AD7.5 Building the Complete Quarterly Report

# Get-QuarterlyReport.ps1 — Quarterly Security Posture Data Collection
# Run at the start of each quarter to collect data for the report

param(
    [int]$DaysBack = 90  # Default: last quarter (90 days)
)

$startDate = (Get-Date).AddDays(-$DaysBack).ToString("yyyy-MM-ddTHH:mm:ssZ")
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "  QUARTERLY SECURITY REPORT DATA" -ForegroundColor Cyan
Write-Host "  Period: Last $DaysBack days" -ForegroundColor Cyan
Write-Host "  Generated: $(Get-Date -Format 'dd MMM yyyy HH:mm')" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan

# Connect to all required services
Connect-MgGraph -Scopes "AuditLog.Read.All","SecurityEvents.Read.All","DeviceManagementManagedDevices.Read.All" -NoWelcome
Connect-ExchangeOnline -ShowBanner:$false

# --- SECTION 2: IDENTITY ---
Write-Host "`n--- SECTION 2: IDENTITY ---" -ForegroundColor Yellow
$allSignIns = Get-MgAuditLogSignIn -Filter "createdDateTime ge $startDate" -Top 5000
$riskySignIns = ($allSignIns | Where-Object { $_.RiskLevelDuringSignIn -notin @("none","hidden") }).Count
$caBlocked = ($allSignIns | Where-Object { $_.ConditionalAccessStatus -eq "failure" }).Count
Write-Host "Total sign-ins: $($allSignIns.Count)"
Write-Host "Risky sign-ins detected: $riskySignIns"
Write-Host "Sign-ins blocked by CA: $caBlocked"

# MFA coverage
$allUsers = Get-MgUser -All -Property UserPrincipalName,AccountEnabled | Where-Object { $_.AccountEnabled }
$mfaRegistered = 0
foreach ($u in $allUsers | Select-Object -First 50) {
    $methods = (Get-MgUserAuthenticationMethod -UserId $u.UserPrincipalName -ErrorAction SilentlyContinue).Count
    if ($methods -gt 1) { $mfaRegistered++ }
}
Write-Host "MFA registered (sample): $mfaRegistered / $($allUsers.Count) users"

# --- SECTION 3: EMAIL ---
Write-Host "`n--- SECTION 3: EMAIL ---" -ForegroundColor Yellow
Write-Host "Check manually: security.microsoft.com → Reports → Threat protection status"
Write-Host "Record: phishing blocked, malware blocked, user-reported, delivered phishing"

# --- SECTION 4: DEVICES ---
Write-Host "`n--- SECTION 4: DEVICES ---" -ForegroundColor Yellow
$devices = Get-MgDeviceManagementManagedDevice -All
$compliant = ($devices | Where-Object { $_.ComplianceState -eq "compliant" }).Count
$total = $devices.Count
$rate = if ($total -gt 0) { [math]::Round($compliant / $total * 100, 1) } else { 0 }
Write-Host "Total managed devices: $total"
Write-Host "Compliant: $compliant ($rate%)"
Write-Host "Non-compliant: $($total - $compliant)"

# --- SECTION 5: DATA ---
Write-Host "`n--- SECTION 5: DATA ---" -ForegroundColor Yellow
Write-Host "Check manually: purview.microsoft.com → Data Classification → Overview"
Write-Host "Record: labeled documents %, label distribution, DLP matches, overrides"

# DLP summary
Connect-IPPSSession -ShowBanner:$false
$dlpMatches = Get-DlpDetailReport -StartDate (Get-Date).AddDays(-$DaysBack) -EndDate (Get-Date) -ErrorAction SilentlyContinue
if ($dlpMatches) {
    Write-Host "DLP matches: $($dlpMatches.Count)"
    $dlpMatches | Group-Object PolicyAction | Select-Object Name, Count | Format-Table
}

# --- SECTION 6: SECURE SCORE ---
Write-Host "`n--- SECTION 6: SECURE SCORE ---" -ForegroundColor Yellow
$score = Get-MgSecuritySecureScore -Top 1
$pct = [math]::Round($score.CurrentScore / $score.MaxScore * 100, 1)
Write-Host "Current: $($score.CurrentScore) / $($score.MaxScore) ($pct%)"

