Application friendly name of the application performing the operation. Extends the Common schema with the properties specific to all reports events. The total number of all recipients on the TO, CC, and BCC lines of the message. Enable a webhook that was disabled because of excessive failed notifications. A similar source type, o365:management:activity, is in the Splunk Add-on for Microsoft Office 365. mscs_audit_auth_all_changes, User modifies a resource engagement in Project Web App. The value is false for a documented edited in Office 365. Each attribute in the following table corresponds to a field in Splunk Web. Application friendly name of the application performing the operation.Outlook (for email), OWA (for email), Word (for file), Excel (for file), PowerPoint (for file). These events exist in both Exchange and SharePoint Online and OneDrive for Business. The following is an example of a notification. The WorkPlace Analytics events listed in Search the audit log in the Office 365 Security & Compliance Center will use this schema. Information about document properties that triggered a rule match. The size of the message in bytes with UTF-16 encoding. Create an Azure Active Directory Application An Azure Active Directory application is required to allow Splunk to read information from Azure. The value is False for documented edited in Office 365. If there are more results in the specified time range than can be returned in single response, the results will be truncated and a header will be added to the response indicating the URL to use to retrieve the next page of results. This operation retrieves friendly names for objects in the data feed identified by guids. Set only if the CrossMailboxOperations parameter is. Investigation events are logged based on a change in investigation status. The Yammer events listed in Search the audit log in the Security & Compliance Center will use this schema. These actions and events are also available in the Office 365 Activity Reports. For example, an alert policy is defined to trigger an alert if any user deletes more than 100 files in 5 minutes. The GUID for your organization's Office 365 tenant. The possible values are unknown, localMedia, removableMedia, fileshare, and cloud. In SharePoint, another value display in the UserId property is app@sharepoint. Indicates the value for the attribute that is the primary field for the entity. Site administrator enables document preview for a SharePoint site. The tenant ID is a GUID. Network ID of the user that performed the operation. Policy action in the Safe attachments in Defender for Office 365 policy. This event includes folder metadata changes, such as tags and properties. Safe links time-of-block and block override events from Microsoft Defender for Office 365. Click action for the URL based on the organization's policies for. The name of the workspace where the event occurred. A user who has submitted a response to a form. The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. For a description of the most common operations/activities. The intent of this audit schema is to represent the sum of all portal activity that involves accessing the encrypted mail by external recipients. User modifies a project in Project Web App. This is the user friendly name of the object that was modified by the cmdlet. The name of the entity in the organization. Specified tenant ID ({0}) does not exist in the system or has been deleted. The returned content will be a collection of one more actions or events in JSON format. Read focused primers on disruptive technology topics. This property is included for admin events. See SyncFrequency for possible values. Extends the Common schema with the properties specific to the Communication compliance offensive language model. Use the /content operation instead. For example, Windows. The Exchange GUID of the mailbox that was accessed. Extends the Common schema with the properties specific to all Viva Goals events. Access timely security research and guidance. For more information, see: Remove blocked users from the Restricted Users portal in Office 365. Policy action is to Bcc the email message to email address specificed by the filtering policy. (Events for manually generated investigations are coming soon.) If we do not receive an HTTP 200 OK response, the subscription will not be created. Extends the Common schema with the properties specific to encrypted message portal accessed by external recipients. Id of the container associated with the plan. The Guid of the list. Splunk_ta_o365. The tenant ID passed in the URL ({0}) does not match the tenant ID passed in the access token ({1}). The URL will contain the same startTime and endTime parameters that were specified in the original request, together with a parameter indicating the internal ID of the next page. Hi ninjas, I am collecting following logs. This includes audit records for the SupervisoryReviewOLAudit operation that's generated when email message content contains offensive language identified by anti-spam models with a match accuracy of >= 99.5%. This property is from OrgIdLogon.LoginStatus directly. As a result of this distributed process, the actions and events contained in the content blobs will not necessarily appear in the order in which they occurred. The name of the user or admin activity. Details about the client device, device OS, and device browser that was used for the of the account login event. We recommend that you use the new ThreatsAndDetectionTech field because it shows multiple verdicts and the updated detection technologies. You can use this operation to help investigate issues related to webhooks and notifications, but you should not use it