Microsoft 365 Incident Response and Threat Hunting PowerShell tool. The Hawk is designed to ease the burden on M365 administrators who are performing Cloud forensic tasks for their organization. It accelerates the gathering of data from multiple sources in the service that be used to quickly identify malicious presence and activity.

Log user log on and off activity to a txt file and optionally to Teams. Run with -help or no arguments for usage.