Report activity alert audit events

Connect-ExchangeOnline -ShowBanner:$false

param(
    [int] $LookbackDays = 180
)
 
[array]$Modules = Get-Module | Select-Object -ExpandProperty Name
If ("ExchangeOnlineManagement" -notin $Modules) {
    Connect-ExchangeOnline -ShowBanner:$false
}
 
Write-Host "Searching for audit records"
[array]$Records = (Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-$LookbackDays) -EndDate (Get-Date).AddDays(+1) -RecordType SecurityComplianceAlerts -Formatted -ResultSize 3000)
If ($Records.Count -eq 0) {
   Write-Host "No alert audit records found."
   Break
}
 
Write-Host "Processing" $Records.Count "audit records..."
$Report = [System.Collections.Generic.List[Object]]::new()
ForEach ($Rec in $Records) {
  $AuditData = ConvertFrom-Json $Rec.Auditdata
  $Data = ConvertFrom-Json $Auditdata.data
  If ($Rec.Operations -eq "AlertTriggered") {
      $ReportLine = [PSCustomObject]@{
        TimeStamp   = $Rec.CreationDate
        User        = $Data.f3u
        Action      = $Data.an
        Status      = $AuditData.ResultStatus
        Severity    = $AuditData.Severity
        Workload    = $AuditData.Source
        Operation   = $Rec.Operations
        Category    = $AuditData.Category
      }
      $Report.Add($ReportLine)
  } Else {
      $ReportLine = [PSCustomObject]@{
        TimeStamp   = $Rec.CreationDate
        User        = $Data.eid
        Action      = $Data.lon
        Status      = $AuditData.ResultStatus
        Severity    = $AuditData.Severity
        Workload    = $AuditData.Source
        Operation   = $Rec.Operations
        Category    = $AuditData.Category
      }
      $Report.Add($ReportLine)
  }
}
 
$Report | Select-Object Timestamp, Action, Operation, User  | Out-GridView