-
Notifications
You must be signed in to change notification settings - Fork 137
Description
What happened?
I want to run Hawk between "11th of March 2025" and "9th of June 2025" but I always seem to get the error;
Write-ErrorMessage : ||Audit log search argument startDate (03/11/2025 00:00:00) is later than endDate (06/10/2025 00:00:00).
I am in the UK and my PC is set to use the UK Locale.
[Using the USA Date Format MM/DD/YYY]
Start-HawkTenantInvestigation -StartDate "03/11/2025" -EndDate "06/09/2025" -FilePath "C:\Investigation" -SkipUpdate
[2025-06-09 16:40:28Z] - [ACTION] - Running Unified Audit Log Search
Write-ErrorMessage : ||Audit log search argument startDate (03/11/2025 00:00:00) is later than endDate (06/10/2025 00:00:00).
At C:\Users\PeterHopkins\AppData\Local\Temp\tmpEXO_cf3k5qyq.11f\tmpEXO_cf3k5qyq.11f.psm1:1189 char:13
+ Write-ErrorMessage $ErrorObject
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Search-UnifiedAuditLog], ArgumentException
+ FullyQualifiedErrorId : [Server=LNXP265MB1081,RequestId=4a062ed6-a9e6-5968-5f7d-8a21f3a8581c,TimeStamp=Mon, 09 Jun 2025 16:40:28 GMT],Write-ErrorMessage
[Using the UK Date Format DDMM/YYY]
Start-HawkTenantInvestigation -StartDate "11/03/2025" -EndDate "09/06/2025" -FilePath "C:\Investigation" -SkipUpdate
EndDate cannot be more than one day in the future
Even if I run with the -DaysToLookBack 30 command
Start-HawkTenantInvestigation -DaysToLookBack 30 -FilePath "C:\Hawk"
[2025-06-09 16:42:37Z] - [ACTION] - Running Unified Audit Log Search Write-ErrorMessage : ||Audit log search argument startDate (03/11/2025 00:00:00) is later than endDate (06/10/2025 00:00:00). At C:\Users\PeterHopkins\AppData\Local\Temp\tmpEXO_cf3k5qyq.11f\tmpEXO_cf3k5qyq.11f.psm1:1189 char:13 Write-ErrorMessage $ErrorObject ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CategoryInfo : InvalidArgument: (:) [Search-UnifiedAuditLog], ArgumentException FullyQualifiedErrorId : [Server=LNXP265MB1081,RequestId=43bad51a-406e-715c-744a-c97bbe051ec1,TimeStamp=Mon, 09 Jun 2025 16:42:36 GMT],Write-ErrorMessage
Steps to Reproduce
Set PC to UK Date and Time Local
Run Start-HawkTenantInvestigation -DaysToLookBack 30 -FilePath "C:\Hawk"
Hawk Version
4.0
Technical Analysis
No response
Implementation Plan
No response
Acceptance Criteria
No response