# --- SECTION 7: INCIDENTS ---
Write-Host "`n--- SECTION 7: INCIDENTS ---" -ForegroundColor Yellow
Write-Host "Check manually: weekly security log for incident count, classification"
Write-Host "Record: TP count, FP count, BTP count, mean time to detect, mean time to contain"

Write-Host "`n========================================" -ForegroundColor Green
Write-Host "  DATA COLLECTION COMPLETE" -ForegroundColor Green
Write-Host "  Paste results into report template" -ForegroundColor Green
Write-Host "========================================" -ForegroundColor Green

Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue

QUARTERLY SECURITY POSTURE REPORT
[Organization Name]
Q[X] [Year] | Prepared by: [Name] | Date: [Date]

1. EXECUTIVE SUMMARY
[4 sentences covering all layers. Example:]
"This quarter, [Organization] maintained robust security across all
layers: [X] credential attacks blocked by MFA and conditional access,
[X] phishing emails blocked by Defender for Office 365, [X]%
device compliance rate with BitLocker encryption verified, and [X]%
of documents classified with sensitivity labels. [X] security
incidents were detected and contained through weekly monitoring,
with mean time to detect of [X] hours. Secure Score maintained at
[X]% (industry benchmark: [X]%). All controls operate within the
existing E3 licence at no additional cost."

2. IDENTITY (Module AD1)
- MFA coverage: [X]% of active users
- Credential attacks blocked: [X] (CA failures from unfamiliar sources)
- Risky sign-ins detected: [X] (investigated during weekly review)
- Compromised accounts: [X] (contained via AD6.2 procedure)
- Conditional access policies active: [X] (CA001-CA003)
- Trend: [stable/improved/declined] vs last quarter

3. EMAIL (Module AD2)
- Phishing emails blocked: [X]
- Safe Links clicks blocked: [X]
- Malware attachments blocked: [X]
- User-reported suspicious emails: [X]
- Phishing emails delivered (missed by filters): [X]
- DMARC status: [p=none/quarantine/reject]
- Trend: [stable/improved/declined] vs last quarter

4. DEVICES (Module AD3)
- Compliance rate: [X]%
- Encryption coverage: [X]% (BitLocker verified)
- Unmanaged device access blocked: [X]
- Non-compliant devices remediated: [X]
- Exceptions: [X] active exceptions (reviewed quarterly)
- Trend: [stable/improved/declined] vs last quarter

5. DATA (Module AD4)
- Label adoption: [X]% of documents classified
- Label distribution: Public [X]%, Internal [X]%, Confidential [X]%,
  Highly Confidential [X]%
- DLP matches: [X] (blocked: [X], overridden: [X])
- External sharing: anonymous links disabled, [X] external users active
- Stale external access removed: [X] users this quarter
- Trend: [stable/improved/declined] vs last quarter

6. INCIDENTS AND MONITORING (Modules AD5-AD6)
- Weekly security reviews conducted: [X]/13 (target: 13/13)
- Incidents detected: [X] total ([X] TP, [X] FP, [X] BTP)
- Mean time to detect: [X] hours
- Mean time to contain: [X] minutes
- Secure Score: [X]% (vs [X]% last quarter)
- Notable incidents: [brief summary of any TP incidents]

7. NEXT STEPS AND RECOMMENDATIONS
- Completed improvements: [list from post-incident reviews]
- In-progress improvements: [list with timelines]
- Recommendations for next quarter: [prioritized list]
- E5 evaluation: [status — see AD7.9 for full business case]
- Budget requests: [if any]
- Governance status: [X]/4 policies approved, IRP tested [date]

APPENDIX: Data Sources
- Identity: Entra ID sign-in logs, Get-MgAuditLogSignIn
- Email: Defender portal → Reports → Threat protection status
- Devices: Intune compliance dashboard, Get-MgDeviceManagementManagedDevice
- Data: Purview Data Classification dashboard, Get-DlpDetailReport
- Secure Score: Get-MgSecuritySecureScore
- Incidents: Weekly security log (C:\SecurityScripts\WeeklySecurityLog.csv)