mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
109 lines
3.4 KiB
YAML
109 lines
3.4 KiB
YAML
name: O365 ModifyFolderPermissions
|
|
id: 0a8c1080-68c2-46d7-8324-2e7d97bb6e2f
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs modifications to folder permissions in Microsoft 365, including updates to access levels, user assignments, and sharing settings.
|
|
mitre_components:
|
|
- User Account Modification
|
|
- File Access
|
|
- Active Directory Object Modification
|
|
- Application Log Content
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: ModifyFolderPermissions
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- AppId
|
|
- ClientIP
|
|
- ClientIPAddress
|
|
- ClientInfoString
|
|
- CreationTime
|
|
- ExternalAccess
|
|
- Id
|
|
- InternalLogonType
|
|
- Item.Id
|
|
- Item.ParentFolder.Id
|
|
- Item.ParentFolder.MemberRights
|
|
- Item.ParentFolder.MemberSid
|
|
- Item.ParentFolder.MemberUpn
|
|
- Item.ParentFolder.Name
|
|
- Item.ParentFolder.Path
|
|
- LogonType
|
|
- LogonUserSid
|
|
- MailboxGuid
|
|
- MailboxOwnerSid
|
|
- MailboxOwnerUPN
|
|
- Operation
|
|
- OrganizationId
|
|
- OrganizationName
|
|
- OriginatingServer
|
|
- RecordType
|
|
- ResultStatus
|
|
- SessionId
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- action
|
|
- app
|
|
- authentication_service
|
|
- change_type
|
|
- client_info_str
|
|
- command
|
|
- dataset_name
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- eventtype
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- object_attrs
|
|
- object_category
|
|
- object_id
|
|
- punct
|
|
- record_type
|
|
- result
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- status
|
|
- tag
|
|
- tag::eventtype
|
|
- tenant_id
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_agent
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"CreationTime": "2023-09-07T18:19:07", "Id": "ff065c17-e638-4013-20ab-08dbafceeca1", "Operation": "ModifyFolderPermissions", "OrganizationId": "e17879dd-24ec-44a6-be92-9dcbf6969220", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "10032002CC029AE9", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "22.23.21.25", "UserId": "user1@contoso.onmicrosoft.com", "AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientIPAddress": "22.23.21.25", "ClientInfoString": "Client=OWA;Action=ViaProxy", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxGuid": "8e942cc1-73d8-4483-9def-7d9579d615a7", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxOwnerUPN": "user1@contoso.onmicrosoft.com", "OrganizationName": "contoso.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2728 (15.20.4200.000)\r\n", "SessionId": "d2a5a3ba-992b-431a-9b52-8c76210d17d9", "Item": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}'
|