# Script d'audit permissions SharePoint - Marie RSSI
Connect-SPOService -Url https://megacorp-admin.sharepoint.com

# Vérification des sites avec permissions "Everyone"
$sites = Get-SPOSite -Limit All
foreach($site in $sites) {
    $permissions = Get-SPOSiteGroup -Site $site.Url
    if($permissions -match "Everyone") {
        Write-Host "🚨 ALERT: Site $($site.Url) has Everyone permissions!" -ForegroundColor Red
    }
}

# Check external sharing settings
Get-SPOTenant | Select ExternalSharingState, DefaultSharingLinkType

🚨 ALERT: https://megacorp.sharepoint.com/sites/tresorerie has Everyone permissions!
🚨 ALERT: https://megacorp.sharepoint.com/sites/budgets has Everyone permissions!
🚨 ALERT: https://megacorp.sharepoint.com/sites/investissements has Everyone permissions!
...
[47 autres alertes]

ExternalSharingState: ExternalUserAndGuestSharing
DefaultSharingLinkType: AnonymousAccess

# Détection contenus sensibles exposés
$sensitivePatterns = @(
    "IBAN [A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}[A-Z0-9]{1,16}",
    "Confidentiel",
    "Budget [0-9]{4}",
    "Prévision.*[€$][0-9]{4,}",
    "Trésorerie.*[0-9]+M€"
)

foreach($site in $TreasurySites) {
    Search-SPOContent -SiteUrl $site -ContentPattern $sensitivePatterns
}

# Script de remédiation d'urgence - Marie RSSI
# Arrêt hémorragie SharePoint en 10 minutes

Write-Host "🚨 REMÉDIATION D'URGENCE EN COURS..." -ForegroundColor Red

# 1. Couper tout partage externe
Set-SPOTenant -SharingCapability Disabled
Write-Host "✅ Partage externe COUPÉ" -ForegroundColor Green

# 2. Révoquer tous les liens anonymes
$sites = Get-SPOSite -Limit All
foreach($site in $sites) {
    Remove-SPOSiteUsersFromGroup -Site $site.Url -LoginNames "Everyone" -Group "Members"
    Write-Host "✅ Everyone supprimé de $($site.Title)" -ForegroundColor Green
}

# 3. Audit des liens de partage actifs
foreach($site in $sites) {
    $links = Get-SPOSiteSharingLinks -Site $site.Url
    foreach($link in $links) {
        if($link.ShareType -eq "Anonymous") {
            Remove-SPOSiteSharingLink -Site $site.Url -Identity $link.ShareId -Force
            Write-Host "🗑️ Lien anonyme SUPPRIMÉ" -ForegroundColor Yellow
        }
    }
}

# 4. Notification équipes
Send-SPONotification -Message "URGENCE: Revue permissions SharePoint en cours. Accès temporairement restreints."

Write-Host "🎯 REMÉDIATION TERMINÉE - Sites sécurisés" -ForegroundColor Green

# SharePoint Permission Guardian v2.0 - By Arsène "Le Repenti"
# Surveillance automatisée des permissions SharePoint

function Start-PermissionGuardian {
    Write-Host "🛡️ DÉMARRAGE SHAREPOINT PERMISSION GUARDIAN" -ForegroundColor Cyan
    
    # Module 1: Détection Everyone/External
    Check-DangerousPermissions
    
    # Module 2: Surveillance contenu sensible
    Monitor-SensitiveContent
    
    # Module 3: Audit liens de partage
    Audit-SharingLinks
    
    # Module 4: Alertes temps réel
    Setup-RealTimeAlerts
}

function Check-DangerousPermissions {
    Write-Host "🔍 Vérification permissions dangereuses..." -ForegroundColor Yellow
    
    $dangerousSites = @()
    $sites = Get-SPOSite -Limit All
    
    foreach($site in $sites) {
        $groups = Get-SPOSiteGroup -Site $site.Url
        
        # Alerte si "Everyone" détecté
        if($groups.LoginName -match "Everyone") {
            $alert = @{
                Site = $site.Title
                URL = $site.Url
                Risk = "CRITIQUE"
                Issue = "Permissions Everyone détectées"
                TimeStamp = Get-Date
            }
            $dangerousSites += $alert
            
            # Notification Slack immédiate
            Send-SlackAlert -Message "🚨 ALERTE CRITIQUE: Site $($site.Title) has Everyone permissions!"
        }
    }
    
    return $dangerousSites
}

function Monitor-SensitiveContent {
    Write-Host "💰 Surveillance contenu financier..." -ForegroundColor Green
    
