name: O365
id: 11c0eed5-3f3f-42e4-bf72-30f11295a686
author: Patrick Bareiss, Splunk
source: o365
sourcetype: o365:management:activity
separator: Operation
supported_TA:
  name: Splunk Add-on for Microsoft Office 365
  version: 4.5.1
  url: https://splunkbase.splunk.com/app/4055
event_names:
- event_name: O365
  data_source: data_sources/cloud/event_sources/O365.yml
- event_name: O365 Add app role assignment grant to user.
  data_source: data_sources/cloud/event_sources/O365_Add_app_role_assignment_grant_to_user..yml
- event_name: O365 Add app role assignment to service principal.
  data_source: data_sources/cloud/event_sources/O365_Add_app_role_assignment_to_service_principal..yml
- event_name: O365 Add member to role.
  data_source: data_sources/cloud/event_sources/O365_Add_member_to_role..yml
- event_name: O365 Add owner to application.
  data_source: data_sources/cloud/event_sources/O365_Add_owner_to_application..yml
- event_name: O365 Add service principal.
  data_source: data_sources/cloud/event_sources/O365_Add_service_principal..yml
- event_name: O365 Add-MailboxPermission
  data_source: data_sources/cloud/event_sources/O365_Add-MailboxPermission.yml
- event_name: O365 Change user license.
  data_source: data_sources/cloud/event_sources/O365_Change_user_license..yml
- event_name: O365 Consent to application.
  data_source: data_sources/cloud/event_sources/O365_Consent_to_application..yml
- event_name: O365 Disable Strong Authentication.
  data_source: data_sources/cloud/event_sources/O365_Disable_Strong_Authentication..yml
- event_name: O365 MailItemsAccessed
  data_source: data_sources/cloud/event_sources/O365_MailItemsAccessed.yml
- event_name: O365 ModifyFolderPermissions
  data_source: data_sources/cloud/event_sources/O365_ModifyFolderPermissions.yml
- event_name: O365 Set Company Information.
  data_source: data_sources/cloud/event_sources/O365_Set_Company_Information..yml
- event_name: O365 Set-Mailbox
  data_source: data_sources/cloud/event_sources/O365_Set-Mailbox.yml
- event_name: O365 Update application.
  data_source: data_sources/cloud/event_sources/O365_Update_application..yml
- event_name: O365 Update authorization policy.
  data_source: data_sources/cloud/event_sources/O365_Update_authorization_policy..yml
- event_name: O365 Update user.
  data_source: data_sources/cloud/event_sources/O365_Update_user..yml
- event_name: O365 UserLoggedIn
  data_source: data_sources/cloud/event_sources/O365_UserLoggedIn.yml
- event_name: O365 UserLoginFailed
  data_source: data_sources/cloud/event_sources/O365_UserLoginFailed.yml
fields:
- _time
- AppAccessContext.IssuedAtTime
- AppAccessContext.UniqueTokenId
- AppId
- ClientAppId
- ClientIP
- CreationTime
- ExternalAccess
- Id
- Name
- ObjectId
- Operation
- OrganizationId
- OrganizationName
- OriginatingServer
- Parameters{}.Name
- Parameters{}.Value
- RecordType
- RequestId
- ResultStatus
- Role
- SessionId
- User
- UserId
- UserKey
- UserType
- Version
- Workload
- app
- authentication_service
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dest_name
- dvc
- host
- index
- linecount
- object
- punct
- record_type
- signature
- source
- sourcetype
- splunk_server
- src
- src_ip
- status
- timeendpos
- timestartpos
- user
- user_id
- user_type
- vendor_account
- vendor_product
example_log: '{"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId":
  "g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a",
  "Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08",
  "RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType":
  2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId":
  "splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com",
  "AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess":
  false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer":
  "BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"},
  {"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}],
  "RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"}'