Zero Hour Auto Purge Teams

<# .SYNOPSIS Zero-Hour Auto Purge (ZAP) .DESCRIPTION Enables ZAP to automatically remove malicious emails post-delivery .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param([switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Zero-Hour Auto Purge (ZAP)" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop $policies = Get-HostedContentFilterPolicy -ErrorAction Stop $result = @{ total = $policies.Count; zapEnabled = 0; zapDisabled = 0 } foreach ($policy in $policies) { $zapEnabled = $policy.ZapEnabled if ($zapEnabled) { $result.zapEnabled++ Write-Host " [OK] ZAP ENABLED: $($policy.Name)" -ForegroundColor Green } else { $result.zapDisabled++ Write-Host " [FAIL] ZAP DISABLED: $($policy.Name)" -ForegroundColor Red } } Write-Host "`n Summary: $($result.zapEnabled)/$($result.total) policies enabled" -ForegroundColor Cyan Write-Host "`n ZAP Functionality:" -ForegroundColor Cyan Write-Host " • Removes phishing emails after delivery" -ForegroundColor Gray Write-Host " • Removes malware after delivery" -ForegroundColor Gray Write-Host " • Moves to Junk/Quarantine automatically" -ForegroundColor Gray if ($result.zapDisabled -eq 0) { Write-Host "`n[OK] COMPLIANT - ZAP enabled on all policies" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Some policies without ZAP!" -ForegroundColor Red exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop $policies = Get-HostedContentFilterPolicy | Where-Object { -not $_.ZapEnabled } if ($policies.Count -eq 0) { Write-Host " [OK] ZAP already enabled on all policies" -ForegroundColor Green exit 0 } foreach ($policy in $policies) { Set-HostedContentFilterPolicy -Identity $policy.Name -ZapEnabled $true -ErrorAction Stop Write-Host " [OK] Enabled ZAP for: $($policy.Name)" -ForegroundColor Green } Write-Host "`n[OK] ZAP enabled on $($policies.Count) policies" -ForegroundColor Green exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop $policies = Get-HostedContentFilterPolicy | Where-Object { $_.ZapEnabled } foreach ($policy in $policies) { Set-HostedContentFilterPolicy -Identity $policy.Name -ZapEnabled $false -ErrorAction Stop Write-Host " ⚠️ Disabled ZAP for: $($policy.Name)" -ForegroundColor Yellow } exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Revert) { Invoke-Revert } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring | -Remediation | -Revert" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }