Before installing Hawk, ensure your environment meets the following requirements:
To check your PowerShell version, run:
$PSVersionTable
Run the following command in a PowerShell session with administrator privileges to set the execution policy:
Set-ExecutionPolicy RemoteSigned
This command allows scripts to run securely on your system.
To install the Hawk module from the PowerShell Gallery, use this command:
Install-Module -Name Hawk
This will download and install the Hawk module on your system.
When you install Hawk, it automatically handles all required dependencies. All these modules enable connectivity to Microsoft 365 services and are essential for Hawk's functionality. The following modules will be installed your system:
To load the Hawk module in your current PowerShell session, run:
Import-Module Hawk
This command loads the Hawk module, making all its commands available for use in your current session.
To verify your installation, open a new PowerShell session and run:
Get-Module Hawk -ListAvailable
This command should display information about the installed Hawk version.
To see all available commands in Hawk, run:
Get-Command -Module Hawk
This will list all functions available in Hawk. While most of these functions are automatically executed during tenant or user investigations, they can also be run individually for targeted analysis.
Hawk provides detailed help documentation for all commands. To view help for any command, use Get-Help followed by the command name. For example:
Get-Help Start-HawkTenantInvestigation
Get-Help Start-HawkUserInvestigation
If you encounter installation issues or need assistance:
Review the previous section: Hawk Overview.
Enable Hawk to hunt, by configuring cloud permissions.