<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">ActorContextId</span>
<span class="pill kill-chain">ActorIpAddress</span>
<span class="pill kill-chain">Actor{}.ID</span>
<span class="pill kill-chain">Actor{}.Type</span>
<span class="pill kill-chain">additionalDetails</span>
<span class="pill kill-chain">app</span>
<span class="pill kill-chain">authentication_service</span>
<span class="pill kill-chain">AzureActiveDirectoryEventType</span>
<span class="pill kill-chain">ClientIP</span>
<span class="pill kill-chain">command</span>
<span class="pill kill-chain">CreationTime</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">dest_name</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">event_type</span>
<span class="pill kill-chain">extended_properties</span>
<span class="pill kill-chain">extendedAuditEventCategory</span>
<span class="pill kill-chain">ExtendedProperties{}.Name</span>
<span class="pill kill-chain">ExtendedProperties{}.Value</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">Id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">InterSystemsId</span>
<span class="pill kill-chain">IntraSystemId</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">modified_properties</span>
<span class="pill kill-chain">modified_properties_name</span>
<span class="pill kill-chain">modified_properties_new_value</span>
<span class="pill kill-chain">ModifiedProperties{}.Name</span>
<span class="pill kill-chain">ModifiedProperties{}.NewValue</span>
<span class="pill kill-chain">ModifiedProperties{}.OldValue</span>
<span class="pill kill-chain">object</span>
<span class="pill kill-chain">object_id</span>
<span class="pill kill-chain">ObjectId</span>
<span class="pill kill-chain">Operation</span>
<span class="pill kill-chain">OrganizationId</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">record_type</span>
<span class="pill kill-chain">RecordType</span>
<span class="pill kill-chain">result</span>
<span class="pill kill-chain">ResultStatus</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">src</span>
<span class="pill kill-chain">src_ip</span>
<span class="pill kill-chain">src_user</span>
<span class="pill kill-chain">status</span>
<span class="pill kill-chain">SupportTicketId</span>
<span class="pill kill-chain">TargetContextId</span>
<span class="pill kill-chain">Target{}.ID</span>
<span class="pill kill-chain">Target{}.Type</span>
<span class="pill kill-chain">tenant_id</span>
<span class="pill kill-chain">timestamp</span>
<span class="pill kill-chain">user</span>
<span class="pill kill-chain">user_agent</span>
<span class="pill kill-chain">user_agent_change</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">user_type</span>
<span class="pill kill-chain">UserId</span>
<span class="pill kill-chain">UserKey</span>
<span class="pill kill-chain">UserType</span>
<span class="pill kill-chain">vendor_account</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
<span class="pill kill-chain">Workload</span>
</div>
Data Source: O365 Add app role assignment grant to user.
Description
Logs the assignment of an application role grant to a user in Microsoft 365, including details about the role, user, and application involved.
Details
| Property | Value |
|---|---|
| Source | o365 |
| Sourcetype | o365:management:activity |
| Separator | Operation |
Related Detections
| Name | Technique | Type |
|---|---|---|
| O365 Service Principal Privilege Escalation | Additional Cloud Roles | TTP |
| O365 Add App Role Assignment Grant User | Cloud Account | TTP |
Supported Apps
- Splunk Add-on for Microsoft Office 365 (version 6.1.1)
Event Fields
Fields
Example Log
1{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type": 2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "40.124.84.4", "AzureActiveDirectoryEventType": 1, "ClientIP": "40.124.84.4", "CreationTime": "2021-01-05T22:38:18", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "c85f23b8-efbe-408c-937f-87bf275b07a5", "InterSystemsId": "d5e28497-8835-49e2-8caf-25ad7d054f33", "IntraSystemId": "fea87ad1-8c77-48f6-b0fe-6f5f475f10c6", "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "8b292bda-39b6-4b77-849e-887565235bb0", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "msiam_access", "OldValue": ""}, {"Name": "User.ObjectID", "NewValue": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "OldValue": ""}, {"Name": "User.UPN", "NewValue": "rodsoto@rodsoto.onmicrosoft.com", "OldValue": ""}, {"Name": "User.PUID", "NewValue": "10037FFEA938FB92", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "OldValue": ""}], "ObjectId": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Operation": "Add app role assignment grant to user.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Azure AD SAML Toolkit", "Type": 1}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 2}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
Required Output Fields
-
dest
-
user
-
src
-
vendor_account
-
vendor_product
Source: GitHub | Version: 4