mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
79 lines
3.6 KiB
YAML
79 lines
3.6 KiB
YAML
name: Azure Active Directory Update user
|
|
id: 5495c90a-047c-4b8e-b2fe-1db6282d3872
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs an event when a user account is updated in Azure Active Directory.
|
|
mitre_components:
|
|
- User Account Modification
|
|
- User Account Metadata
|
|
source: Azure AD
|
|
sourcetype: azure:monitor:aad
|
|
separator: operationName
|
|
separator_value: Update user
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Cloud Services
|
|
url: https://splunkbase.splunk.com/app/3110
|
|
version: 6.1.1
|
|
fields:
|
|
- _time
|
|
- Level
|
|
- callerIpAddress
|
|
- category
|
|
- correlationId
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- durationMs
|
|
- host
|
|
- index
|
|
- linecount
|
|
- operationName
|
|
- operationVersion
|
|
- properties.activityDateTime
|
|
- properties.activityDisplayName
|
|
- properties.additionalDetails{}.key
|
|
- properties.additionalDetails{}.value
|
|
- properties.category
|
|
- properties.correlationId
|
|
- properties.id
|
|
- properties.initiatedBy.user.displayName
|
|
- properties.initiatedBy.user.id
|
|
- properties.initiatedBy.user.ipAddress
|
|
- properties.initiatedBy.user.userPrincipalName
|
|
- properties.loggedByService
|
|
- properties.operationType
|
|
- properties.result
|
|
- properties.resultReason
|
|
- properties.targetResources{}.displayName
|
|
- properties.targetResources{}.id
|
|
- properties.targetResources{}.modifiedProperties{}.displayName
|
|
- properties.targetResources{}.modifiedProperties{}.newValue
|
|
- properties.targetResources{}.modifiedProperties{}.oldValue
|
|
- properties.targetResources{}.type
|
|
- properties.targetResources{}.userPrincipalName
|
|
- properties.userAgent
|
|
- punct
|
|
- resourceId
|
|
- resultSignature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- tenantId
|
|
- time
|
|
- timeendpos
|
|
- timestartpos
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413199", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-07-24T14:28:15.2233481+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Member\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Member"}]}}'
|