to determine what content is currently available for retrieval. An administrator who has access to the form. consider posting a question to Splunkbase Answers. Difference with Splunk Add-on for Microsoft Cloud Is it an anti-pattern to add your own modification Splunk Add-on for Microsoft Cloud Services to inde How to get Windows data into Splunk Cloud? The name of the team the message belongs to. User redacts an enterprise resource removing all personal information in Project Web App. Possible values are All, List and FilterUri. Customer success starts with data success. Automated incident response (AIR) events. Events for consent actions performed by tenant admins for Microsoft Graph Data Connect applications. Only present for settings events. All organizations are initially allocated a baseline of 2,000 requests per minute. For Exchange it includes false positive and override information. Null when the sensitivity label is removed. The plan originates from Microsoft Project. The property is included for admin events, such as adding or modifying role permissions given to Microsoft Defender Experts. The display name of the application performing the operation. All API operations require an Authorization HTTP header with an access token obtained from Azure AD. Because we retry notifications in the event of failure, this operation can return multiple notifications for the same content, and the order in which the notifications are sent will not necessarily match the order in which the content became available (especially when there are failures and retries). User Impersonation (UIMP) action in the Anti-phish policy. SMTP address of the user on whose behalf the email is sent. Extends the Common schema with the properties specific to all Microsoft Teams events. System information related to the hygiene event. Name of the group in the operation. Document LifeCycle Policy has been updated for a site collection. Extends the SharePoint Base schema with the properties specific to file sharing. The IP address is displayed in either an IPv4 or IPv6 address format. User copies a document from a SharePoint or OneDrive for Business site. Alert Type - Scheduled. Deep-link to the file event in Explorer or Real-time reports in the Security & Compliance Center. Phish policy action in the Anti-phish policy applied to ZAP. The authentication method is a secure Pin. User modifies the a Project Web App configuration. The following table contain information related to AIP heartbeat events. contentExpiration: The datetime after which the content will no longer be available for retrieval. Forms that are created with the New Form option. Indicates whether this is a Form, Quiz, or Survey. Used for comments and other generic information. Information about the user's client or browser. Describes metadata about the document in SharePoint or OneDrive for Business that contained the sensitive information. Events related to the customer key encryption service. Describes metadata about the email message that contained the sensitive information. Extends the Common schema with the properties specific to Microsoft Project For The Web events. Shows the value of Label Action. A unique identifier of the group in Azure Active Directory that the message belongs to. Refer DataStoreType for all possible values. Site administrator or owner renames a SharePoint or OneDrive for Business site. The New/current value of the object after change. We return an error if the subscription status is disabled. A quiz is a special type of form that includes additional features such as point values, auto and manual grading, and commenting. Outlook (for email), OWA (for email), Word (for file), Excel (for file), PowerPoint (for file). Because the notification includes the tenant identifier, you can use the same webhook to receive notifications for all tenants for which you have subscriptions. Information about the state of various tenant level switches. The API relies on Azure AD and the OAuth2 protocol for authentication and authorization. User creates, modifies or deletes a permissions template in Project Web App. The notification system sends notifications as new content becomes available. A cmdlet is the source where the request from a user to preview, delete, release, export, or view the header of a potentially harmful email message can originate from. The values for this parameter are Admin, Owner, Responder, or Coauthor. The authentication method is a EncProxyPasswordHash. The name of the sensitivity label applied to the email message. This indicates that the "user" who performed the activity was an application that has the necessary permissions in SharePoint to perform organization-wide actions (such as search a SharePoint site or OneDrive account) on behalf of a user, admin, or service. The Exchange Online Protection service plan assigned to the user that executed the cmdlet. Outlook, msip.app, WinWord. Old value of the setting. Site administrator or owner changes the settings of a group for a SharePoint or OneDrive for Business site. Notifications are sent to the configured webhook for a subscription as new content becomes available. Closing this box indicates that you accept our Cookie Policy. User publishes a project in Project Web App. One content blob can contain actions and events that occurred prior to the actions and events contained in an earlier content blob. A person with administrative privileges for someone's mailbox. This operation returns a collection of the current subscriptions together with the associated webhooks. sourcetype = o365:management:activity start_by_shell = false disabled = 0 [splunk_ta_o365_management_activity://AuditSharePoint] content_type = Audit.SharePoint