Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update README.md #55

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update README.md #55

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,18 +42,18 @@ data gathering easier.
## HOW TO USE:
Osprey is divided into two primary forms of cmdlets; *user* based Cmdlets and *tenant* based cmdlets.

User based cmdlets take the form Verb-OspreyUser<action>. They all expect a -user switch and
User based cmdlets take the form `Verb-OspreyUser<action>`. They all expect a `-user` switch and
will retrieve information specific to the user that is specified. Tenant based cmdlets take
the form Verb-OspreyTenant<Action>. They don't need any switches and will return information
about the whole tenant.

You must run the Start-Osprey command first, which will initialize the session and allow you to set the required parameters.
After Osprey is initialized you should run Start-OspreyTenantInvestigation which will run all the tenant based
You must run the `Start-Osprey` command first, which will initialize the session and allow you to set the required parameters.
After Osprey is initialized you should run `Start-OspreyTenantInvestigation` which will run all the tenant based
cmdlets and provide a collection of data to start with. Once this data has been reviewed
if there are specific user(s) that more information should be gathered on
Start-OspreyUserInvestigation will gather all the User specific information for a single user.
`Start-OspreyUserInvestigation` will gather all the User specific information for a single user.

You can run Start-Osprey again in the same PowerShell Session and get prompted for reinitialization.
You can run `Start-Osprey` again in the same PowerShell Session and get prompted for reinitialization.
When reinitializing you can either just change the investigation parameters such as the timeframe,
or can change the actual tenant you are investigating, which is helpful for responders who may
investigate incidents for different clients.
Expand Down