SOC 2 Audit Prep Part 2: Azure AD Audit Log Retention Setup (Step-by-Step)

# Check your Azure AD license tier
Connect-AzureAD
Get-AzureADSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits

# Look for:
# - AAD_PREMIUM or AAD_PREMIUM_P1 → You're good
# - AAD_PREMIUM2 → Even better
# - AAD_BASIC or AAD_FREE → Can't export Azure AD logs

# Set variables
$resourceGroup = "governance-rg"
$workspaceName = "audit-logs-workspace"
$location = "eastus"  # Change to your region
$retentionDays = 730  # 2 years

# Create resource group if it doesn't exist
New-AzResourceGroup -Name $resourceGroup -Location $location -Force

# Create workspace
$workspace = New-AzOperationalInsightsWorkspace `
    -ResourceGroupName $resourceGroup `
    -Name $workspaceName `
    -Location $location `
    -RetentionInDays $retentionDays `
    -Sku "PerGB2018"

# Show workspace ID (save this)
Write-Host "Workspace ID: $($workspace.ResourceId)" -ForegroundColor Green

# Show workspace key (for API access if needed)
$workspaceKey = Get-AzOperationalInsightsWorkspaceSharedKey `
    -ResourceGroupName $resourceGroup `
    -Name $workspaceName

Write-Host "Workspace Key: $($workspaceKey.PrimarySharedKey)" -ForegroundColor Yellow

# Verify workspace exists and is active
Get-AzOperationalInsightsWorkspace `
    -ResourceGroupName $resourceGroup `
    -Name $workspaceName | 
    Select-Object Name, Location, Sku, RetentionInDays, ProvisioningState

# Expected output:
# Name                   : audit-logs-workspace
# Location               : eastus
# Sku                    : PerGB2018
# RetentionInDays        : 730
# ProvisioningState      : Succeeded

# Install Microsoft Graph module (if not already installed)
Install-Module Microsoft.Graph -Scope CurrentUser -Force

# Connect with required permissions
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"

# Set variables
$workspaceResourceId = "/subscriptions/YOUR-SUB-ID/resourceGroups/governance-rg/providers/Microsoft.OperationalInsights/workspaces/audit-logs-workspace"

# Get current tenant ID
$tenantId = (Get-MgContext).TenantId

# Define diagnostic setting
$diagnosticSetting = @{
    name = "export-azuread-to-law"
    workspaceId = $workspaceResourceId
    logs = @(
        @{ category = "AuditLogs"; enabled = $true }
        @{ category = "SignInLogs"; enabled = $true }
        @{ category = "NonInteractiveUserSignInLogs"; enabled = $true }
        @{ category = "ServicePrincipalSignInLogs"; enabled = $true }
        @{ category = "ManagedIdentitySignInLogs"; enabled = $true }
    )
}

# Apply diagnostic setting
# Note: This uses REST API because there's no direct PowerShell cmdlet yet
$uri = "https://graph.microsoft.com/beta/auditLogs/directoryAudits/diagnosticSettings"

Invoke-MgGraphRequest -Method POST -Uri $uri -Body ($diagnosticSetting | ConvertTo-Json -Depth 10)

Write-Host "Azure AD diagnostic settings configured successfully!" -ForegroundColor Green

# You need Global Administrator or Security Administrator role
# Check your role:
Get-MgUserMemberOf -UserId (Get-MgContext).Account | 
    Select-Object AdditionalProperties

# If you don't have the right role, ask someone who does to run this script

# Login
az login

# Get workspace ID
workspaceId=$(az monitor log-analytics workspace show \
    --resource-group governance-rg \
    --workspace-name audit-logs-workspace \
    --query id -o tsv)

# Note: Azure CLI doesn't fully support Azure AD diagnostic settings yet
# Use Portal or PowerShell for now
# This is a known limitation as of October 2025

☑ Administrative
☑ Security
☑ ServiceHealth
☑ Alert
☑ Recommendation
☑ Policy
☑ Autoscale
☑ ResourceHealth

☑ AuditLogs
☑ SignInLogs
☑ NonInteractiveUserSignInLogs
☑ ServicePrincipalSignInLogs
☑ ManagedIdentitySignInLogs

# Get subscription diagnostic settings
$subscriptionId = (Get-AzContext).Subscription.Id
$diagnosticSettings = Get-AzDiagnosticSetting -ResourceId "/subscriptions/$subscriptionId"

# Show what's actually configured
foreach ($setting in $diagnosticSettings) {
    Write-Host "`n=== Diagnostic Setting: $($setting.Name) ===" -ForegroundColor Cyan

    Write-Host "`nEnabled Categories:" -ForegroundColor Yellow
    foreach ($log in $setting.Logs) {
        $status = if ($log.Enabled) { "✓" } else { "✗" }
        $color = if ($log.Enabled) { "Green" } else { "Red" }
        Write-Host "  $status $($log.Category)" -ForegroundColor $color
    }

    if ($setting.WorkspaceId) {
        Write-Host "`n✓ Sending to Log Analytics" -ForegroundColor Green
    }
}

# Check Azure AD diagnostic settings
Connect-MgGraph -Scopes "AuditLog.Read.All"
$uri = "https://graph.microsoft.com/beta/auditLogs/directoryAudits/diagnosticSettings"
$settings = Invoke-MgGraphRequest -Method GET -Uri $uri

# Show configured categories
$settings.value | ForEach-Object {
    Write-Host "`n=== $($_.name) ===" -ForegroundColor Cyan
    $_.logs | ForEach-Object {
        $status = if ($_.enabled) { "✓" } else { "✗" }
        Write-Host "  $status $($_.category)" -ForegroundColor $(if ($_.enabled) { "Green" } else { "Red" })
    }
}

# Create timestamped proof
$timestamp = Get-Date -Format "yyyy-MM-dd-HHmm"
$diagnosticSettings | ConvertTo-Json -Depth 10 | 
    Out-File "diagnostic-settings-proof-$timestamp.json"

Write-Host "`nConfiguration proof saved: diagnostic-settings-proof-$timestamp.json" -ForegroundColor Green

AuditLogs
| where TimeGenerated > ago(1h)
| take 10
| project TimeGenerated, OperationName, Identity, Result

SignInLogs
| where TimeGenerated > ago(1h)
| take 10
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, ResultType

AADServicePrincipalSignInLogs
| where TimeGenerated > ago(1h)
| take 10
| project TimeGenerated, AppId, ServicePrincipalName, ResourceDisplayName

// Check which log types are present
search *
| where TimeGenerated > ago(24h)
| where $table startswith "AAD" or $table == "AuditLogs" or $table contains "SignIn"
| summarize 
    RowCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by $table
| order by RowCount desc

# Install Az.OperationalInsights if needed
Install-Module Az.OperationalInsights -Scope CurrentUser -Force

# Connect
Connect-AzAccount

# Run query to check for logs
$resourceGroup = "governance-rg"
$workspaceName = "audit-logs-workspace"

$query = @"
search *
| where TimeGenerated > ago(24h)
| where `$table startswith "AAD" or `$table == "AuditLogs" or `$table contains "SignIn"
| summarize RowCount = count() by `$table
"@

$result = Invoke-AzOperationalInsightsQuery `
    -WorkspaceId (Get-AzOperationalInsightsWorkspace `
        -ResourceGroupName $resourceGroup `
        -Name $workspaceName).CustomerId `
    -Query $query

$result.Results | Format-Table

# Should show multiple log types with row counts

// Find app registration creation events
AuditLogs
| where OperationName == "Add application"
| where Result == "success"
| extend 
    AppName = tostring(TargetResources[0].displayName),
    AppId = tostring(TargetResources[0].id),
    CreatedBy = tostring(InitiatedBy.user.userPrincipalName),
    CreatedByObjectId = tostring(InitiatedBy.user.id)
| project 
    TimeGenerated,
    CreatedBy,
    AppName,
    AppId,
    CorrelationId
| order by TimeGenerated desc

// Track admin consent grants to apps
AuditLogs
| where OperationName == "Consent to application"
| where Result == "success"
| extend 
    AppName = tostring(TargetResources[0].displayName),
    ConsentedBy = tostring(InitiatedBy.user.userPrincipalName),
    ConsentType = tostring(TargetResources[0].modifiedProperties[0].newValue),
    Permissions = tostring(TargetResources[0].modifiedProperties)
| project 
    TimeGenerated,
    ConsentedBy,
    AppName,
    ConsentType,
    Permissions,
    CorrelationId
| order by TimeGenerated desc

