WRKLOG-2026-06-02

d001 open cert-renewal
# View: partials/cert-audit-output-2026-06-02.adoc

Android Scanner → CHLA_Staff SSID (802.1X)
    → ISE RADIUS Authentication:
        Device cert from Intune MDM (SCEP/PKCS) — no user identity needed
    → ISE RADIUS Authorization:
        Match on: certificate CN/SAN + endpoint identity group + MDM compliance
        Result: DACL/VLAN for scanner devices

Sachin: Hi Argam - any updates from your end. We were onsite and had
the test devices. Not sure if they are configured to be used with
chla staff network

Sachin: Hi Argam - Any updates on the 2 test devices - We are onsite
today and our next onsite is on 8th

Argam: Hi Sachin — I will need to work with Evan before setting these
up. As the security appliance need AD identity that these shared
device don't have

Sachin: ok - then we will wait to hear back. let me know if you have
a ETA so that we could plan our onsites accordingly. its a 3 hour
drive for us - me and Truptesh so we plan accordingly based on other
priorities

Argam: I have asked Evan for a quick call, will decide and update
after our discussion

Sachin: awesome. Thank you so much

# One MAC per line

dsource d001 dev/network/ise

# Replace with actual MAC
curl -sk "https://$ISE_PAN_FQDN:$ISE_ERS_PORT/ers/config/endpoint?filter=mac.EQ.AA:BB:CC:DD:EE:FF" \
  -u "$ISE_API_USER:$ISE_API_PASS" \
  -H "Accept: application/json" | jq '.SearchResult.total, .SearchResult.resources[]'

# Save Alex's MACs to file
cat > /tmp/alex-pena-macs.txt << 'EOF'
# paste MACs here
EOF

# Run batch check
source scripts/ise-check-macs.sh /tmp/alex-pena-macs.txt

# Build a SQL IN clause from the MAC file
macs=$(awk '{printf "'\''%s'\'',",$0}' /tmp/alex-pena-macs.txt | sed 's/,$//')

dc_query "
SELECT
    calling_station_id AS mac,
    username,
    identity_group,
    endpoint_profile,
    authentication_protocol,
    passed,
    failed,
    timestamp_timezone
FROM radius_authentications_week
WHERE calling_station_id IN ($macs)
ORDER BY timestamp_timezone DESC
FETCH FIRST 50 ROWS ONLY
"

dc_query "
SELECT
    e.mac_address,
    e.endpoint_policy AS profile,
    g.name AS identity_group,
    e.endpoint_ip,
    e.hostname,
    e.static_assignment,
    e.create_time_without_tz,
    e.update_time_without_tz
FROM endpoints_data e
LEFT JOIN endpoint_identity_groups g ON e.identity_group_id = g.id
WHERE e.mac_address IN ($macs)
ORDER BY e.mac_address
"

dsource d001 dev/network/ise
dc-run-sql data/d001/projects/linux-research/sql/linux-inventory-summary.sql /tmp/linux-inventory-summary.json

dc-run-sql data/d001/projects/linux-research/sql/linux-inventory-ise-profiler.sql /tmp/linux-inventory-profiler.json

dc-run-sql data/d001/projects/linux-research/sql/linux-inventory-ise-radius.sql /tmp/linux-inventory-radius.json

dc-run-sql data/d001/projects/linux-research/sql/linux-inventory-ise-unknown.sql /tmp/linux-inventory-unknown.json

jq -r '(.[0] | keys_unsorted) as $k | $k, (.[] | [.[$k[]]] | map(tostring)) | @csv' \
  /tmp/linux-inventory-profiler.json > /tmp/linux-inventory-access-layer.csv

// All Linux syslog sources — last 7 days
Syslog
| where TimeGenerated > ago(7d)
| where Computer != ""
| summarize
    LastSeen = max(TimeGenerated),
    EventCount = count()
    by Computer, HostIP, Facility
| order by EventCount desc

// Linux hosts by kernel identifier in syslog
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("Linux", "kernel:", "systemd")
| summarize
    LastSeen = max(TimeGenerated),
    EventCount = count()
    by Computer, HostIP
| order by EventCount desc

// CommonSecurityLog — Linux security events (if CEF-forwarded)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has_any ("linux", "syslog")
| summarize count() by DeviceVendor, DeviceProduct, SourceIP
| order by count_ desc

! Run on DC core/distribution switches
show ip arp | include Vlan
show ip arp vrf <vrf-name> | include Vlan

! DHCP leases (if centralized DHCP)
show ip dhcp binding

! MAC address table — which port, which VLAN
show mac address-table | include <vlan-id>

# After collecting IPs from ARP dumps
while read -r ip; do
    host=$(dig +short -x "$ip" 2>/dev/null)
    printf '%s\t%s\n' "$ip" "${host:-(no PTR)}"
done < /tmp/dc-linux-ips.txt | tee /tmp/linux-dns-reverse.txt

Connect-PnPOnline -Url "https://chla.sharepoint.com/sites/InfoSec" -Interactive

# Broad search — any ISE cert docs
Submit-PnPSearchQuery -Query "ISE certificate renewal" -MaxResults 30 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title    = $_["Title"]
    Path     = $_["Path"]
    Modified = $_["LastModifiedTime"]
    Author   = $_["Author"]
  }} | Format-Table -AutoSize

# CSR files
Submit-PnPSearchQuery -Query "filename:ISE filetype:csr OR filetype:pem OR filetype:cer OR filetype:pfx" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { $_["Title"], $_["Path"] }

# Any cert-related Excel tracking sheets
Submit-PnPSearchQuery -Query "filetype:xlsx certificate ISE expiry OR renewal OR expiration" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title = $_["Title"]
    Path  = $_["Path"]
  }} | Format-Table -AutoSize

Submit-PnPSearchQuery -Query "ISE certificate change request OR iTrack OR CR" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title = $_["Title"]
    Path  = $_["Path"]
    Modified = $_["LastModifiedTime"]
  }} | Format-Table -AutoSize

# Cisco TAC cases related to ISE certs
Submit-PnPSearchQuery -Query "Cisco TAC ISE certificate" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { $_["Title"], $_["Path"] }

# CA-related (AD CS, Entrust, DigiCert)
Submit-PnPSearchQuery -Query "certificate authority CHLASUBCA OR Entrust OR DigiCert" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { $_["Title"], $_["Path"] }

Submit-PnPSearchQuery -Query "ISE runbook OR SOP OR procedure certificate" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title = $_["Title"]
    Path  = $_["Path"]
    Author = $_["Author"]
  }} | Format-Table -AutoSize

# Download to local for review
Get-PnPFile -Url "/sites/InfoSec/Shared Documents/path/to/cert-renewal-procedure.docx" -Path "C:\temp" -AsFile

# Download multiple files from a folder
Get-PnPFolderItem -FolderSiteRelativeUrl "Shared Documents/ISE Certificates" -ItemType File |
  ForEach-Object {
    Get-PnPFile -Url $_.ServerRelativeUrl -Path "C:\temp\ise-certs" -AsFile
    Write-Host "Downloaded: $($_.Name)"
  }

Inbound:
  Internet → EOP (baseline) → MDO (advanced) → Mailbox
                                                  ↑
                                          Abnormal (API — behavioral AI, post-delivery)

Outbound:
  Mailbox → EOP → Internet
              ↓
         DKIM signed ✅ · SPF validated · DMARC enforced

# Install module (one-time)
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

# Connect (interactive — prompts for MFA)
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Verify connection
Get-OrganizationConfig | Select-Object Name, IsDehydrated

Get-HostedContentFilterPolicy | Format-List Name, BulkThreshold, MarkAsSpamBulkMail, SpamAction, HighConfidenceSpamAction

Get-HostedContentFilterRule | Format-List Name, HostedContentFilterPolicy, SentTo, SentToMemberOf, RecipientDomainIs, State