    $sensitivePatterns = @{
        "IBAN" = "IBAN [A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}[A-Z0-9]{1,16}"
        "Budget" = "Budget.*[0-9]{4}"
        "Confidentiel" = "CONFIDENTIEL|RESTRICTED|INTERNAL USE"
        "Financial" = "[€$][0-9]{1,3}(?:[\s,][0-9]{3})*(?:\.[0-9]{2})?\s*(?:million|M)"
    }
    
    foreach($pattern in $sensitivePatterns.GetEnumerator()) {
        $results = Search-SPOContent -Pattern $pattern.Value
        if($results.Count -gt 0) {
            Write-Warning "⚠️ $($results.Count) documents contenant $($pattern.Key) détectés"
            
            # Vérification permissions pour chaque document
            foreach($doc in $results) {
                $permissions = Get-SPOItemPermissions -ItemUrl $doc.Url
                if($permissions -match "Everyone|Anonymous") {
                    Send-CriticalAlert -Type $pattern.Key -Document $doc.Title -URL $doc.Url
                }
            }
        }
    }
}

function Setup-RealTimeAlerts {
    Write-Host "🔔 Configuration alertes temps réel..." -ForegroundColor Magenta
    
    # Webhook vers Teams pour alertes critiques
    $teamsWebhook = "https://outlook.office.com/webhook/YOUR_WEBHOOK_HERE"
    
    # Configuration audit log monitoring
    $auditConfig = @{
        Operations = @("SharingSet", "SharingRevoked", "FileAccessed", "FileDownloaded")
        Users = @("Everyone", "Anonymous")
        Severity = "High"
        NotificationTarget = $teamsWebhook
    }
    
    # Démarrage monitoring continu
    Start-ContinuousMonitoring -Config $auditConfig
}

# Lancement du guardian
Start-PermissionGuardian

Stack_Sécuritaire_Économique:
  
  Layer_1_Scripts_Maison:
    - PowerShell_Guardian: "Monitoring continu gratuit"
    - Audit_Automatisé: "Rapports hebdomadaires"
    - Alertes_Teams: "Notifications temps réel"
    coût: "0€ (inclus dans M365)"
    
  Layer_2_M365_Natif:
    - SharePoint_DLP_Policies: "Détection contenus sensibles"
    - Conditional_Access: "Restrictions géographiques"
    - Audit_Logs: "Traçabilité complète"
    coût: "Inclus E3/E5"
    
  Layer_3_Purview_Starter:
    - Information_Protection: "Classification automatique"
    - Activity_Explorer: "Analyse comportementale"
    - Insider_Risk: "Détection anomalies"
    coût: "25€/user/mois (seulement admins)"
    
  Budget_Total_Mensuel: "750€/mois vs 74,5M€ de pertes évitées"
  ROI_Annuel: "82 667 fois l'investissement"

# KIT DE SURVIE SHAREPOINT - Par Arsène le Repenti
# 5 scripts essentiels pour éviter la catastrophe

# Script 1: Health Check quotidien
function Invoke-SharePointHealthCheck {
    Write-Host "🏥 HEALTH CHECK SHAREPOINT EN COURS..." -ForegroundColor Green
    
    $healthReport = @()
    
    # Check 1: Sites avec Everyone
    $everyoneSites = Get-SPOSite | Where-Object {(Get-SPOSiteGroup -Site $_.Url).LoginName -match "Everyone"}
    if($everyoneSites) {
        $healthReport += "🚨 CRITIQUE: $($everyoneSites.Count) sites avec permissions Everyone"
    }
    
    # Check 2: Partage externe
    $tenantConfig = Get-SPOTenant
    if($tenantConfig.SharingCapability -eq "ExternalUserAndGuestSharing") {
        $healthReport += "⚠️ ATTENTION: Partage externe activé globalement"
    }
    
    # Check 3: Liens anonymes
    $anonymousLinks = Get-SPOSite | ForEach-Object { 
        Get-SPOSiteSharingLinks -Site $_.Url | Where-Object {$_.ShareType -eq "Anonymous"} 
    }
    if($anonymousLinks) {
        $healthReport += "🔗 INFO: $($anonymousLinks.Count) liens anonymes actifs"
    }
    
    return $healthReport
}

# Script 2: Détection contenu sensible
function Find-SensitiveContent {
    param([string[]]$SiteUrls)
    
    $sensitivePatterns = @{
        "IBAN" = "IBAN\s[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}[A-Z0-9]{1,16}"
        "SIRET" = "[0-9]{3}\s[0-9]{3}\s[0-9]{3}\s[0-9]{5}"
        "Confidentiel" = "CONFIDENTIEL|RESTRICTED|SECRET"
        "Budget" = "BUDGET.*[0-9]{4}|[€$][0-9]{1,3}(?:[\s,][0-9]{3})*\sM"
    }
    
    foreach($siteUrl in $SiteUrls) {
        foreach($pattern in $sensitivePatterns.GetEnumerator()) {
            $results = Search-SPOContent -SiteUrl $siteUrl -ContentPattern $pattern.Value
            if($results) {
                Write-Warning "⚠️ $($results.Count) documents $($pattern.Key) trouvés sur $siteUrl"
            }
        }
    }
}