index = o365_management_activity interval = 300 tenant_name = o365 number_of_threads = 8 sourcetype = o365:management:activity [splunk_ta_o365_management_activity://AuditGeneral] The recipient of an invitation to view or edit a shared file (or folder) has accessed the shared file by clicking on the link in the invitation. Events related to extractions done by Microsoft Graph Data Connect. Microsoft Planner extends the Common schema with the following record types. Splunk, Splunk>, Turn Data Into Doing, and Data-to-Everything are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. Site administrator or owner adds the SharePoint Workflow Task content type to the site. For instructions, see Turn Office 365 audit log search on or off. If the subscription is later restarted, you'll have access to new content from that point forward. The scope group list for the dataset in the consent operation. The list definition type on which the list is based. Ask a question or make a suggestion. This property is displayed only for FileCopied and FileMoved events. configured via Security & Compliance Center). User accesses portfolio content (driver library, driver prioritization, portfolio analyses) in Project Web App. The Get-AipServiceTemplate cmdlet gets all existing or selected protection templates from Azure Information Protection. Furthermore, if you do get any results in response to a request for more than 24 hours, these could be partial results and should not be taken into account. Severity levels include: Category of the alert. This event was created by a hosted O365 service. The return path of sender of the email message. The email address of the person who owns the mailbox that was accessed. Used when the requested plan is not found. User checks out an enterprise resource located in Project Web App. An invitation can be withdrawn only before it's accepted. The file extension of a file that is copied or moved. The date the sensitivity label was applied to the email message. Ask a question or make a suggestion. The following table contains information related to AIP sensitivity label events. Adding a person to a group grants the user the permissions that were assigned to the group. The type of the channel the message belongs to. Users can browser-enable form templates that don't contain form code, require full trust, enable rendering on a mobile device, or use a data connection managed by a server administrator. User renames a document on a SharePoint or OneDrive for Business site. Collection(Edm.String)Term="Microsoft.Office.Audit.Schema.PIIFlag" Bool="true". Device platform (Win, OSX, Android, iOS).. Fixed a bug related to getting 401 authorization errors for Management Activity inputs. User deletes a folder from the second-stage recycle bin on a SharePoint or OneDrive for Business site. The URL for the API endpoint that you use is based on the type of Microsoft 365 or Office 365 subscription plan for your organization. All log events generated by the Splunk Add-on for Microsoft Office 365. The Splunk Add-on for Microsoft Office 365 provides the index-time and search-time knowledge for audit, service status, and service message events in the following formats. You will not be able to retrieve content that was available between the time the subscription was stopped and restarted. The application where the activity happened and displayed in GUID. User forces a check in on a project in Project Web App. The view to extract Record Type, User ID, Client IP, User type and Action along with core dimensions such as user properties (such as UserID), location properties (such as Client IP), and service-specific properties (such as Object Id). The name of the dataset in the consent operation. Any response other than HTTP 200 OK will be considered a failure and the notification will be retried. The type of channel being audited (Standard/Private). The Office 365 Management Activity API is a REST web service that you can use to develop solutions using any language and hosting environment that supports HTTPS and X.509 certificates. To begin retrieving content blobs for a tenant, you first create a subscription to the desired content types. The operation type for the audit log.The name of the user or admin activity. Currently, these content types are supported: Audit.General (includes all other workloads not included in the previous content types), DLP.All (DLP events only for all workloads). For more information about sensitivity labels, see: Apply a sensitivity label to content automatically. The size of a chat or channel message in bytes with UTF-16 encoding. The operation type indicated by the record. Events related to sharing of data ingested via SystemSync. definition: sourcetype=o365:management:activity: description: customer specific splunk configurations(eg- index, source, sourcetype). The authentication method is an LMPasswordHash. An error is returned if the subscription status is disabled. Here we are only listing the relevant MIP Record types. Stores the UPN or name of the target user or group that a resource was shared with. The name of the channel the message belongs to. The query that was used to identify the messages of the mail cluster, The number of mail messages that are part of the mail cluster. This is from where the operation originated. Represents a timesheet line classification. An In-Place Hold was placed on a content source. For failed logins, this property contains a user-readable description of the reason for the failed login. Microsoft Defender for Office 365 and Threat Investigation and Response events are available for Office 365 customers who have an Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, or an E5 subscription.