Get-HostedOutboundSpamFilterPolicy | Format-List Name, AutoForwardingMode, RecipientLimitPerDay, ActionWhenThresholdReached

Get-HostedOutboundSpamFilterRule | Format-List Name, HostedOutboundSpamFilterPolicy, From, FromMemberOf, State

Get-AntiPhishPolicy | Format-List Name, Enabled, EnableTargetedUserProtection, TargetedUsersToProtect, EnableMailboxIntelligenceProtection, EnableSpoofIntelligence, PhishThresholdLevel

Get-AntiPhishRule | Format-List Name, AntiPhishPolicy, SentTo, SentToMemberOf, RecipientDomainIs, Priority, State

Get-AntiPhishPolicy | Where-Object { $_.TargetedUsersToProtect -ne $null } | Select-Object Name, @{N='VIPs';E={$_.TargetedUsersToProtect -join "`n"}}

Get-SafeLinksPolicy | Format-List Name, EnableSafeLinksForEmail, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, ScanUrls, EnableForInternalSenders

Get-SafeLinksRule | Format-List Name, SafeLinksPolicy, SentTo, SentToMemberOf, RecipientDomainIs, State

Get-SafeAttachmentPolicy | Format-List Name, Enable, Action, ActionOnError, Redirect, RedirectAddress

Get-SafeAttachmentRule | Format-List Name, SafeAttachmentPolicy, SentTo, SentToMemberOf, RecipientDomainIs, State

Get-AtpPolicyForO365 | Format-List EnableATPForSPOTeamsODB, EnableSafeDocs, AllowSafeDocsOpen

Get-DkimSigningConfig | Format-List Domain, Enabled, Status, Selector1CNAME, Selector2CNAME, LastCheckedTime

# Set-DkimSigningConfig -Identity "yourdomain.com" -Enabled $true

# DMARC is DNS-based, but MDO honors it:
Get-AntiPhishPolicy | Format-List Name, HonorDmarcPolicy, DmarcQuarantineAction, DmarcRejectAction

Get-TransportRule | Format-List Name, State, Priority, Mode, Description

Get-TransportRule -Identity "External Sender Disclaimer" | Format-List *

Get-TransportRule | Where-Object { $_.ApplyHtmlDisclaimerText -ne $null -or $_.SetHeaderName -ne $null } | Select-Object Name, State, Priority

Get-MessageTrace -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId | Format-Table -AutoSize

Get-MessageTrace -SenderAddress "sender@external.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-Table Received, RecipientAddress, Subject, Status

Get-MessageTrace -Status "FilteredAsSpam" -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Format-Table Received, SenderAddress, Subject
Get-MessageTrace -Status "Quarantined" -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Format-Table Received, SenderAddress, Subject

Start-HistoricalSearch -ReportTitle "Abnormal Investigation" -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -ReportType MessageTrace -SenderAddress "suspect@external.com"
Get-HistoricalSearch | Format-List ReportTitle, Status, SubmitDate, Rows

Get-QuarantineMessage -StartReceivedDate (Get-Date).AddDays(-7) -EndReceivedDate (Get-Date) | Select-Object ReceivedTime, SenderAddress, RecipientAddress, Subject, Type, QuarantineTypes | Format-Table -AutoSize

Get-QuarantineMessage -MessageId "<message-id>" | Get-QuarantineMessageHeader

# Release-QuarantineMessage -Identity "<quarantine-id>" -ReleaseToAll

Get-MailDetailATPReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Select-Object Date, SenderAddress, RecipientAddress, Subject, ThreatType, DetectionMethod | Format-Table -AutoSize

Get-SafeLinksDetailReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Select-Object ClickTime, NetworkMessageId, Url, Action, IsClickedThrough | Format-Table -AutoSize

Get-TransportRule | Sort-Object WhenChanged -Descending | Format-Table Name, State, Priority, WhenChanged, CreatedBy -AutoSize

