Monkey365

https://silverhack.github.io/monkey365/
Admin
Monkey365 is an open-source security tool used to conduct Microsoft 365, Azure subscription, and...
Tokens:25,825
Snippets:275
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install MkDocs dependencies and serve documentation

Source: https://silverhack.github.io/monkey365/license/license-contributing

Run these commands inside the Monkey365 repository folder to install documentation dependencies and start a local MkDocs server. The documentation will be served on localhost:8000.

```bash
pip install -r requirements-docs.txt
mkdocs serve
```

--------------------------------

### Install and run Monkey365 with PowerShell

Source: https://silverhack.github.io/monkey365

Install the Monkey365 module and execute a security review. The example sets parameters for a Microsoft 365 instance, collects data from ExchangeOnline, MicrosoftTeams, Purview, and SharePointOnline, prompts for account selection, includes Entra ID, and exports results to HTML.

```powershell
#Install module
Install-Module Monkey365 -Scope CurrentUser
#Set params
$param = @{
    Instance = 'Microsoft365';
    Collect = 'ExchangeOnline','MicrosoftTeams','Purview','SharePointOnline';
    PromptBehavior = 'SelectAccount';
    IncludeEntraID = $true;
    ExportTo = 'HTML';
}
#Execute monkey365
Invoke-Monkey365 @param
```

--------------------------------

### Get-Help Invoke-Monkey365 -Examples - List examples

Source: https://silverhack.github.io/monkey365/getting_started/basic-usage

Displays a list of examples for Invoke-Monkey365.

```powershell
Get-Help Invoke-Monkey365 -Examples

```

--------------------------------

### Get-Help Invoke-Monkey365 -Detailed - List all options and examples

Source: https://silverhack.github.io/monkey365/getting_started/basic-usage

Displays all options and examples with detailed information for Invoke-Monkey365.

```powershell
Get-Help Invoke-Monkey365 -Detailed

```

--------------------------------

### Install Monkey365 beta version

Source: https://silverhack.github.io/monkey365/install/install-instructions

Installs a beta version of Monkey365 by adding the -AllowPrerelease parameter to the Install-Module command.

```powershell
Install-Module -Name monkey365 -Scope CurrentUser -AllowPrerelease
```

--------------------------------

### Install Monkey365 from PowerShell Gallery

Source: https://silverhack.github.io/monkey365/install/install-instructions

Installs Monkey365 for the current user using the built-in Install-Module command. Use the -Scope parameter to control installation scope (AllUsers or CurrentUser).

```powershell
Install-Module -Name monkey365 -Scope CurrentUser
```

--------------------------------

### Enable TLS 1.2 and install Monkey365

Source: https://silverhack.github.io/monkey365/install/install-instructions

If you receive a warning when installing Monkey365, you may need to explicitly enable TLS 1.2 before running the install command. This snippet sets the SecurityProtocol and then installs the module.

```powershell
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
Install-Module -Name monkey365 -Scope CurrentUser
```

--------------------------------

### Invoke-Monkey365 with ListFramework

Source: https://silverhack.github.io/monkey365/configuration/general-options

Example of using the ListFramework flag to list available frameworks.

```powershell
Invoke-Monkey365 -ListFramework

```

--------------------------------

### Slack logger configuration example

Source: https://silverhack.github.io/monkey365/logging/Slack

Example configuration for the Slack logger plugin. It includes a default file logger and a Slack logger that sends only exceptions to the specified Slack channel. The webHook URL is a placeholder and must be replaced with a valid Slack webhook.

```json
"logging": {
        "default":[
            {
                "name": "File",
                "type": "File",
                "configuration": {
                    "filename": "monkey365_yyyyMMddhhmmss.log",
                    "includeExceptions": false,
                    "includeDebug": false,
                    "includeVerbose": false,
                    "includeError": false
                }
            }
        ],
        "loggers": [
            {
                "name": "Slack",
                "type": "Slack",
                "configuration": {
                    "webHook": "https://hooks.slack.com/services/00000000000/00000000000/00000000000000000",
                    "icon_emoji": ":ghost:",
                    "username": "monkey365",
                    "channel": "#monkey365",
                    "onlyExceptions": true
                }
            }
        ]
    }
```

