
Feature: DeviceCode Login Flag
Closed 3 years ago2
Unable to find type error
Closed 3 years ago2
cmdlet error
Closed 3 years ago6
"An error occurred" Generic error when running this script.
Closed 4 years ago3
Cheatsheet
Closed 4 years ago6
Not Getting output to CSV when Sparrow is run
Closed 4 years ago1
Audit Log search error
Closed 4 years ago2
Invalid characters
Closed 4 years ago1
Could not load type 'Syste.Security.Cryptography.SHA256Cng'
Closed 4 years ago2
Issues found after executing script
Closed 4 years ago2
Sparrow script doesn't work under a E3 sub, correct?
Closed 4 years ago1
Exchange Online Access denied
Closed 4 years ago2
The HTTP error (12175) is: A security error occurred .
Closed 4 years ago2
Getting an I/O operation error
Closed 4 years ago4
Error when running the Script.
Closed 4 years ago7
Files in ExportDir
Closed 4 years ago4
Unable to get the SaveAs property of the Workbook class
Closed 4 years ago1
Script returns nothing
Closed 4 years ago3
PowerShell script fails with error: Unable to get the delete property of the worksheet class
Closed 4 years ago3
Azure Tenants without 0365 Email script failure
Closed 4 years ago6
Can Sparrow run without having office365 ?
Closed 4 years ago
What's the expected result we could have from this script?
Closed 4 years ago
Script fails to fetch audit logs
Closed 4 years ago3
Choose your Azure Environment prompt does not proceed
Closed 4 years ago3
What is the default directory where the csv-files should appear?
Closed 4 years ago3
Warning; Excel not found - skipping combined file.
Closed 4 years ago2
Comment Doesn't Match Actual search string
Closed 4 years ago1