azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: azcomputerguru:2efd4a4fb3d7482e16ca64ba75bf273f0650e252
Branches Tags
azcomputerguru:main
...
compare: azcomputerguru:ce8401a093251b783bff82b3033527fa8300ce96
Branches Tags
azcomputerguru:main

2 Commits
2efd4a4fb3 ... ce8401a093

Author SHA1 Message Date
Mike Swanson
ce8401a093 sync: auto-sync from GURU-5070 at 2026-06-08 21:04:39 
Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-08 21:04:39
 2026-06-08 21:05:24 -07:00
Mike Swanson
1cc03e9f23 verify(remediation): kittlearizona EXO persistence re-checked clean post role-fix 
Double-checked the 2026-06-08 BEC remediation for missed EXO-dependent items now that
the Exchange role is confirmed. Findings: malicious inbox rules gone (cleanup stuck);
all 14 mailboxes clean of fwd/redirect/delete/move rules; no mailbox forwarding; no
transport rules; no rogue delegates. Open (need Ken): Christina-Micek StopProcessing rule
+ Ken FullAccess to Accounting. Corrected stale 'Exchange Admin NOT assigned' note (it IS).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-08 21:05:24 -07:00
2 changed files with 42 additions and 1 deletions
Expand all files Collapse all files

41
.claude/scripts/_recall_proof_poller.sh Normal file
View File

@@ -0,0 +1,41 @@
#!/usr/bin/env bash
# One-shot: wait for Safe Site EXO app-only access to propagate, then pull the recall proof.
set -uo pipefail
cd "$(git rev-parse --show-toplevel)"
SK=~/.claude/skills/remediation-tool/scripts; [ -d "$SK" ] || SK=.claude/skills/remediation-tool/scripts
export VAULT_ROOT_ENV="$(jq -r '.vault_path // "D:/vault"' .claude/identity.json)"
TID=71b4e637-c802-4137-a812-ae50dbc839e3
EXURL="https://outlook.office365.com/adminapi/beta/$TID/InvokeCommand"
OUT="/c/Users/guru/Downloads/safesite-recall-proof.json"
inv(){ local tok="$1" payload="$2"; curl -s -m 90 -X POST "$EXURL" -H "Authorization: Bearer $tok" -H "Content-Type: application/json" -d "$payload" | tr -d '\000'; }
echo "[poller] waiting for EXO app-only propagation (up to ~75 min)..."
for i in $(seq 1 15); do
EOP=$(bash "$SK/get-token.sh" safesitellc.com exchange-op 2>/dev/null | tr -d '[:space:]')
RC=$(curl -s -o /dev/null -m 60 -w '%{http_code}' -X POST "$EXURL" -H "Authorization: Bearer $EOP" -H "Content-Type: application/json" -d '{"CmdletInput":{"CmdletName":"Get-OrganizationConfig","Parameters":{}}}')
echo "[poller] attempt $i: Get-OrganizationConfig HTTP $RC"
if [ "$RC" = "200" ]; then
echo "[poller] EXO READY — pulling recall proof..."
{
echo "{"
echo "\"pulled_at\":\"$(date -u +%FT%TZ)\","
echo "\"audit_freetext_SSUS\":"
inv "$EOP" '{"CmdletInput":{"CmdletName":"Search-UnifiedAuditLog","Parameters":{"StartDate":"2026-06-08","EndDate":"2026-06-09","FreeText":"SSUS 06122026","ResultSize":500}}}'
echo ","
echo "\"audit_deletes_recipients\":"
inv "$EOP" '{"CmdletInput":{"CmdletName":"Search-UnifiedAuditLog","Parameters":{"StartDate":"2026-06-08","EndDate":"2026-06-09","Operations":["HardDelete","SoftDelete","MoveToDeletedItems"],"UserIds":["beeanna@safesitellc.com","david@safesitellc.com","jeremiahw@safesitellc.com","jon@safesitellc.com","justinb@safesitellc.com","lennyg@safesitellc.com","suzannep@safesitellc.com","thomasc@safesitellc.com","travisf@safesitellc.com"],"ResultSize":500}}}'
echo ","
echo "\"message_trace_mparis\":"
inv "$EOP" '{"CmdletInput":{"CmdletName":"Get-MessageTraceV2","Parameters":{"SenderAddress":"m.paris@nexsitepartners.com","StartDate":"2026-06-08T00:00:00","EndDate":"2026-06-09T00:00:00"}}}'
echo "}"
} > "$OUT" 2>&1
echo "[poller] DONE -> $OUT"
echo "[poller] quick tally:"
echo " audit FreeText 'SSUS 06122026' rows: $(jq '.audit_freetext_SSUS.value|length' "$OUT" 2>/dev/null || echo '?')"
echo " audit delete/purge rows (recipients): $(jq '.audit_deletes_recipients.value|length' "$OUT" 2>/dev/null || echo '?')"
exit 0
fi
sleep 300
done
echo "[poller] EXO still not ready after 75 min — coord todo 7ddc8ebd remains for a later session."
exit 0

2
.claude/skills/remediation-tool/references/tenants.md
View File

@@ -37,7 +37,7 @@ that will fail the next email task; fix it with `assign-exchange-role.sh <domain
| Jema Enterprises, LLC | jemaenterprises.com | 41268042-9a8e-41c2-9a3c-0775398b86cb | NO | |
| JR Kennedy Company | jrkco.com | a92594b9-c8ad-4dba-8b40-14fcd32c723c | NO | |
| Khalsa Montessori School | khalsamontessorischools.onmicrosoft.com | b2950f9d-81f8-40e4-85d9-2854d1d4f31b | NO | |
| Kittle Design & Construction | kittlearizona.com | 3d073ebe-806a-4a5e-9035-3c7c4a264fc0 | PARTIAL | Sec Inv consented 2026-04-23; Exchange Admin role NOT assigned; Tenant Admin not consented; breach check run — Alexis + Ken inbox rules flagged |
| Kittle Design & Construction | kittlearizona.com | 3d073ebe-806a-4a5e-9035-3c7c4a264fc0 | YES | Sec Inv + Exchange Operator + Tenant Admin consented (2026-06-08 BEC remediation). Exchange Admin role IS assigned to Exch Op SP (verified 2026-06-09 — prior "NOT assigned" note was stale). BEC EXO persistence re-verified clean 2026-06-09: malicious inbox rules gone, no forwarding, no transport rules, no rogue delegates. Open (need Ken): "Christina Micek" StopProcessing rule on Ken + Ken FullAccess to Accounting. |
| LeeAnn Parkinson | lamaddux.com | 2f0c4c92-c608-4ee0-bdc2-87d5fd8fe929 | NO | |
| Marty Ryan | martylryan.com | 48581923-2153-48b9-82b3-6a3587813041 | YES | Sec Inv + Tenant Admin consented; all roles assigned 2026-04-20 |
| MVAN Enterprises, Inc | mvan.onmicrosoft.com | 5affaf1e-de89-416b-a655-1b2cf615d5b1 | NO | |