Change scan name

[Johnthe0n]

I have uninstalled and reinstalled the Hawk PS module and the scan is still showing with the same scan name from the previous install, is there a way to resolve this?
Thank you

[clj575]

I can confirm this issue. This has been happening since the last update. The tenant would update when creating a new scan. Now it stays the same on every new client.

[T0pCyber]

We're taking a look. Appreciate letting us know.

[MSFT-SeanG]

@Johnthe0n & @clj575

Which cmdlet are you calling that this is presenting the issue - User or Tenant investigations?

[MackT4]

@MSFT-SeanG I am seeing the same issue when using the Start-HawkTenantInvestigation cmdlet. Also found this registry key showing that previous path Computer\HKEY_CURRENT_USER\Software\Microsoft\WindowsPowerShell\PSFramework\Config\Default\Hawk.FilePath

[T0pCyber]

@MackT4, @clj575, @Johnthe0n - Are you creating a new session when you run Hawk? The expected result within the same session is to save the results to the same global folder. We're trying to replicate the experience. Would you want an option to input new folder path within the same session?

[MackT4]

@T0pCyber - Yes new powershell window and new sessions. Just not sure where the current folder name is being draw from (changing that registry entry did not seem to do it). The name I am seeing would have been the last tenant investigation that was ran before upgrading to the Graph version. The output directory is working fine its just that Hawk.Filepath seems to be "stuck".

[Johnthe0n]

Sorry, I have not logged in here in FOREVER. Its a new session I am running each time and I have uninstalled and reinstalled the HAWK system from PowerShell, that did not work. I am saving the sessions to different folders each time I run scans.