--------------------------------

### Scan specific subscriptions with -Subscriptions

Source: https://silverhack.github.io/monkey365/configuration/azure-options

PowerShell example using Invoke-Monkey365 with the -Subscriptions parameter to scan a list of subscription IDs in one execution. The parameter accepts space-separated GUIDs.

```powershell
$param = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    subscriptions = '00000000-0000-0000-0000-000000000000 11111111-1111-1111-1111-111111111111';
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'PRINT';
}
$assets = Invoke-Monkey365 @param
```

--------------------------------

### File logger configuration example

Source: https://silverhack.github.io/monkey365/logging/File

Example configuration for the File logger plugin, showing default and logger channel settings. The default channel writes to monkey365_yyyyMMddhhmmss.log with exceptions, debug, verbose, and error disabled. The logger channel writes to monkey365_exceptions_yyyyMMddhhmmss.log with exceptions, debug, and verbose enabled, and info disabled.

```json
"logging": {
        "default":[
            {
                "name": "File",
                "type": "File",
                "configuration": {
                    "filename": "monkey365_yyyyMMddhhmmss.log",
                    "includeExceptions": false,
                    "includeDebug": false,
                    "includeVerbose": false,
                    "includeError": false
                }
            }
        ],
        "loggers":[
            {
                "name": "File",
                "type": "File",
                "configuration": {
                    "filename": "monkey365_exceptions_yyyyMMddhhmmss.log",
                    "includeExceptions": true,
                    "includeDebug": true,
                    "includeVerbose": true,
                    "includeInfo": false
                }
            }
        ]
    }
```

--------------------------------

### Example JSON exclusion file

Source: https://silverhack.github.io/monkey365/configuration/azure-options

Example of a JSON exclusion file with multiple exclusions for Azure VMs, storage accounts, resource groups, and containers, each with a pattern and justification.

```json
{
    "title": "Azure exclusion list",
    "exclusions": [
        {
            "code": "Azure VMs",
            "suppress": {
                "pattern": "*excludedmachine*",
                "justification": "Controlled by Third-Party integrations"
            }
        },
        {
            "code": "Azure Storage account",
            "suppress": {
                "pattern": "*excludedstorageaccount*",
                "justification": "Controlled by Third-Party integrations"
            }
        },
        {
            "code": "Azure Resource Group",
            "suppress": {
                "pattern": "*resourceGroups/excludedrg*",
                "justification": "Controlled by Third-Party integrations"
            }
        },
        {
            "code": "Azure Containers",
            "suppress": {
                "pattern": "*resourceGroups/Containers*",
                "justification": "Controlled by Third-Party integrations"
            }
        }
    ]
}
```

--------------------------------

### Register-Monkey365Application with default settings

Source: https://silverhack.github.io/monkey365/authentication/sp_authentication/automatic_setup

Run the utility with default settings from the Monkey365 installation directory. This creates an Entra ID application with permissions for the specified services and generates a certificate.

```powershell
$p = @{
    TenantId = '00000000-0000-0000-0000-000000000000';
    Services = 'ExchangeOnline','MicrosoftGraph','MicrosoftTeams','SharePointOnline';
}
Register-Monkey365Application @p
```

--------------------------------

### Scan all subscriptions with -AllSubscriptions

Source: https://silverhack.github.io/monkey365/configuration/azure-options

PowerShell example using Invoke-Monkey365 with the -AllSubscriptions parameter set to $true to scan all subscriptions the identity has access to.

```powershell
$param = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    AllSubscriptions = $true;
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'PRINT';
}
$assets = Invoke-Monkey365 @param
```

--------------------------------

### Custom ruleset example with one rule

Source: https://silverhack.github.io/monkey365/security_checks/custom-rule

This JSON ruleset example shows how to include a custom rule in a ruleset. It references the rule file 'exchange-remote-powershell-enabled.json' and enables it with a medium level.

```json
{
    "about": "My custom ruleset",
    "rules": {
        "exchange-users-remote-powershell-enabled.json": [
            {
                "enabled": true,
                "level": "medium"
            }
        ]
    }
}
```

--------------------------------

### Example JSON output from Monkey365 export

Source: https://silverhack.github.io/monkey365/exporting/export-json

Example JSON output from Monkey365 export. Shows the structure of a finding, including metadata, severity, status, findingInfo, resources, cloud account, and remediation details. Useful for understanding the JSON schema and expected fields.

```json
{
  "metadata": {
    "eventCode": "aad_sbd_enabled",
    "product": {
      "name": "Monkey365",
      "vendorName": "Monkey365",
      "version": "0.98"
    },
    "version": "1.1.0"
  },
  "severityId": 0,
  "severity": "Unknown",
  "status": "New",
  "statusCode": "pass",
  "statusDetail": null,
  "statusId": 1,
  "unmapped": {
    "provider": "EntraID",
    "pluginId": "aad0024",
    "apiType": "EntraIDPortal",
    "resource": "EntraIDPortal"
  },
  "activityName": "Create",
  "activityId": 1,
  "findingInfo": {
    "createdTime": "2024-08-21T11:47:48Z",
    "description": "Security defaults in Microsoft Entra ID (Azure Active Directory) make it easier to be secure and help protect your organization. Security defaults
 contain preconfigured security settings for common attacks.Microsoft is making security defaults available to everyone. The goal is to ensure that all organizations 
have a basic level of security-enabled at no extra cost. The use of security defaults however will prohibit custom settings which are being set with more advanced set
tings.",
    "productId": "Monkey365",
    "title": "Ensure Security Defaults is disabled on Microsoft Entra ID",
    "id": "Monkey365-aad-sbd-enabled-a4807c0361194a9a9da91e02458bd3ff-zxuQ2OfB3Ag"
  },
  "resources": {
    "cloudPartition": "6",
    "region": null,
    "data": null,
    "group": {
      "name": "General"
    },
    "labels": null,
    "name": null,
    "type": null,
    "id": null
  },
  "categoryName": "Findings",
  "categoryId": 2,
  "className": "Detection",
  "classId": 2004,
  "cloud": {
    "account": {
      "name": "Contoso",
      "type": "AzureADAccount",
      "typeId": "6",
      "id": "a4807c03-6119-4a9a-9da9-1e02458bd3ff"
    },
    "organization": {
      "name": "Contoso",
      "id": "a4807c03-6119-4a9a-9da9-1e02458bd3ff"
    },
    "provider": "Microsoft365",
    "region": "global"
  },
  "time": "2024-08-21T11:47:48Z",
  "remediation": {
    "description": "From Azure Console1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.2. Bro
wse to Microsoft Entra ID  Properties.3. Select Manage security defaults.4. Set the Enable security defaults toggle to No.5. Select Save.",
    "references": [
      "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions",
      "http://www.rebeladmin.com/2019/04/step-step-guide-restrict-azure-ad-administration-portal/",
      "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults",
      "https://techcommunity.microsoft.com/t5/azure-active-directory-identity/introducing-security-defaults/ba-p/1061414"
    ]
  },
  "typeId": 200401,
  "typeName": "Create"
}
```

--------------------------------

### Invoke-Monkey365 with Compress

Source: https://silverhack.github.io/monkey365/configuration/general-options

Example of using the Compress flag to compress output data into a single zip file. The command specifies Instance, Collect, ExportTo, and Compress.

```powershell
Invoke-Monkey365 -Instance Microsoft365 -Collect ExchangeOnline -ExportTo HTML -Compress

