Hawk: a PowerShell module for collecting Microsoft 365 forensic data

A collector for cloud forensic data, not a detector

Hawk is a free, open source PowerShell module that streamlines the collection of forensic data from Microsoft cloud environments. It is aimed at security professionals, incident responders and administrators, and it automates gathering log data across Microsoft services with a focus on Microsoft 365 and Microsoft Entra ID.

The README draws the boundary itself, and it is the most important sentence in the documentation. Hawk includes basic analysis capabilities to flag potential items of interest, such as suspicious mail forwarding rules, over-privileged applications or risky user activities, but it is fundamentally a data collection tool rather than an automated threat detection system. The goal stated in the documentation is to quickly get you the data needed to come to a conclusion, not to make the conclusion for you.

Three capabilities are listed. Data collection with automated collection processes. Security analysis that examines configurations, audit logs and user activities. And export and report, producing both CSV reports and JSON data for SIEM integration.

That third capability is the reason the tool exists for a responder. The bottleneck in a cloud investigation is rarely deciding what to look at, it is the number of clicks between the incident ticket and a usable timeline, and Hawk turns that part into a script.

Tenant wide investigation and per user investigation

Hawk offers two investigation approaches, and they are aimed at different questions.

A tenant investigation examines broader Microsoft cloud tenant settings, audit logs and security configurations. The documentation describes it as an excellent starting point for identifying suspicious patterns, and the command to start one is `Start-HawkTenantInvestigation`. This is the wide shot: what is configured, what the audit log says, where the tenant looks unusual as a whole.

A user investigation performs a deep dive into an individual user account, examining mailbox configurations, inbox rules and login histories. The command takes the account as an argument, `Start-HawkUserInvestigation -UserPrincipleName <[email protected]>`.

The split is the right one for response work. Mailbox and inbox rule data is per person, so the user scoped command is what you run when you have a suspicious mailbox, while tenant scoped data answers whether the configuration itself is a problem. Running both is common, and the directory layout reflects that, since results for each account are kept separate.

Installing Hawk from the PowerShell Gallery

The installation is a single command:

Install-Module -Name Hawk

The module is published on the PowerShell Gallery, and the repository also carries an install.ps1 script at its top level, along with a build/ directory, an azure-pipelines.yml file and a .pre-commit-config.yaml, so the packaging and release process is scripted rather than manual.

The system requirements are worth checking before anything else, because two of them are hard limits. You need Windows with administrator access, and PowerShell 5.0 or above, with PowerShell Core stated as something that will be supported in the future rather than now. The module also needs network connectivity to the PowerShell Gallery, to the Graph API and to Microsoft 365 services.

That last point is the one that catches people out in practice. Hawk is a Windows module that talks to cloud APIs, so it is not a candidate for running on a Linux jump host unless the future PowerShell Core support arrives. The Graph API requirement also means the module needs the relevant permissions in the tenant, and the README points to hawkforensics.io for detailed installation and permissions guides rather than describing the permission set in the repository itself.

The output directory separates tenant data from each account

Results are organised into a structured directory hierarchy rooted at the investigation directory. Inside it, a Tenant folder holds AdminAuditLogConfig.csv, OrgConfig.csv and files prefixed `_Investigate_` alongside other tenant files. Then there is one folder per user, named for the account, each holding Mailbox_Info.csv, InboxRules.csv, its own `_Investigate_` files and other user files. A second user folder follows the same shape.

The naming convention carries meaning. Files prefixed with `_Investigate_` contain potentially suspicious findings that warrant further review, so they are the shortlist you work through first, while the CSV files around them are the raw configuration and log data that supports or contradicts a finding.

Because the output is files on disk in a predictable layout, the next step is yours. Export is offered as both CSV reports and JSON data for SIEM integration, which means you can load the results into a SIEM, diff two accounts against each other with ordinary tooling, or hand the directory to another analyst. The layout is designed to survive being moved out of the tool and worked on elsewhere.

What the built in analysis actually flags

Hawk ships with light analysis, and it is worth being precise about the scope so you do not read more into a clean result than is there.

The documented examples of items of interest are suspicious mail forwarding rules, over-privileged applications and risky user activities. Inbox rules are the classic case, and they are collected per user by the user investigation, so a forwarding rule to an external address appears in the InboxRules.csv output and, when it meets whatever criteria the module applies, in the `_Investigate_` files as well.

The important caveat is the one the README makes: this is not an automated threat detection system. The flags are prompts for a human to look, not verdicts. A finding that says a mail forwarding rule is suspicious is the start of an analysis, not a finding of compromise, and the documentation is careful to frame the module's role as getting you the data needed to reach a conclusion.

For a responder this is arguably the right level of automation. Detection rules that decide an account is compromised tend to be tuned to one environment and misfire everywhere else, whereas a tool that collects the same fields consistently and marks a handful of candidates for review transfers cleanly into an environment you already understand.

Telemetry covers function names and region, nothing else

The README carries a telemetry disclosure, and it is worth reading before the module touches a tenant that has data handling rules.

What is collected is the names of the functions that are run within Hawk and the region of use. The purpose given is to identify the most frequently used features, which then informs prioritising updates, enhancements and new functionality, and making data driven decisions about development. The data is described as being used strictly for internal development purposes and as never being shared, sold, or used for tracking beyond feature usage.

What is not collected is stated just as explicitly: no user identifiable data, no script inputs, outputs or arguments, and no personal, confidential or sensitive data.

That distinction matters in a forensics context. Function names tell you that an investigator ran a tenant investigation or a user investigation; they do not carry the account names that were investigated, because the arguments are excluded. Whether that is an acceptable arrangement for your organisation is a policy question rather than a technical one, and it is one that a regulated environment should answer explicitly rather than by assumption.

Where Hawk stops, and what to check first

The boundaries are clear.

Hawk is Windows only for now, and it runs on Windows PowerShell 5.0 or above with PowerShell Core deferred to a future release. It also assumes administrator access to the machine and connectivity to Graph API and to Microsoft 365 services, so it fits an endpoint on the corporate network, not an isolated analysis box with no route to the tenant.

The comparison worth making is with the manual path the README names, running individual queries through web interfaces. That approach needs no module, no permissions model beyond what you already use in the portal, and nothing installed on a workstation, and it leaves a smaller footprint on the machine you investigate from. What it costs is the repetition: every mailbox, every account, every audit query is a separate set of clicks and a separate export.

Hawk wins on breadth and repeatability, and loses on the small cases. If you need one user's inbox rules, a handful of portal queries is faster than installing a module and waiting for a directory of output to be produced. If you need the whole tenant's mail flow across hundreds of accounts, that is exactly the case the module is built for.

On maintenance and licence, the project is MIT licensed and the documentation points to hawkforensics.io for installation guides, permissions, tutorials, troubleshooting and usage examples, with the repository carrying the module source under Hawk/ and library/ and the build artefacts under build/. The repository publishes no GitHub releases, so there is no version tag to pin, and the last push was on 2026-06-10. Support comes through the PowerShell Gallery package, GitHub issues, GitHub discussions and an email address, and contributions are invited through the team, the feature request template and the bug report template.

Editorial conclusion

Adopt Hawk if you are responding to a Microsoft 365 or Entra ID incident and want the collection queries scripted and repeatable rather than typed into web interfaces one at a time. Do not treat it as a detection engine, since the README says it flags items of interest and leaves the conclusion to you. Before you run it, confirm you have Windows with administrator access and PowerShell 5.0 or above, review the telemetry disclosure, which covers function names and region only, and note that the repository publishes no GitHub releases while the last push was on 2026-06-10.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. README
5. T0pCyber/hawk on GitHub