// Check service principal sign-in activity
let appId = "YOUR-APP-ID-GUID";  // Replace with actual App ID
AADServicePrincipalSignInLogs
| where AppId == appId
| where TimeGenerated >= ago(90d)
| summarize 
    SignInCount = count(),
    FirstSignIn = min(TimeGenerated),
    LastSignIn = max(TimeGenerated),
    UniqueResources = dcount(ResourceDisplayName),
    Resources = make_set(ResourceDisplayName)
    by AppDisplayName, AppId
| extend DaysSinceLastUse = datetime_diff('day', now(), LastSignIn)
| project 
    AppDisplayName,
    AppId,
    SignInCount,
    FirstSignIn,
    LastSignIn,
    DaysSinceLastUse,
    UniqueResources,
    Resources

// Find repeated failed sign-in attempts
SignInLogs
| where TimeGenerated >= ago(24h)
| where ResultType != 0  // 0 = success, anything else = failure
| summarize 
    FailedAttempts = count(),
    FirstAttempt = min(TimeGenerated),
    LastAttempt = max(TimeGenerated),
    UniqueIPs = dcount(IPAddress),
    IPList = make_set(IPAddress),
    ErrorCodes = make_set(ResultType)
    by UserPrincipalName, AppDisplayName
| where FailedAttempts > 10  // Threshold for investigation
| order by FailedAttempts desc

// Track who was granted admin roles
AuditLogs
| where OperationName == "Add member to role"
| where Result == "success"
| extend 
    RoleName = tostring(TargetResources[0].displayName),
    UserAdded = tostring(TargetResources[1].userPrincipalName),
    AddedBy = tostring(InitiatedBy.user.userPrincipalName)
| project 
    TimeGenerated,
    AddedBy,
    UserAdded,
    RoleName,
    CorrelationId
| order by TimeGenerated desc

// Find sign-ins from specific location (adjust for your compliance needs)
SignInLogs
| where TimeGenerated >= ago(90d)
| where LocationDetails.countryOrRegion == "RU"  // Russia, adjust as needed
| where ResultType == 0  // Successful sign-ins only
| project 
    TimeGenerated,
    UserPrincipalName,
    AppDisplayName,
    IPAddress,
    LocationDetails.city,
    LocationDetails.countryOrRegion,
    DeviceDetail.operatingSystem
| order by TimeGenerated desc

// Track changes to Conditional Access policies
AuditLogs
| where Category == "Policy"
| where OperationName contains "conditional access policy"
| extend 
    PolicyName = tostring(TargetResources[0].displayName),
    Action = OperationName,
    ChangedBy = tostring(InitiatedBy.user.userPrincipalName),
    Changes = tostring(TargetResources[0].modifiedProperties)
| project 
    TimeGenerated,
    ChangedBy,
    PolicyName,
    Action,
    Changes
| order by TimeGenerated desc

// Track when secrets or certificates are added to app registrations
AuditLogs
| where OperationName in ("Add service principal credentials", "Update application – Certificates and secrets management")
| where Result == "success"
| extend 
    AppName = tostring(TargetResources[0].displayName),
    AddedBy = tostring(InitiatedBy.user.userPrincipalName),
    CredentialType = tostring(TargetResources[0].modifiedProperties[0].displayName)
| project 
    TimeGenerated,
    AddedBy,
    AppName,
    CredentialType,
    CorrelationId
| order by TimeGenerated desc

# Export all app registrations to CSV
Connect-AzureAD

# Get all applications
$apps = Get-AzureADApplication -All $true

# Build detailed report
$report = @()
foreach ($app in $apps) {
    # Get owners
    $owners = Get-AzureADApplicationOwner -ObjectId $app.ObjectId -All $true
    $ownerEmails = $owners.UserPrincipalName -join "; "

    # Get credentials (secrets and certificates)
    $secrets = $app.PasswordCredentials
    $certs = $app.KeyCredentials

    # Check for expiring credentials
    $expiringSecrets = $secrets | Where-Object { $_.EndDate -lt (Get-Date).AddDays(60) }