```

--------------------------------

### Install Monkey365 via Git

Source: https://silverhack.github.io/monkey365/install/install-instructions

Clones the Monkey365 repository into the PowerShell Modules directory. The commands change to the module directory, clone the repository, and return to the original location.

```powershell
# change path to Module directory
PS C:\Users\monkeyuser> Push-Location ~\Documents\WindowsPowerShell\Modules

# clone repository
PS C:\Users\monkeyuser\Documents\WindowsPowerShell\Modules> git clone https://github.com/silverhack/monkey365.git

# return to original location
PS C:\Users\monkeyuser\Documents\WindowsPowerShell\Modules> Pop-Location
```

--------------------------------

### Client certificate in command-line flag

Source: https://silverhack.github.io/monkey365/authentication/authFlows/sp

Authenticate to Monkey365 using a client certificate. The certificate file path and password are provided. This example collects SharePointOnline data and exports to HTML.

```powershell
$param = @{
    ClientId = '00000000-0000-0000-0000-000000000000';
    certificate = 'C:\monkey365\testapp.pfx';
    CertFilePassword = ("MySuperCertSecret" | ConvertTo-SecureString -AsPlainText -Force);
    Instance = 'Microsoft365';
    Collect = 'SharePointOnline';
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = @("HTML");
}
Invoke-Monkey365 @param
```

--------------------------------

### Export to HTML with Invoke-Monkey365

Source: https://silverhack.github.io/monkey365/exporting/export-html

Use this PowerShell example to export all data to an HTML file. It sets parameters for Azure instance, collection scope, prompt behavior, all subscriptions, tenant ID, and export format.

```powershell
$param = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    AllSubscriptions = $true;
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'HTML';
}
Invoke-Monkey365 @param
```

--------------------------------

### Monkey365 configuration file example for Microsoft Entra ID API

Source: https://silverhack.github.io/monkey365/configuration/configuration-file

Example configuration for Monkey365 that sets the Microsoft Entra ID API version to 1.6 and enables the getUsersWithAADInternalAPI key to true, causing the tool to use the internal (1.61-internal) API version for extracting Microsoft Entra ID user information. Boolean values are case-insensitive and represented as True (enabled) or False (disabled).

```json
"entraId": {
    "useMsGraph": "true",
    "forceRequestMFA": "false",
    "getUsersWithAADInternalAPI": "true",
    "auditLog":{
        "enabled": "false",
        "AuditLogDaysAgo": "-7"
    },
    "provider": {
        "graph":{
            "api_version": "1.6",
            "internal_api_version": "1.61-internal"
        },
        "portal":{
            "GetManagedApplicationsByPrincipalId": "true"
        },
        "msgraph":{
            "api_version": "V1.0"
        }
    }
}
```

--------------------------------

### Invoke-Monkey365 with IncludeEntraID

Source: https://silverhack.github.io/monkey365/configuration/general-options

Example of using the IncludeEntraID flag to scan a Microsoft Entra ID tenant. The command uses a parameter splat with Instance, Collect, PromptBehavior, IncludeEntraID, and ExportTo.

```powershell
$param = @{
    Instance = 'Microsoft365';
    Collect = 'ExchangeOnline';
    PromptBehavior = 'SelectAccount';
    IncludeEntraID = $true;
    ExportTo = 'HTML';
}
Invoke-Monkey365 @param

```

--------------------------------

### Import monkey365 from PSModulePath

Source: https://silverhack.github.io/monkey365/install/install-instructions

Use this command when monkey365 is installed in a directory listed in the PSModulePath environment variable. It loads the module into the current PowerShell session.

```powershell
Import-Module monkey365