Get-TransportRule | Sort-Object WhenChanged -Descending | Select-Object -First 5 | Format-List Name, State, Priority, WhenChanged, CreatedBy, Description, Conditions, Actions, *Disclaimer*, *Header*, SentTo*, FromScope, *Domain*

Get-TransportRule | Where-Object { $_.WhenChanged -gt (Get-Date).AddDays(-7) } | Format-List Name, State, WhenChanged, CreatedBy, Description

Get-InboundConnector | Sort-Object WhenChanged -Descending | Format-Table Name, Enabled, WhenChanged, ConnectorType -AutoSize
Get-OutboundConnector | Sort-Object WhenChanged -Descending | Format-Table Name, Enabled, WhenChanged, ConnectorType -AutoSize

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations "New-TransportRule","Set-TransportRule" -ResultSize 25 | Select-Object CreationDate, UserIds, Operations, AuditData | Format-List

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType ExchangeAdmin -ResultSize 50 | Select-Object CreationDate, UserIds, Operations | Format-Table -AutoSize

Install-Module -Name ORCA -Scope CurrentUser
Connect-ExchangeOnline
Get-ORCAReport
# Generates HTML report with recommendations vs current config

# Connect first
Connect-ExchangeOnline

Write-Host "=== Anti-Spam Policies ===" -ForegroundColor Cyan
Get-HostedContentFilterPolicy | Format-Table Name, BulkThreshold, SpamAction, HighConfidenceSpamAction -AutoSize

Write-Host "`n=== Outbound Spam ===" -ForegroundColor Cyan
Get-HostedOutboundSpamFilterPolicy | Format-Table Name, AutoForwardingMode, RecipientLimitPerDay -AutoSize

Write-Host "`n=== Anti-Phish Policies ===" -ForegroundColor Cyan
Get-AntiPhishPolicy | Format-Table Name, Enabled, EnableTargetedUserProtection, PhishThresholdLevel -AutoSize

Write-Host "`n=== Safe Links ===" -ForegroundColor Cyan
Get-SafeLinksPolicy | Format-Table Name, EnableSafeLinksForEmail, EnableSafeLinksForTeams, TrackClicks -AutoSize

Write-Host "`n=== Safe Attachments ===" -ForegroundColor Cyan
Get-SafeAttachmentPolicy | Format-Table Name, Enable, Action, Redirect -AutoSize

Write-Host "`n=== DKIM ===" -ForegroundColor Cyan
Get-DkimSigningConfig | Format-Table Domain, Enabled, Status -AutoSize

Write-Host "`n=== Transport Rules ===" -ForegroundColor Cyan
Get-TransportRule | Format-Table Name, State, Priority -AutoSize

Write-Host "`n=== Global ATP Settings ===" -ForegroundColor Cyan
Get-AtpPolicyForO365 | Format-List EnableATPForSPOTeamsODB, EnableSafeDocs

Write-Host "`nAudit complete." -ForegroundColor Green

# View the output
d001 open-file abnormal

# Or decrypt directly
decrypt-file data/d001/projects/abnormal-security/partials/mdo-eop-audit-output-2026-06-02.adoc.age

Install-Module -Name PnP.PowerShell -Scope CurrentUser
Connect-PnPOnline -Url "https://chla.sharepoint.com/sites/InfoSec" -Interactive

Submit-PnPSearchQuery -Query "filename:certificate-renewal" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title    = $_["Title"]
    Path     = $_["Path"]
    Modified = $_["LastModifiedTime"]
    Author   = $_["Author"]
  }} | Format-Table -AutoSize

Submit-PnPSearchQuery -Query "ISE certificate renewal" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title  = $_["Title"]
    Path   = $_["Path"]
    Author = $_["Author"]
  }} | Format-Table -AutoSize

# Excel files about ISE
Submit-PnPSearchQuery -Query "filetype:xlsx ISE" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { $_["Title"], $_["Path"] }

# PDFs about certificates
Submit-PnPSearchQuery -Query "filetype:pdf certificate renewal" -MaxResults 20 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { $_["Title"], $_["Path"] }

