Data Source: O365

Created: 2024-07-16

Last Updated: 2026-10-14

ID: b32de97d-0074-4cca-853c-db22c392b6c0

Author: Patrick Bareiss, Splunk

Description

Logs management activities in Microsoft 365, including administrative actions, user activities, and configuration changes across various services.

Details

Property	Value
Source	`o365`
Sourcetype	`o365:management:activity`
Separator	Operation

Name ▲▼	Technique ▲▼	Type ▲▼
O365 ApplicationImpersonation Role Assigned	Additional Email Delegate Permissions	TTP
O365 User Consent Denied for OAuth Application	Steal Application Access Token	TTP
O365 PST export alert	Email Collection	TTP
O365 New Federated Domain Added	Cloud Account	TTP
O365 Service Principal New Client Credentials	Additional Cloud Credentials	TTP
O365 Added Service Principal	Cloud Account	TTP

Supported Apps

Splunk Add-on for Microsoft Office 365 (version 6.1.1)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">AppAccessContext.IssuedAtTime</span>
  
  <span class="pill kill-chain">AppAccessContext.UniqueTokenId</span>
  
  <span class="pill kill-chain">AppId</span>
  
  <span class="pill kill-chain">authentication_service</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">ClientAppId</span>
  
  <span class="pill kill-chain">ClientIP</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">CreationTime</span>
  
  <span class="pill kill-chain">dataset_name</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_name</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">ExternalAccess</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">Id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">object</span>
  
  <span class="pill kill-chain">object_attrs</span>
  
  <span class="pill kill-chain">object_category</span>
  
  <span class="pill kill-chain">object_id</span>
  
  <span class="pill kill-chain">ObjectId</span>
  
  <span class="pill kill-chain">Operation</span>
  
  <span class="pill kill-chain">OrganizationId</span>
  
  <span class="pill kill-chain">OrganizationName</span>
  
  <span class="pill kill-chain">OriginatingServer</span>
  
  <span class="pill kill-chain">Parameters{}.Name</span>
  
  <span class="pill kill-chain">Parameters{}.Value</span>
  
  <span class="pill kill-chain">Params</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">record_type</span>
  
  <span class="pill kill-chain">RecordType</span>
  
  <span class="pill kill-chain">RequestId</span>
  
  <span class="pill kill-chain">result</span>
  
  <span class="pill kill-chain">ResultStatus</span>
  
  <span class="pill kill-chain">Role</span>
  
  <span class="pill kill-chain">SessionId</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">tenant_id</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">User</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">UserId</span>
  
  <span class="pill kill-chain">UserKey</span>
  
  <span class="pill kill-chain">UserType</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
  <span class="pill kill-chain">Workload</span>
  
</div>

Example Log

1{"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId": "g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a", "Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08", "RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType": 2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId": "splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com", "AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess": false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"}, {"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}], "RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"}

Source: GitHub | Version: 4