```

--------------------------------

### Rule condition query example

Source: https://silverhack.github.io/monkey365/security_checks/overview

Defines a query block with conditions using operators 'and' and 'or'. The example shows a filter with two condition groups: one requiring 'isEnabled' to equal 'True' and 'policyName' to match 'Built-In', and another with an 'or' group checking 'Policy.ScanUrls', 'Policy.AllowClickThrough', and 'Policy.EnableLinksForEmail' values. Multiple PowerShell comparison operators are supported.

```json
{
  "query": [
    {
      "operator": "and",
      "filter": [
        {
          "conditions": [
            [
              "isEnabled",
              "eq",
              "True"
            ],
            [
              "policyName",
              "match",
              "Built-In"
            ]
          ],
          "operator": "and"
        },
        {
          "conditions": [
            [
              "Policy.ScanUrls",
              "eq",
              "False"
            ],
            [
              "Policy.AllowClickThrough",
              "eq",
              "True"
            ],
            [
              "Policy.EnableSafeLinksForEmail",
              "eq",
              "False"
            ]
          ],
          "operator": "or"
        }
      ]
    }
  ]
}
```

--------------------------------

### Default Table configuration from azure-storage-accounts-https-traffic-enabled.json

Source: https://silverhack.github.io/monkey365/exporting/export-html

Use this JSON to render data in a default table format. This example is from the azure-storage-accounts-https-traffic-enabled.json Monkey365 rule, used for the 'Storage accounts missing key rotation' finding.

```json
{
    "data": {
        "properties": {
          "name": "Name",
          "CreationTime": "Creation Time",
          "location": "Location",
          "supportsHttpsTrafficOnly": "Https Only"
        },
        "expandObject": null
      },
      "table": "default",
      "decorate": [

      ],
      "emphasis": [

      ]
}

```

--------------------------------

### Exclude resources with -ExcludedResources

Source: https://silverhack.github.io/monkey365/configuration/azure-options

PowerShell example using Invoke-Monkey365 with the -ExcludedResources parameter pointing to a JSON file. The parameter only accepts a JSON file path.

```powershell
$param = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    AllSubscriptions = $true;
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExcludedResources = 'C:\temp\az_excluded_resources.json';
    ExportTo = 'HTML';
}
Invoke-Monkey365 @param
```

--------------------------------

### Run Monkey365 with custom ruleset using RuleSet parameter

Source: https://silverhack.github.io/monkey365/security_checks/custom-ruleset

Use this PowerShell snippet to run Monkey365 with a custom ruleset file. The RuleSet parameter points to the JSON ruleset file, and the example uses Microsoft365 instance, ExchangeOnline collection, SelectAccount prompt behavior, a placeholder TenantID, and HTML export.

```powershell
$param = @{
    Instance = 'Microsoft365';
    Collect = 'ExchangeOnline';
    PromptBehavior = 'SelectAccount';
    TenantID = '00000000-0000-0000-0000-000000000000';
    RuleSet = C:\temp\myruleset.json;
    ExportTo = 'HTML';
}
Invoke-Monkey365 @param

```

--------------------------------

### Table As List configuration from azure-app-services-ad-managed-identity-missing.json

Source: https://silverhack.github.io/monkey365/exporting/export-html

Use this JSON to render data in a single table formatted 'as list'. The 'emphasis' field highlights the 'Principal ID' property. This example is from the azure-app-services-ad-managed-identity-missing.json Monkey365 rule.

```json
{
    "data": {
        "properties": {
          "name": "Application Name",
          "kind": "Kind",
          "location": "Location",
          "properties.defaultHostName": "HostName",
          "properties.httpsOnly": "Https Only",
          "identity.principalId": "Principal ID",
          "appConfig.properties.ftpsState": "SSL FTP",
          "appConfig.properties.minTlsVersion": "TLS Version",
          "appConfig.properties.siteAuthSettings.Enabled": "Site Auth Enabled"
        },
        "expandObject": null
      },
      "table": "asList",
      "decorate": [

      ],
      "emphasis": [
        "Principal ID"
      ]
}