    $report += [PSCustomObject]@{
        DisplayName = $app.DisplayName
        AppId = $app.AppId
        ObjectId = $app.ObjectId
        CreatedDateTime = $app.CreatedDateTime
        Owners = $ownerEmails
        OwnerCount = $owners.Count
        SecretCount = $secrets.Count
        CertCount = $certs.Count
        ExpiringSecretsIn60Days = $expiringSecrets.Count
        SignInAudience = $app.SignInAudience
        PublisherDomain = $app.PublisherDomain
        ReplyUrls = ($app.ReplyUrls -join "; ")
    }
}

# Export to CSV with timestamp
$timestamp = Get-Date -Format "yyyy-MM-dd"
$outputFile = "app-registrations-inventory-$timestamp.csv"
$report | Export-Csv -Path $outputFile -NoTypeInformation

Write-Host "Exported $($report.Count) app registrations to: $outputFile" -ForegroundColor Green

# Show apps without owners (RED FLAG)
$noOwners = $report | Where-Object { $_.OwnerCount -eq 0 }
if ($noOwners) {
    Write-Host "`nWARNING: $($noOwners.Count) apps have NO OWNERS:" -ForegroundColor Red
    $noOwners | Select-Object DisplayName, AppId, CreatedDateTime | Format-Table
}

# Show apps with expiring secrets
$expiring = $report | Where-Object { $_.ExpiringSecretsIn60Days -gt 0 }
if ($expiring) {
    Write-Host "`nATTENTION: $($expiring.Count) apps have secrets expiring in 60 days:" -ForegroundColor Yellow
    $expiring | Select-Object DisplayName, AppId, ExpiringSecretsIn60Days | Format-Table
}

# Compare this month vs last month to find NEW apps
$thisMonth = Import-Csv "app-registrations-inventory-2025-10-01.csv"
$lastMonth = Import-Csv "app-registrations-inventory-2025-09-01.csv"

$newApps = $thisMonth | Where-Object { $_.AppId -notin $lastMonth.AppId }
Write-Host "New apps created this month: $($newApps.Count)"
$newApps | Select-Object DisplayName, AppId, CreatedDateTime, Owners | Format-Table

# Pseudo-code for CMDB sync
$apps = Get-AzureADApplication -All $true
foreach ($app in $apps) {
    # Check if exists in CMDB
    $cmdbRecord = Get-CMDBRecord -Type "AzureAppRegistration" -AppId $app.AppId

    if ($cmdbRecord) {
        # Update existing record
        Update-CMDBRecord -Id $cmdbRecord.Id -Data @{
            LastVerified = Get-Date
            OwnerCount = (Get-AzureADApplicationOwner -ObjectId $app.ObjectId).Count
        }
    } else {
        # Create new record
        New-CMDBRecord -Type "AzureAppRegistration" -Data @{
            Name = $app.DisplayName
            AppId = $app.AppId
            ObjectId = $app.ObjectId
            CreatedDate = $app.CreatedDateTime
            Status = "Review"  # New apps default to review status
        }
    }
}

# Set variables
$resourceGroup = "governance-rg"
$storageAccountName = "auditarchive$(Get-Random)"  # Must be globally unique
$location = "eastus"

# Create storage account
New-AzStorageAccount `
    -ResourceGroupName $resourceGroup `
    -Name $storageAccountName `
    -Location $location `
    -SkuName Standard_LRS `
    -Kind StorageV2 `
    -AccessTier Cool `
    -MinimumTlsVersion TLS1_2

Write-Host "Storage account created: $storageAccountName" -ForegroundColor Green

# Enable soft delete (protection against accidental deletion)
$storageAccount = Get-AzStorageAccount `
    -ResourceGroupName $resourceGroup `
    -Name $storageAccountName

$ctx = $storageAccount.Context
Enable-AzStorageBlobDeleteRetentionPolicy -Context $ctx -RetentionDays 30

Write-Host "Soft delete enabled (30-day retention)" -ForegroundColor Green

# Get storage account resource ID
$storageId = (Get-AzStorageAccount `
    -ResourceGroupName $resourceGroup `
    -Name $storageAccountName).Id

# Update diagnostic settings to include storage
# Note: This updates the existing diagnostic setting
# Run the same diagnostic setting creation command from Step 2
# but add storage configuration:

