Teamontwikkeling Voor Microsoft 365 Security Operations

<# .SYNOPSIS Teamontwikkeling en samenwerkingsmonitoring voor Microsoft 365 security operations. .DESCRIPTION Ondersteunt SOC- en CISO-teams bij het meten van teamdynamiek, roosterbelasting, psychologische veiligheid en ketensamenwerking. Werkt met een lokaal configuratiebestand en biedt DebugMode zodat testen binnen vijftien seconden kan plaatsvinden zonder cloudverbinding. .NOTES Project : Nederlandse Baseline voor Veilige Cloud Author : Nederlandse Baseline voor Veilige Cloud Team File : team-building.ps1 .EXAMPLE .\team-building.ps1 -Baseline Maakt of vernieuwt het configuratiebestand team-building.config.json. .EXAMPLE .\team-building.ps1 -Pulse -DebugMode Voert een teamscan uit met voorbeelddata en toont de issues. .EXAMPLE .\team-building.ps1 -Evidence -OutputPath .\evidence\team-building.json Schrijft een auditklaar JSON-rapport inclusief hashwaarde. .EXAMPLE .\team-building.ps1 -Simulate -AbsentMembers 3 Simuleert het effect van drie gelijktijdige uitvallers op de roosters. #> #Requires -Version 5.1 [CmdletBinding(DefaultParameterSetName = 'Help')] param( [Parameter(ParameterSetName = 'Baseline')] [switch]$Baseline, [Parameter(ParameterSetName = 'Pulse')] [switch]$Pulse, [Parameter(ParameterSetName = 'Workshop')] [switch]$WorkshopPlan, [Parameter(ParameterSetName = 'Evidence')] [switch]$Evidence, [Parameter(ParameterSetName = 'Simulate')] [switch]$Simulate, [Parameter(ParameterSetName = 'Simulate')] [int]$AbsentMembers = 2, [string]$OutputPath, [switch]$DebugMode, [switch]$WhatIf ) Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' Write-Host "`n===============================================" -ForegroundColor Cyan Write-Host "Teamontwikkeling Microsoft 365 Security Ops" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "===============================================`n" -ForegroundColor Cyan function Get-TeamConfigPath { $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath 'team-building.config.json') } function Initialize-TeamBaselineData { $today = (Get-Date).ToString('yyyy-MM-dd') return [ordered]@{ version = '1.0' owner = 'SOC Teamlead' lastUpdated = $today riskThresholds = [ordered]@{ maxFatigue = 0.65 minPsychSafety = 0.72 maxRotationDays = 21 ritualHorizonDays = 7 } teams = @( [ordered]@{ name = 'Nationaal SOC' purpose = '24/7 detectie, respons en crisiscoördinatie' primaryCoverage = @('Defender XDR','Sentinel','Purview') members = @( [ordered]@{ name = 'Analist Noord' role = 'Incident Commander' skillFocus = @('Crisiscommunicatie','KQL','Automation') lastOnCallStart = (Get-Date).AddDays(-5).ToString('yyyy-MM-dd') averageHoursPerWeek= 38 fatigueScore = 0.42 psychSafetyScore = 0.86 available = $true }, [ordered]@{ name = 'Analist Zuid' role = 'Threat Hunter' skillFocus = @('ThreatIntel','PowerShell','Analytics') lastOnCallStart = (Get-Date).AddDays(-18).ToString('yyyy-MM-dd') averageHoursPerWeek= 36 fatigueScore = 0.58 psychSafetyScore = 0.74 available = $true }, [ordered]@{ name = 'Contractor West' role = 'Automation Engineer' skillFocus = @('LogicApps','DevOps','Change') lastOnCallStart = (Get-Date).AddDays(-24).ToString('yyyy-MM-dd') averageHoursPerWeek= 32 fatigueScore = 0.68 