Data Source: Azure Monitor Activity

Created: 2025-01-13

Last Updated: 2026-10-14

ID: 1997a515-a61a-4f78-ada9-54af34c764f2

Author: Bhavin Patel, Splunk

Description

Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.

Details

Property	Value
Source	`Azure AD`
Sourcetype	`azure:monitor:activity`
Separator	operationName

Name ▲▼	Technique ▲▼	Type ▲▼
Microsoft Intune Mobile Apps	Cloud Services, Software Deployment Tools, Ingress Tool Transfer, Indirect Command Execution	Hunting
Microsoft Intune Device Health Scripts	Cloud Services, Software Deployment Tools, Ingress Tool Transfer, Indirect Command Execution	Hunting
Microsoft Intune Manual Device Management	Cloud Services, Software Deployment Tools, System Shutdown/Reboot	Hunting
Microsoft Intune Bulk Wipe	Disk Content Wipe	TTP
Microsoft Intune DeviceManagementConfigurationPolicies	Cloud Services, Software Deployment Tools, Domain or Tenant Policy Modification, Disable or Modify Tools, Disable or Modify System Firewall	Hunting

Supported Apps

Splunk Add-on for Microsoft Cloud Services (version 6.3.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">category</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">correlationId</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">identity</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">operationName</span>
  
  <span class="pill kill-chain">properties.ActivityDate</span>
  
  <span class="pill kill-chain">properties.ActivityResultStatus</span>
  
  <span class="pill kill-chain">properties.ActivityType</span>
  
  <span class="pill kill-chain">properties.Actor.ActorType</span>
  
  <span class="pill kill-chain">properties.Actor.Application</span>
  
  <span class="pill kill-chain">properties.Actor.ApplicationName</span>
  
  <span class="pill kill-chain">properties.Actor.IsDelegatedAdmin</span>
  
  <span class="pill kill-chain">properties.Actor.Name</span>
  
  <span class="pill kill-chain">properties.Actor.ObjectId</span>
  
  <span class="pill kill-chain">properties.Actor.PartnerTenantId</span>
  
  <span class="pill kill-chain">properties.Actor.UPN</span>
  
  <span class="pill kill-chain">properties.Actor.UserPermissions{}</span>
  
  <span class="pill kill-chain">properties.AdditionalDetails</span>
  
  <span class="pill kill-chain">properties.AuditEventId</span>
  
  <span class="pill kill-chain">properties.Category</span>
  
  <span class="pill kill-chain">properties.RelationId</span>
  
  <span class="pill kill-chain">properties.TargetDisplayNames{}</span>
  
  <span class="pill kill-chain">properties.TargetObjectIds{}</span>
  
  <span class="pill kill-chain">properties.Targets{}.ModifiedProperties{}.Name</span>
  
  <span class="pill kill-chain">properties.Targets{}.ModifiedProperties{}.New</span>
  
  <span class="pill kill-chain">properties.Targets{}.ModifiedProperties{}.Old</span>
  
  <span class="pill kill-chain">properties.Targets{}.Name</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">resource_provider</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">result_id</span>
  
  <span class="pill kill-chain">resultDescription</span>
  
  <span class="pill kill-chain">resultType</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tenantId</span>
  
  <span class="pill kill-chain">time</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
</div>

Example Log

1{"time": "2026-03-29T00:17:39.9903000Z", "tenantId": "32c6bdec-b3a3-4cec-a0ca-1df92bb99b5b", "category": "AuditLogs", "operationName": "wipe ManagedDevice", "properties": {"ActivityDate": "3/29/2026 12:17:39 AM", "ActivityResultStatus": 1, "ActivityType": 3, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "f575e540-cc95-4422-8b09-0b275d214c68", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "bob@contoso.com"}, "AdditionalDetails": "", "AuditEventId": "1f252c59-e344-4844-8a15-1feda5e87466", "Category": 4, "RelationId": null, "TargetDisplayNames": ["wipe"], "TargetObjectIds": ["7a2db475-9dfd-4c42-9b46-464f9f8f8025"], "Targets": [{"ModifiedProperties": [{"Name": "keepEnrollmentData", "Old": null, "New": "False"}, {"Name": "AzureADDeviceId", "Old": null, "New": "4b652e2d-8015-4e7c-8263-f6ae89eda0d2"}, {"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5025-10-23"}], "Name": "wipe"}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "5b275c2d-4de1-447e-83eb-f132acf027f8", "identity": "bob@contoso.com"}

Required Output Fields

action
dest
user
src
vendor_account
vendor_product

Source: GitHub | Version: 3