$diagnosticSetting = @{
    name = "export-azuread-to-law"
    workspaceId = $workspaceResourceId
    storageAccountId = $storageId
    logRetentionDays = 2555  # 7 years
    logs = @(
        @{ category = "AuditLogs"; enabled = $true; retentionPolicy = @{ enabled = $true; days = 2555 } }
        @{ category = "SignInLogs"; enabled = $true; retentionPolicy = @{ enabled = $true; days = 2555 } }
        @{ category = "NonInteractiveUserSignInLogs"; enabled = $true; retentionPolicy = @{ enabled = $true; days = 2555 } }
        @{ category = "ServicePrincipalSignInLogs"; enabled = $true; retentionPolicy = @{ enabled = $true; days = 2555 } }
        @{ category = "ManagedIdentitySignInLogs"; enabled = $true; retentionPolicy = @{ enabled = $true; days = 2555 } }
    )
}

# Apply via REST API (same as Step 2 but with storage added)

# List containers in storage account
$ctx = (Get-AzStorageAccount `
    -ResourceGroupName $resourceGroup `
    -Name $storageAccountName).Context

Get-AzStorageContainer -Context $ctx | Select-Object Name

# Expected containers:
# insights-logs-auditlogs
# insights-logs-signin
# insights-logs-noninteractiveusersignin
# insights-logs-serviceprincipalsignin
# insights-logs-managedidentitysignin

# List blobs in a specific container
$containerName = "insights-logs-auditlogs"
Get-AzStorageBlob -Container $containerName -Context $ctx | 
    Select-Object Name, LastModified, Length | 
    Sort-Object LastModified -Descending | 
    Select-Object -First 10

/insights-logs-auditlogs/
  resourceId=/TENANTS/YOUR-TENANT-ID/y=2025/m=10/d=27/h=14/m=00/
    PT1H.json

# Enable legal hold (prevents deletion)
Set-AzRmStorageContainerImmutabilityPolicy `
    -ResourceGroupName $resourceGroup `
    -StorageAccountName $storageAccountName `
    -ContainerName $containerName `
    -ImmutabilityPeriod 2555  # 7 years in days

Write-Host "Immutability policy set - logs cannot be deleted for 7 years" -ForegroundColor Green

# Set to 90 days instead of 730 days
Set-AzOperationalInsightsWorkspace `
    -ResourceGroupName $resourceGroup `
    -Name $workspaceName `
    -RetentionInDays 90

# Savings: ~75% on retention costs
# Trade-off: Less query-able history (rely more on storage archive)

# Set commitment tier (100 GB/day minimum)
Set-AzOperationalInsightsWorkspace `
    -ResourceGroupName $resourceGroup `
    -Name $workspaceName `
    -Sku CapacityReservation `
    -CapacityReservationLevel 100

# Pricing: $196/day ($5,880/month) for 100 GB/day
# vs. $250/month on Pay-As-You-Go
# Savings kick in above ~78 GB/month

# Automatically move old blobs to Archive tier after 365 days
$rule = Add-AzStorageAccountManagementPolicyAction `
    -BaseBlobAction TierToArchive `
    -DaysAfterModificationGreaterThan 365

Add-AzStorageAccountManagementPolicyRule `
    -ResourceGroupName $resourceGroup `
    -AccountName $storageAccountName `
    -Rules $rule

# Archive tier: $0.002/GB/month (vs. Cool tier $0.01/GB/month)
# Savings: 80% on old logs you rarely access

# Check diagnostic settings exist
Connect-MgGraph -Scopes "AuditLog.Read.All"
$uri = "https://graph.microsoft.com/beta/auditLogs/directoryAudits/diagnosticSettings"
Invoke-MgGraphRequest -Method GET -Uri $uri | ConvertTo-Json -Depth 10

# Should show your diagnostic setting with all log categories enabled

// See which log types consume most data
Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize DataVolume_GB = sum(Quantity) / 1000 by DataType
| order by DataVolume_GB desc

// Search by app name (partial match)
AuditLogs
| where OperationName == "Add application"
| extend AppName = tostring(TargetResources[0].displayName)
| where AppName contains "MyApp"  // Replace with partial name
| project TimeGenerated, AppName, InitiatedBy

