mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
69 lines
2.8 KiB
YAML
69 lines
2.8 KiB
YAML
name: M365 Copilot Graph API
|
|
id: 30dd2202-869c-47fb-ad37-4f4d4c93c6b7
|
|
version: 2
|
|
creation_date: '2025-10-13'
|
|
modification_date: '2026-05-13'
|
|
author: Rod Soto, Splunk
|
|
description: Access Logs from M365 Copilot access via Graph API
|
|
source: AuditLogs.SignIns
|
|
sourcetype: o365:graph:api
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- appDisplayName
|
|
- appId
|
|
- clientAppUsed
|
|
- conditionalAccessStatus
|
|
- correlationId
|
|
- createdDateTime
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- deviceDetail.browser
|
|
- deviceDetail.deviceId
|
|
- deviceDetail.displayName
|
|
- deviceDetail.isCompliant
|
|
- deviceDetail.isManaged
|
|
- deviceDetail.operatingSystem
|
|
- deviceDetail.trustType
|
|
- eventtype
|
|
- host
|
|
- id
|
|
- index
|
|
- ipAddress
|
|
- isInteractive
|
|
- linecount
|
|
- location.city
|
|
- location.countryOrRegion
|
|
- location.geoCoordinates.altitude
|
|
- location.geoCoordinates.latitude
|
|
- location.geoCoordinates.longitude
|
|
- location.state
|
|
- punct
|
|
- resourceDisplayName
|
|
- resourceId
|
|
- riskDetail
|
|
- riskLevelAggregated
|
|
- riskLevelDuringSignIn
|
|
- riskState
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- status.additionalDetails
|
|
- status.errorCode
|
|
- status.failureReason
|
|
- timeendpos
|
|
- timestartpos
|
|
- userDisplayName
|
|
- userId
|
|
- userPrincipalName
|
|
output_fields: []
|
|
example_log: '{"id": "7fbc0a97-7f78-4cc8-9377-dc94d2ad1e00", "createdDateTime": "2025-09-30T12:34:20Z", "userDisplayName": "Rod Soto", "userPrincipalName": "rodsoto@rodsoto.onmicrosoft.com", "userId": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "appId": "9199bf20-a13f-4107-85dc-02114787ef48", "appDisplayName": "One Outlook Web", "ipAddress": "127.0.0.1", "clientAppUsed": "Browser", "correlationId": "8fe7aa9b-42c8-b52e-c6f2-8e4dfc07996b", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": "MFA requirement satisfied by claim in the token"}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Chrome 140.0.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Miami", "state": "Florida", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 25.76286, "longitude": -80.31196}}, "appliedConditionalAccessPolicies": []}'
|