```

--------------------------------

### Invoke-Monkey365 with manually retrieved access token

Source: https://silverhack.github.io/monkey365/authentication/manual_token_retrieval

Use this PowerShell hash table to pass a manually obtained Microsoft Graph access token to Invoke-Monkey365. The token, represented by the placeholder 'ey0....', must be replaced with the actual token string. The example sets the tenant ID, exports to HTML, and enables verbose output.

```powershell
$graph = "ey0...."

$p = @{
    AccessToken = $graph;
    IncludeEntraId = $true;
    TenantId = "00000000-0000-0000-0000-000000000000";
    ExportTo = @('HTML');
    Verbose = $true;
    InformationAction = "Continue"
}
Invoke-Monkey365 @p
```

--------------------------------

### Get-Help Invoke-Monkey365 - List available options

Source: https://silverhack.github.io/monkey365/getting_started/basic-usage

Displays the list of available command line options for Invoke-Monkey365.

```powershell
Get-Help Invoke-Monkey365

```

--------------------------------

### List All Rules for Azure with -ListRule

Source: https://silverhack.github.io/monkey365/configuration/general-options

Lists all rules available for the Azure instance. Set the Instance parameter to "Azure" and ListRule to $true before calling Invoke-Monkey365.

```powershell
$p = @{
    Instance = "Azure";
    ListRule = $true
}
Invoke-Monkey365 @p

```

--------------------------------

### Build Linux Docker image with build.ps1

Source: https://silverhack.github.io/monkey365/docker/docker

Use this command to create a Monkey365 Docker image based on Ubuntu for Linux. The script is located in the root folder and accepts parameters for image name, version, and Dockerfile path.

```powershell
.\build.ps1 -Name monkey365 -version latest -Path .\docker\Dockerfile_linux
```

--------------------------------

### Build Windows Docker image with build.ps1

Source: https://silverhack.github.io/monkey365/docker/docker

Use this command to create a Monkey365 Docker image based on Windows Server Core. The script is located in the root folder and accepts parameters for image name, version, and Dockerfile path.

```powershell
.\build.ps1 -Name monkey365 -version latest -Path .\docker\Dockerfile_windows
```

--------------------------------

### Client secret in command-line flag

Source: https://silverhack.github.io/monkey365/authentication/authFlows/sp

Authenticate to Monkey365 using a client secret. The secret is converted to a secure string and passed in the parameter hashtable. This example collects all data and exports to HTML.

```powershell
$param = @{
    ClientId = '00000000-0000-0000-0000-000000000000';
    ClientSecret = ("MySuperClientSecret" | ConvertTo-SecureString -AsPlainText -Force)
    Instance = 'Azure';
    Collect = 'All';
    subscriptions = '00000000-0000-0000-0000-000000000000';
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = @("HTML");
}
Invoke-Monkey365 @param
```

--------------------------------

### Manual admin consent steps

Source: https://silverhack.github.io/monkey365/authentication/sp_authentication/automatic_setup

After registering the application, manually grant admin consent for required permissions by navigating through Azure Entra ID.

```text
* Azure Entra ID > App registrations
* Select the Monkey365 app
* Go to API permissions, and click !Grant admin consent for *your organisation*.
```

--------------------------------

### List All Rules for Microsoft 365 with -ListRule

Source: https://silverhack.github.io/monkey365/configuration/general-options

Lists all rules available for the Microsoft 365 instance. Set the Instance parameter to "Microsoft365" and ListRule to $true before calling Invoke-Monkey365.

```powershell
$p = @{
    Instance = "Microsoft365";
    ListRule = $true
}
Invoke-Monkey365 @p

```

--------------------------------

### showModalButton configuration for raw data modal

Source: https://silverhack.github.io/monkey365/exporting/export-html

Set 'showModalButton' to 'True' to display a modal button for raw data. This feature is only supported in tables formatted as 'default'. The example shows the 'actions' object with 'objectData' and 'showModalButton'.

```json
{
    "actions": {
        "objectData": {
          "expand": [
            "name",
            "location",
            "ResourceGroupName",
            "CreationTime",
            "supportsHttpsTrafficOnly"
          ],
          "limit": null
        },
        "showModalButton": "True"
      }
}