psychSafetyScore = 0.69 available = $false } ) rituals = @( [ordered]@{ title = 'Maandelijkse retro' cadenceDays = 30 nextDate = (Get-Date).AddDays(6).ToString('yyyy-MM-dd') owner = 'Teamcoach' }, [ordered]@{ title = 'Ketentafel RijksSOC' cadenceDays = 14 nextDate = (Get-Date).AddDays(3).ToString('yyyy-MM-dd') owner = 'CISO-office' } ) }, [ordered]@{ name = 'Regionale uitvoering' purpose = "Ondersteunt gemeenten en ZBO's bij piekbelasting" primaryCoverage = @('Sentinel','Incident Response','Workshops') members = @( [ordered]@{ name = 'Coach Midden' role = 'Teamcoach' skillFocus = @('Facilitatie','Behavioural','Purview') lastOnCallStart = (Get-Date).AddDays(-10).ToString('yyyy-MM-dd') averageHoursPerWeek= 34 fatigueScore = 0.35 psychSafetyScore = 0.88 available = $true }, [ordered]@{ name = 'Engineer Oost' role = 'Use-case Engineer' skillFocus = @('Automation','Power BI','Runbooks') lastOnCallStart = (Get-Date).AddDays(-2).ToString('yyyy-MM-dd') averageHoursPerWeek= 40 fatigueScore = 0.61 psychSafetyScore = 0.77 available = $true } ) rituals = @( [ordered]@{ title = 'Gemeentelijke kennisdeling' cadenceDays = 21 nextDate = (Get-Date).AddDays(11).ToString('yyyy-MM-dd') owner = 'Programma manager' } ) } ) } } function Save-TeamConfig { param( [Parameter(Mandatory = $true)] [hashtable]$Dataset ) $configPath = Get-TeamConfigPath $json = $Dataset | ConvertTo-Json -Depth 6 if ($WhatIf) { Write-Host "[WhatIf] Configuratie zou worden opgeslagen op $configPath" -ForegroundColor Yellow Write-Host $json return } $dir = Split-Path -Parent $configPath if (-not (Test-Path -Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $json | Out-File -FilePath $configPath -Encoding UTF8 -Force Write-Host "[OK] Configuratie opgeslagen: $configPath" -ForegroundColor Green } function Resolve-TeamOutputPath { param( [Parameter(Mandatory = $false)] [string]$CustomPath, [Parameter(Mandatory = $true)] [string]$DefaultFileName ) if (-not [string]::IsNullOrWhiteSpace($CustomPath)) { try { return (Resolve-Path -Path $CustomPath -ErrorAction Stop).Path } catch { return $CustomPath } } return (Join-Path -Path (Split-Path -Parent $PSCommandPath) -ChildPath $DefaultFileName) } function Get-TeamDataset { if ($DebugMode) { return (Initialize-TeamBaselineData) } $configPath = Get-TeamConfigPath if (Test-Path -Path $configPath) { $raw = Get-Content -Path $configPath -Raw return ($raw | ConvertFrom-Json -Depth 6) } throw "Geen configuratie gevonden. Voer '.\team-building.ps1 -Baseline' uit of gebruik -DebugMode." } function Get-RotationDays { param([string]$DateString) if ([string]::IsNullOrWhiteSpace($DateString)) { return $null } try { $span = New-TimeSpan -Start (Get-Date $DateString) -End (Get-Date) return [math]::Abs([int]$span.Days) } catch { return $null } } function Invoke-TeamPulseAnalysis { $dataset = Get-TeamDataset $thresholds = $dataset.riskThresholds $issues = [System.Collections.Generic.List[string]]::new() $teams = @() foreach ($team in $dataset.teams) { $members = $team.members $memberCount = ($members | Measure-Object).Count $availableMembers = ($members | Where-Object { $_.available }).Count $avgFatigue = if ($memberCount -gt 0) { [math]::Round(($members.fatigueScore | Measure-Object -Average).Average, 2) } else { 0 } $avgPsych = if ($memberCount -gt 0) { [math]::Round(($members.psychSafetyScore | Measure-Object -Average).Average, 2) } else { 0 } $rotationValues = @() foreach ($member in $members) { $rotationValues += (Get-RotationDays -DateString $member.lastOnCallStart) } $avgRotation = $rotationValues | Where-Object { $_ -ne $null } | Measure-Object -Average $avgRotationDays = if ($avgRotation) { [math]::Round($avgRotation.Average, 1) } else { $null } if ($avgFatigue -gt $thresholds.maxFatigue) { $issues.Add("Team '$($team.name)' overschrijdt de vermoeidheidsdrempel ($avgFatigue > $($thresholds.maxFatigue)).") } if ($avgPsych -lt $thresholds.minPsychSafety) { $issues.Add("Team '$($team.name)' scoort lager dan de psychologische veiligheidsdrempel ($avgPsych < $($thresholds.minPsychSafety)).") } if ($avgRotationDays -and $avgRotationDays -gt $thresholds.maxRotationDays) { $issues.Add("Team '$($team.name)' heeft roosters die langer lopen dan $($thresholds.maxRotationDays) dagen.") } $ritualHorizon = (Get-Date).AddDays($thresholds.ritualHorizonDays) $ritualsDue = @() foreach ($ritual in $team.rituals) { if (-not [string]::IsNullOrWhiteSpace($ritual.nextDate)) { $next = Get-Date $ritual.nextDate if ($next -le $ritualHorizon) { $ritualsDue += $ritual.title } } } $teams += [pscustomobject]@{ Name = $team.name Purpose = $team.purpose ActiveMembers = $memberCount AvailableMembers = $availableMembers AverageFatigue = $avgFatigue AveragePsychSafety = $avgPsych AverageRotation = $avgRotationDays RitualsDue = $ritualsDue } } return [pscustomobject]@{ Script = 'code/m365/security-operations/team-building.ps1' Timestamp = Get-Date Owner = $dataset.owner Teams = $teams Issues = $issues IsHealthy = ($issues.Count -eq 0) } } function Export-TeamWorkshopPlan { $dataset = Get-TeamDataset $plan = foreach ($team in $dataset.teams) { foreach ($ritual in $team.rituals) { [pscustomobject]@{ Team = $team.name Title = $ritual.title NextDate = $ritual.nextDate Cadence = $ritual.cadenceDays Owner = $ritual.owner } } } $target = Resolve-TeamOutputPath -CustomPath $OutputPath -DefaultFileName 'team-building-workshops.csv' if ($WhatIf) { Write-Host "[WhatIf] Workshopplan zou worden geëxporteerd naar $target" -ForegroundColor Yellow $plan | Format-Table -AutoSize return } $dir = Split-Path -Parent $target if ($dir -and -not (Test-Path -Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $plan | Sort-Object NextDate | Export-Csv -Path $target -NoTypeInformation -Encoding UTF8 Write-Host "[OK] Workshopplan geëxporteerd: $target" -ForegroundColor Green } function Publish-TeamEvidenceReport { $pulse = Invoke-TeamPulseAnalysis $target = Resolve-TeamOutputPath -CustomPath $OutputPath -DefaultFileName 'team-building-evidence.json' $payload = [ordered]@{ metadata = [ordered]@{ project = 'Nederlandse Baseline voor Veilige Cloud' generatedOn = (Get-Date).ToString('yyyy-MM-ddTHH:mm:ssK') script = 'team-building.ps1' debugMode = [bool]$DebugMode } pulse = $pulse } if ($WhatIf) { Write-Host "[WhatIf] Evidence zou worden opgeslagen op $target" -ForegroundColor Yellow $payload | ConvertTo-Json -Depth 6 | Write-Output return } $dir = Split-Path -Parent $target if ($dir -and -not (Test-Path -Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null } $payload | ConvertTo-Json -Depth 6 | Out-File -FilePath $target -Encoding UTF8 -Force $hash = Get-FileHash -Path $target -Algorithm SHA256 Write-Host "[OK] Evidence opgeslagen: $target" -ForegroundColor Green Write-Host ("SHA256: {0}" -f $hash.Hash) -ForegroundColor Gray } function Test-TeamResilienceScenario { $dataset = Get-TeamDataset $totalAvailable = 0 foreach ($team in $dataset.teams) { $totalAvailable += ($team.members | Where-Object { $_.available }).Count } $absent = [math]::Max(0, $AbsentMembers) $remaining = [math]::Max(0, $totalAvailable - $absent) $dropPct = if ($totalAvailable -gt 0) { [math]::Round(($absent / $totalAvailable) * 100, 2) } else { 0 } $criticalTeams = @() $teamCount = ($dataset.teams | Measure-Object).Count $perTeamImpact = if ($teamCount -gt 0) { [math]::Ceiling($absent / $teamCount) } else { $absent } foreach ($team in $dataset.teams) { $available = ($team.members | Where-Object { $_.available }).Count $afterDrop = [math]::Max(0, $available - $perTeamImpact) $risk = if ($afterDrop -lt 1) { 'Hoog' } elseif ($afterDrop -lt [math]::Ceiling([math]::Max(1, $available) / 2)) { 'Middel' } else { 'Laag' } $criticalTeams += [pscustomobject]@{ Team = $team.name AvailableNow = $available SimulatedLeft = $afterDrop Risk = $risk } } Write-Host ("Simulatie: {0} afwezige medewerkers ({1}% verlies)" -f $absent, $dropPct) -ForegroundColor Cyan $criticalTeams | Format-Table -AutoSize } function Show-TeamBuildingUsage { Write-Host "Gebruik:" -ForegroundColor Yellow Write-Host " -Baseline Maak of ververs het configuratiebestand" -ForegroundColor Gray Write-Host " -Pulse Bereken teamgezondheid (optioneel -DebugMode)" -ForegroundColor Gray Write-Host " -WorkshopPlan Exporteer ritmes naar CSV (optioneel -OutputPath)" -ForegroundColor Gray Write-Host " -Evidence Schrijf auditrapport (optioneel -OutputPath)" -ForegroundColor Gray Write-Host " -Simulate Test ketencapaciteit (optioneel -AbsentMembers)" -ForegroundColor Gray Write-Host " -DebugMode Gebruik voorbeelddata voor veilige tests" -ForegroundColor Gray Write-Host " -WhatIf Toon welke schrijfacties zouden plaatsvinden" -ForegroundColor Gray } try { switch ($PSCmdlet.ParameterSetName) { 'Baseline' { $dataset = Initialize-TeamBaselineData Save-TeamConfig -Dataset $dataset break } 'Pulse' { $result = Invoke-TeamPulseAnalysis $result.Teams | Format-Table -AutoSize if ($result.Issues.Count -gt 0) { Write-Host "`n[WARN] Issues gevonden:" -ForegroundColor Yellow $result.Issues | ForEach-Object { Write-Host (" - {0}" -f $_) -ForegroundColor Yellow } } else { Write-Host "`n[OK] Geen issues gevonden. Teams voldoen aan drempels." -ForegroundColor Green } break } 'Workshop' { Export-TeamWorkshopPlan break } 'Evidence' { Publish-TeamEvidenceReport break } 'Simulate' { Test-TeamResilienceScenario | Out-Null break } default { Show-TeamBuildingUsage } } } catch { Write-Host "[FAIL] $($_.Exception.Message)" -ForegroundColor Red if ($_.InvocationInfo -and $_.InvocationInfo.PositionMessage) { Write-Host $_.InvocationInfo.PositionMessage -ForegroundColor DarkGray } exit 2 } finally { Write-Host "`n===============================================`n" -ForegroundColor Cyan }