# Grant yourself Storage Blob Data Reader role
$storageAccount = Get-AzStorageAccount `
    -ResourceGroupName $resourceGroup `
    -Name $storageAccountName

$userId = (Get-AzADUser -SignedIn).Id

New-AzRoleAssignment `
    -ObjectId $userId `
    -RoleDefinitionName "Storage Blob Data Reader" `
    -Scope $storageAccount.Id

Write-Host "Role assigned - wait 5 minutes for permission propagation" -ForegroundColor Green

// Verify logs exist from 90+ days ago
AuditLogs
| summarize 
    OldestLog = min(TimeGenerated),
    NewestLog = max(TimeGenerated),
    DaysCovered = datetime_diff('day', max(TimeGenerated), min(TimeGenerated))

# Check storage containers exist and have recent data
$containers = Get-AzStorageContainer -Context $ctx
$containers | ForEach-Object {
    $latest = Get-AzStorageBlob -Container $_.Name -Context $ctx | 
        Sort-Object LastModified -Descending | 
        Select-Object -First 1
    [PSCustomObject]@{
        Container = $_.Name
        LatestBlob = $latest.Name
        LastModified = $latest.LastModified
    }
}

AuditLogs
| where TimeGenerated between(datetime(2025-07-01) .. datetime(2025-09-30))
| where OperationName == "Add member to role"
| where Result == "success"
| extend 
    RoleName = tostring(TargetResources[0].displayName),
    UserAdded = tostring(TargetResources[1].userPrincipalName),
    AddedBy = tostring(InitiatedBy.user.userPrincipalName)
| where RoleName contains "Global Administrator"
| project 
    Date = format_datetime(TimeGenerated, 'yyyy-MM-dd'),
    AddedBy,
    UserAdded,
    RoleName
| order by TimeGenerated asc

$results | Export-Csv -Path "Q3-2025-Global-Admin-Grants.csv" -NoTypeInformation

SignInLogs
| where UserPrincipalName == "john.doe@company.com"
| where TimeGenerated >= ago(90d)
| project 
    TimeGenerated,
    ResultType,
    ResultDescription,
    IPAddress,
    City = LocationDetails.city,
    State = LocationDetails.state,
    Country = LocationDetails.countryOrRegion,
    AppDisplayName,
    DeviceOS = DeviceDetail.operatingSystem,
    Browser = DeviceDetail.browser
| order by TimeGenerated desc

# Export to CSV
$signIns | Export-Csv -Path "incident-john-doe-signins.csv" -NoTypeInformation

# Identify suspicious patterns
$signIns | Group-Object IPAddress | 
    Sort-Object Count -Descending | 
    Select-Object Name, Count, @{N='Countries';E={($_.Group.Country | Select-Object -Unique) -join ', '}}

// Run for each app ID from Tenable report
let appIds = dynamic(["app-id-1", "app-id-2", "app-id-3"]);  // Up to 50
AADServicePrincipalSignInLogs
| where AppId in (appIds)
| where TimeGenerated >= ago(90d)
| summarize 
    SignInCount = count(),
    LastUsed = max(TimeGenerated),
    Resources = make_set(ResourceDisplayName)
    by AppId, AppDisplayName
| extend DaysSinceLastUse = datetime_diff('day', now(), LastUsed)
| order by SignInCount desc

# Load spreadsheet
$inventory = Import-Csv "app-registrations-inventory-2025-10-01.csv"

# Match Tenable alerts to inventory
$tenableApps = Import-Csv "tenable-expiring-secrets-2025-10-27.csv"
$analysis = $tenableApps | ForEach-Object {
    $appId = $_.AppId
    $inventoryRecord = $inventory | Where-Object { $_.AppId -eq $appId }
    [PSCustomObject]@{
        AppName = $_.AppName
        AppId = $appId
        ExpirationDate = $_.SecretExpiration
        LastUsed = $kqlResults[$appId].LastUsed
        Owner = $inventoryRecord.Owners
        Status = if ($kqlResults[$appId].SignInCount -eq 0) { "UNUSED - SAFE TO DELETE" } else { "IN USE - RENEW SECRET" }
    }
}

$analysis | Export-Csv -Path "tenable-app-analysis-2025-10-27.csv" -NoTypeInformation