```

--------------------------------

### Import JSON data in Python

Source: https://silverhack.github.io/monkey365/exporting/exporting-data

Loads Monkey365 JSON report data into a Python script using the json module. Assumes the report was previously exported to JSON format. The file path is an example; adjust to your actual output path.

```python
import json

file = 'C:/temp/monkey365-output/00000000-0000-0000-0000-000000000000/json/monkey3650000000000000000000000000000000020240902155926.json'

with open(file) as f:

    json_data = json.load(f)

    return json_data

```

--------------------------------

### Register-Monkey365Application with custom certificate

Source: https://silverhack.github.io/monkey365/authentication/sp_authentication/automatic_setup

Override default settings by specifying a custom certificate path. The utility will use the provided certificate instead of generating one.

```powershell
$p = @{
    TenantId = '00000000-0000-0000-0000-000000000000';
    Services = 'ExchangeOnline','MicrosoftGraph','MicrosoftTeams','SharePointOnline';
    Certificate = 'C:\Monkey365.cer'
}
Register-Monkey365Application @p
```

--------------------------------

### Invoke-Monkey365 with ExportTo CLIXML

Source: https://silverhack.github.io/monkey365/exporting/export-clixml

Use this PowerShell snippet to export a Monkey365 report to CLIXML format. The `ExportTo` parameter is set to 'CLIXML' to serialize the report as XML. The example includes common parameters like `Instance`, `Collect`, `PromptBehavior`, `AllSubscriptions`, and `TenantID`.

```powershell
$p = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    AllSubscriptions = $true;
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'CLIXML';
}
Invoke-Monkey365 @p
```

--------------------------------

### Local HTML Report Configuration

Source: https://silverhack.github.io/monkey365/exporting/export-html

Configuration for serving HTML assets from a local server. Set localHtmlReport.enabled to true and configure assetsPath with the base URL where static assets are hosted.

```json
"htmlSettings": {
    "convertPassFindingToGood": true,
    "assets": {
        "repository": "https://github.com/silverhack/monkey365assets",
        "branch": "main",
        "useLatestTag": "true"
    },
    "localHtmlReport": {
        "assetsPath": "http(s)://your_local_server/localassets/",
        "enabled": "false"
    },
    "htmlReportFromCDN": "true"
}
```

--------------------------------

### Run Monkey365 container with volume mapping

Source: https://silverhack.github.io/monkey365/docker/docker

Run the Monkey365 container with a volume mapping to persist reports. The command uses the --volume flag to map a host directory to the container's monkey-reports directory.

```bash
docker run -it --env-file monkey.env `
               -volume=C:\temp:/home/monkey365/monkey365/monkey-reports `
               monkey365 pwsh "/home/monkey365/monkey365/monkey365.ps1"
```

--------------------------------

### Configure File and Slack channels in logging configuration

Source: https://silverhack.github.io/monkey365/logging/channels

Defines two channels in the logging configuration: a File channel that writes logs to a file with optional exception/debug/verbose/error inclusion, and a Slack channel that sends messages to a Slack webhook with options for user, icon, username, channel, and exception-only logging.

```json
"logging": {
        "default":[
            {
                "name": "File",
                "type": "File",
                "configuration": {
                    "filename": "monkey365_yyyyMMddhhmmss.log",
                    "includeExceptions": false,
                    "includeDebug": false,
                    "includeVerbose": false,
                    "includeError": false
                }
            }
        ],
        "loggers":[
            {
                "name": "File",
                "type": "File",
                "configuration": {
                    "filename": "monkey365_exceptions_yyyyMMddhhmmss.log",
                    "includeExceptions": true,
                    "includeDebug": true,
                    "includeVerbose": true,
                    "includeInfo": false
                }
            },
            {
                "name": "Slack",
                "type": "Slack",
                "configuration": {
                    "webHook": "https://hooks.slack.com/services/00000000000/00000000000/00000000000000000",
                    "as_user": "false",
                    "icon_emoji": ":ghost:",
                    "username": "monkey365",
                    "channel": "#monkey365",
                    "onlyExceptions": true
                }
            }
        ]
    }
```

--------------------------------

### Invoke-Monkey365 with SpoSites for SharePoint Online

Source: https://silverhack.github.io/monkey365/configuration/microsoft365-options

Use this PowerShell snippet to run Monkey365 against Microsoft 365 with a manually specified SharePoint Online site URL. The SpoSites parameter is required when Monkey365 cannot automatically detect the root SharePoint URL. The example collects ExchangeOnline, MicrosoftTeams, Purview, and SharePointOnline data, prompts for account selection, includes Entra ID, and exports to HTML.

```powershell
$p = @{
    Instance = 'Microsoft365';
    Collect = @('ExchangeOnline','MicrosoftTeams','Purview','SharePointOnline');
    PromptBehavior = 'SelectAccount';
    IncludeEntraID = $true;
    ExportTo = 'HTML';
    SpoSites = "https://your-domain.sharepoint.com";
}
Invoke-Monkey365 @p
```

--------------------------------

### Invoke-Monkey365 - Retrieve Azure subscription and tenant with interactive login

Source: https://silverhack.github.io/monkey365/getting_started/basic-usage

Retrieves information from a specific Azure subscription and tenant and prints results to a local variable. If credentials are not supplied, Monkey365 will prompt for credentials.

```powershell
$param = @{
    Instance = 'Azure';
    Collect = 'All';
    PromptBehavior = 'SelectAccount';
    Subscriptions = '00000000-0000-0000-0000-000000000000';
    TenantID = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'PRINT';
}
$assets = Invoke-Monkey365 @param

```

--------------------------------

### Invoke-Monkey365 with ROPC credentials

Source: https://silverhack.github.io/monkey365/authentication/authFlows/ropc

Uses Get-Credential to obtain user credentials and passes them to Invoke-Monkey365 with the UserCredentials parameter. Requires a valid TenantId and specifies collection of SharePointOnline and ExchangeOnline data with output to PRINT.

```powershell
$cred = Get-Credential

$param = @{
    Instance = 'Microsoft365';
    Collect = 'SharePointOnline','ExchangeOnline';
    UserCredentials = $cred;
    TenantId = '00000000-0000-0000-0000-000000000000';
    ExportTo = 'PRINT';
}

$assets = Invoke-Monkey365 @param
```

--------------------------------

### Import monkey365 from explicit path

Source: https://silverhack.github.io/monkey365/install/install-instructions

Use this command when monkey365 is not located on a PSModulePath path. Provide the full path to the module file or directory.

```powershell
Import-Module C:\temp\monkey365

```

--------------------------------

### CSV Headers for Azure

Source: https://silverhack.github.io/monkey365/exporting/export-csv

Lists the column names included in the CSV export for Azure scans.

```text
TIMESTAMP
TENANTID
TENANTNAME
SUBSCRIPTIONID
SUBSCRIPTIONNAME
UNIQUEID
PROVIDER
FINDINGID
FINDINGTITLE
FINDINGTYPE
FINDINGTAGS
SERVICENAME
SEVERITYID
SEVERITY
FINDINGDESCRIPTION
FINDINGRATIONALE
FINDINGREMEDIATION
FINDINGREFERENCEURL
RESOURCELOCATION
STATUS
RESOURCETYPE
RESOURCEID
RESOURCENAME
RESOURCEGROUP
RESOURCETAGS
COMPLIANCE
NOTES
MONKEY365VERSION
```
Tokens:
Raw