Home » Cyber Security » Reportly: is an AzureAD user activity report tool.

Reportly: is an AzureAD user activity report tool.

Reportly: is an AzureAD user activity report tool.

Reportly is an AzureAD user activity report tool.

About the tool

This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following:

  1. Information about the user
  2. Actions taken by the user
  3. Actions taken on the user
  4. User login and failure logs

 Example_vid.mp4 

Usage

When running the tool, a link to authentication and a device code will show, follow the link and enter the code to authenticate. 

Insert User principal name of a suspicious user.
Insert start and end times in the following format: 2022-11-16
I recommend a range of no longer than a week.

After authentication, in order to create a full report choose the option “5” 

image

When the report will be ready the tool will print “Your report is ready!”. The reports are created in the executable’s directory.

Installation

In order to use the tool you will need an AzureAD application with the following delegated microsoft graph api permissions:

  • AuditLog.Read.All
  • GroupMember.Read.All
  • RoleManagement.Read.Directory
  • User.Read
  • User.Read.All

    dont forget to grant admin consent 

To create an application go to “App registration” tab and select “New registration” option.

Reportly


Also, when creating the application, make sure you mark the following option as “yes”: 

image
  • you can find this property under the application’s “Authentication” tab.

    Add a secret to the application. 

    image

    • Go to “Certificates & secrets”
    • Add a secret
    • Immediately copy the secret to the config file (after you watch it once, it disappears)

    After you created the application you need to fill the config.cfg file:
    clientId = application id
    clientSecret = application secret
    tenantId = tenant id

    Download

    Also Read:

    Yuki Chan: The Ultimate Automate Pentest Tool

    RecoX: Ultimate Tool for Web Reconnaissance

    SpiderFoot: The Ultimate Tool for Penetration Testing

    The Best Kali Linux Tools for Ethical Hackers

    PentestGPT: A GPT-empowered penetration testing tool

    Leave a Reply