# List files in a folder
Get-PnPFolderItem -FolderSiteRelativeUrl "Shared Documents" -ItemType File |
  Select-Object Name, TimeLastModified, Length | Format-Table -AutoSize

# Recursive — all files in all subfolders
Get-PnPFolderItem -FolderSiteRelativeUrl "Shared Documents" -ItemType File -Recursive |
  Select-Object Name, ServerRelativeUrl, TimeLastModified | Format-Table -AutoSize

Get-PnPFile -Url "/sites/InfoSec/Shared Documents/path/to/file.xlsx" -Path "C:\temp" -AsFile

Connect-PnPOnline -Url "https://chla-admin.sharepoint.com" -Interactive

Submit-PnPSearchQuery -Query "ISE certificate" -MaxResults 50 |
  Select-Object -ExpandProperty ResultRows |
  ForEach-Object { [PSCustomObject]@{
    Title = $_["Title"]
    Site  = $_["SPSiteUrl"]
    Path  = $_["Path"]
  }} | Format-Table -AutoSize

wc -l file.adoc

awk '{printf "%4d  %s\n", NR, $0}' file.adoc

awk 'NR>=10 && NR<=20' file.adoc

awk 'NR<=10' file.adoc            # first 10
awk 'END{start=NR-9} NR>=start' file.adoc  # last 10

grep -n '^=\+ ' file.adoc

grep -n 'include::' file.adoc

grep -n -E '^\[\[|^// tag::|^// end::|^ifdef|^endif' file.adoc

grep -n 'pattern' file.adoc

grep -n -B3 -A3 'pattern' file.adoc

grep -c 'pattern' file.adoc

awk '/^$/{printf "%4d  (blank)\n", NR}' file.adoc

cp file.adoc /tmp/file.adoc.bak
# After editing:
diff /tmp/file.adoc.bak file.adoc

# By line number
awk 'NR==25' file.adoc

# By pattern — make sure it's unique
grep -n 'pattern' file.adoc
# If count > 1, narrow with context or line range:
awk 'NR>=20 && NR<=30 && /pattern/' file.adoc

sed -i '1i\// New header line' file.adoc

sed -i '1i\// Line one\n// Line two\n// Line three' file.adoc

cat <(echo "= New Title") existing.adoc > /tmp/tmp && mv /tmp/tmp existing.adoc

awk 'BEGIN{print "// Prepended by script"} {print}' file.adoc > /tmp/tmp && mv /tmp/tmp file.adoc

# Insert after line 15
sed -i '15a\New content after line 15' file.adoc

# Insert before line 15
sed -i '15i\New content before line 15' file.adoc

sed -i '/== Summary/a\\ninclude::partial$worklog/new-section.adoc[]\n' file.adoc

sed -i '/== Related/i\\ninclude::partial$worklog/new-section.adoc[]\n' file.adoc

awk '/== Summary/{print; print ""; print "include::partial$new.adoc[]"; print ""; next} {print}' \
  file.adoc > /tmp/tmp && mv /tmp/tmp file.adoc

echo 'New last line' >> file.adoc

sed -i '/^---$/i\New content before the horizontal rule' file.adoc

# Verify first
awk 'NR==25' file.adoc

# Replace
sed -i '25s|.*|New content for line 25|' file.adoc

# Verify after
awk 'NR==25' file.adoc

sed -i 's|old content|new content|' file.adoc

sed -i '/^== Old Section$/,/^== Next Section$/c\== New Section\n\nNew content here.\n\n== Next Section' file.adoc

# 1. Before — find insertion point
grep -n 'pattern' file.adoc

# 2. Change — insert after pattern
sed -i '/pattern/a\New line after pattern' file.adoc

# 3. After — confirm
grep -n -A1 'pattern' file.adoc

grep -q 'new-section' file.adoc || sed -i '/== Summary/a\\ninclude::partial$new-section.adoc[]' file.adoc

# paste command here with real output

# paste command here with real output

# paste command here with real output

# keystroke sequence or :command here

# paste here