# Script 3: Nettoyage permissions obsolètes
function Remove-OrphanedPermissions {
    param([string]$SiteUrl)
    
    $site = Get-SPOSite -Identity $SiteUrl
    $groups = Get-SPOSiteGroup -Site $SiteUrl
    
    foreach($group in $groups) {
        $users = Get-SPOUser -Site $SiteUrl -Group $group.LoginName
        foreach($user in $users) {
            # Vérifier si l'utilisateur existe encore dans AD
            try {
                Get-MgUser -UserId $user.LoginName -ErrorAction Stop
            } catch {
                Write-Host "🗑️ Suppression utilisateur orphelin: $($user.LoginName)" -ForegroundColor Yellow
                Remove-SPOUser -Site $SiteUrl -LoginName $user.LoginName
            }
        }
    }
}

# Script 4: Monitoring temps réel (webhook Teams)
function Set-RealTimeMonitoring {
    param([string]$TeamsWebhookUrl)
    
    # Configuration audit en temps réel
    $operations = @("SharingSet", "SharingRevoked", "FileAccessed", "FileDownloaded")
    
    # Boucle monitoring (à exécuter en background)
    while($true) {
        foreach($operation in $operations) {
            $events = Search-UnifiedAuditLog -Operations $operation -StartDate (Get-Date).AddMinutes(-5)
            
            foreach($event in $events) {
                if($event.UserIds -match "Everyone|Anonymous") {
                    $alert = @{
                        "text" = "🚨 ALERTE SharePoint: $($event.Operation) par $($event.UserIds) sur $($event.ObjectId)"
                    } | ConvertTo-Json
                    
                    Invoke-RestMethod -Uri $TeamsWebhookUrl -Method Post -Body $alert -ContentType "application/json"
                }
            }
        }
        Start-Sleep -Seconds 300 # Check toutes les 5 minutes
    }
}

# Script 5: Rapport de gouvernance automatique
function New-GovernanceReport {
    $report = @{
        "Date" = Get-Date
        "TotalSites" = (Get-SPOSite).Count
        "SitesWithEveryone" = (Get-SPOSite | Where-Object {(Get-SPOSiteGroup -Site $_.Url).LoginName -match "Everyone"}).Count
        "AnonymousLinks" = (Get-SPOSite | ForEach-Object { Get-SPOSiteSharingLinks -Site $_.Url | Where-Object {$_.ShareType -eq "Anonymous"} }).Count
        "ExternalUsers" = (Get-SPOExternalUser).Count
    }
    
    # Export vers Excel pour les managers
    $report | Export-Csv -Path "SharePoint-Governance-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation
    
    return $report
}

# UTILISATION QUOTIDIENNE RECOMMANDÉE
Write-Host "🚀 LANCEMENT KIT DE SURVIE SHAREPOINT" -ForegroundColor Cyan
$healthCheck = Invoke-SharePointHealthCheck
$governanceReport = New-GovernanceReport

Write-Host "📊 RAPPORT DU JOUR:" -ForegroundColor Green
$healthCheck | ForEach-Object { Write-Host $_ }

Coût_Prévention_Annuel:
  formation_admin: 3_000€
  scripts_powershell: 0€          # Gratuit
  temps_audit_mensuel: 2_400€     # 2h/mois × 12 × 100€/h
  outils_dlp_basiques: 9_000€     # 25€/mois × 12 × 30 admins
  
TOTAL_PRÉVENTION: 14_400€/an

Coût_Catastrophe_Type_Arsène:
  appels_offres_perdus: 45_000_000€
  amendes_rgpd: 8_500_000€
  gestion_crise: 3_200_000€
  mise_conformité: 2_800_000€
  perte_clients: 15_000_000€
  
TOTAL_CATASTROPHE: 74_500_000€

ROI_PRÉVENTION: 5_174× l'investissement
Probabilité_Catastrophe: 49% (étude Concentric)
Espérance_Gain: 36_526_000€

CONCLUSION: Pour 14 400€, on évite potentiellement 36,5M€ de pertes