mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
91 lines
3.7 KiB
YAML
91 lines
3.7 KiB
YAML
name: O365 MailItemsAccessed
|
|
id: 3d5188eb-341a-4b46-9caa-aade4047d027
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs access to mailbox items in Microsoft 365, including details about the user accessing the items, the accessed content, and the method of access.
|
|
mitre_components:
|
|
- File Access
|
|
- User Account Metadata
|
|
- Application Log Content
|
|
- Active Directory Object Access
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: MailItemsAccessed
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- AppId
|
|
- ClientAppId
|
|
- ClientIPAddress
|
|
- ClientInfoString
|
|
- CreationTime
|
|
- ExternalAccess
|
|
- Folders{}.FolderItems{}.InternetMessageId
|
|
- Folders{}.FolderItems{}.SizeInBytes
|
|
- Folders{}.Id
|
|
- Folders{}.Path
|
|
- Id
|
|
- InternalLogonType
|
|
- IsThrottled
|
|
- LogonType
|
|
- LogonUserSid
|
|
- MailAccessType
|
|
- MailboxGuid
|
|
- MailboxOwnerSid
|
|
- MailboxOwnerUPN
|
|
- Operation
|
|
- OperationCount
|
|
- OperationProperties{}.Name
|
|
- OperationProperties{}.Value
|
|
- OrganizationId
|
|
- OrganizationName
|
|
- OriginatingServer
|
|
- RecordType
|
|
- ResultStatus
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- app
|
|
- authentication_service
|
|
- command
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dvc
|
|
- host
|
|
- index
|
|
- linecount
|
|
- punct
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- status
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"CreationTime": "2024-02-01T16:07:34", "Id": "9cef02e9-4bfa-4c73-be7d-9dad68b9cea8", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user15@splunkresearch.onmicrosoft.com", "AppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientAppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientIPAddress": "120.1.121.35", "ClientInfoString": "Client=WebServices;ExchangeWebServicesProxy/CrossSite/EXCH/15.20.7249.024/python-requests/2.25.1[AppId=47629505-c2b6-4a80-adb1-9b3a3d233b7b];", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "CH0PR18MB5530 (15.20.4200.000)\r\n", "Folders": [{"FolderItems": [{"InternetMessageId": "<CAFpGju6Zzs6HoCNQsDh0=F=vS7KHikisdRrnC_avRsZhqK2iXQ@mail.mail.com>", "SizeInBytes": 44329}, {"InternetMessageId": "<CAFpGju6MHeSA5yKSaPK4w+p1uYWmZ_zew8kF8200_=DtqkvipA@mail.mail.com>", "SizeInBytes": 44304}, {"InternetMessageId": "<CAFpGju7uUnyyuZmuc9rm593BsA6yeB+86GCDg5KzSE48TaAb4Q@mail.mail.com>", "SizeInBytes": 44572}, {"InternetMessageId": "<CH0PR18MB5530506D1B68B05A99A1109FF185A@CH0PR18MB5530.namprd18.prod.outlook.com>", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 4}'
|