updating o365 stuff

data_sources/office_365_universal_audit_log.yml

@@ -0,0 +1,16 @@
+name: Office 365 Universal Audit Log
+id: 86369e87-5b0b-46fe-8b96-310473dffe7f
+version: 1
+date: '2025-02-21'
+author: Bhavin Patel, Splunk
+description: Data source object for Office 365 Universal Audit Log
+source: o365
+sourcetype: o365:management:activity
+separator: Operation
+supported_TA:
+- name: Splunk Microsoft Office 365 Add-on
+  url: https://splunkbase.splunk.com/app/4055
+  version: 4.7.0
+fields:
+- _time
+example_log: |-

detections/cloud/o365_dlp_rule_triggered.yml

@@ -12,7 +12,7 @@ description: The following analytic detects when Microsoft Office 365 Data Loss
   be evaluated thoroughly to determine what, if any, security relevance the underlying
   DLP events contain.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: "`o365_management_activity` Operation=DLPRuleMatch | eval recipient = 'ExchangeMetaData.To{}',
   signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName'
   , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName',

detections/cloud/o365_email_access_by_security_administrator.yml

@@ -10,7 +10,7 @@ description: The following analytic identifies when a user with sufficient acces
   Explorer) to directly view email. Adversaries may exploit privileged access with
   this premium feature to enumerate or exfiltrate sensitive data.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
   | stats values(Workload) as category, values(MailboxId) as user, values(Operation)
   as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId,

detections/cloud/o365_email_reported_by_admin_found_malicious.yml

@@ -11,7 +11,7 @@ description: The following analytic detects when an email manually submitted to
   users to report potentially malicious emails. This correlation looks for any submission
   that returns a Phish or Malware verdict upon submission.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
   | search RescanVerdict IN (Phish,Malware) | stats values(Subject) as subject, values(RescanVerdict)
   as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender)

detections/cloud/o365_email_reported_by_user_found_malicious.yml

@@ -11,7 +11,7 @@ description: The following analytic detects when an email submitted to Microsoft
   to report potentially malicious emails. This correlation looks for any submission
   that returns a Phish or Malware verdict upon submission.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter  Operation=AlertEntityGenerated
   Name="Email reported by user as*" | fromjson Data | rename _raw AS temp etps AS
   _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw | search

detections/cloud/o365_email_security_feature_changed.yml

@@ -11,7 +11,7 @@ description: The following analytic identifies when specific O365 advanced secur
   detection. This can lead to unauthorized data access, data exfiltration, account
   compromise, or other malicious activities without leaving a detailed audit trail.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*")
   Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") | stats
   values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count  by

detections/cloud/o365_email_suspicious_behavior_alert.yml

@@ -12,7 +12,7 @@ description: The following analytic identifies when one of O365 the built-in sec
   Certain premium Office 365 capabilities further enhance these detection and response
   functions.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated
   Name IN ("Suspicious email sending patterns detected","User restricted from sending
   email","Suspicious Email Forwarding Activity","Email sending limit exceeded") |

detections/cloud/o365_safe_links_detection.yml

@@ -9,7 +9,7 @@ description: The following analytic detects when any Microsoft Safe Links alerti
   is triggered. This behavior may indicate when user has interacted with a phishing
   or otherwise malicious link within the Microsoft Office ecosystem.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated
   | fromjson Data | stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId)
   as url values(od) as desc by AlertId,trc,Operation,Name,ot | rename Name as signature,

detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml

@@ -12,7 +12,7 @@ description: The following analytic identifies when the allowed domain settings
   should be monitored by security teams as they could potentially lead to unauthorized
   access.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged
   \"ModifiedProperties{}.Name\"=AllowDomainList | eval signature_id = CorrelationId,
   signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name',

detections/cloud/o365_sharepoint_malware_detection.yml

@@ -11,7 +11,7 @@ description: The following analytic identifies when a malicious file is detected
   365 capabilities should be monitored and responded to appropriately. Certain premium
   Office 365 capabilities further enhance these detection and response functions.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Operation=FileMalwareDetected | stats values(Workload)
   as category, values(SourceFileName) as file_name values(ObjectId) as file_path,
   values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime

detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml

@@ -12,7 +12,7 @@ description: The following analytic identifies when a suspicious email is detect
   and responded to appropriately. Certain premium Office 365 capabilities such as
   Safe Attachment and Safe Links further enhance these detection and response functions.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData
   DeliveryAction!=Blocked Directionality=InBound | rename P2Sender as src_user, P1Sender
   as sender, Recipients{} as user, DeliveryAction as action | stats values(SenderIp)

detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml

@@ -12,7 +12,7 @@ description: The following analytic identifies when a malicious file is detected
   and responded to appropriately. Certain premium Office 365 capabilities such as
   Safe Attachment and Safe Links further enhance these detection and response functions.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection
   | stats values(DetectionMethod) as category  values(FileData.FileName) as file_name
   values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily)

detections/cloud/o365_zap_activity_detection.yml

@@ -11,7 +11,7 @@ description: The following analytic detects when the Microsoft Zero-hour Automat
   content for user inboxes. Since this is a retroactive capability, there is still
   a window in which the user may fall victim to the malicious content.
 data_source:
-- O365 Universal Audit Log
+- Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated
   Name="*messages containing malicious*" | fromjson Data | stats count min(_time)
   as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms)