mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
102 lines
5.0 KiB
YAML
102 lines
5.0 KiB
YAML
name: O365 Update application.
|
|
id: 62159133-911b-4c63-9e30-a6a8c89195ca
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs updates made to applications in Microsoft 365, including changes to configurations, permissions, and role assignments.
|
|
mitre_components:
|
|
- Cloud Service Modification
|
|
- Configuration Modification
|
|
- Cloud Service Metadata
|
|
- Application Log Content
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: Update application.
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- ActorContextId
|
|
- Actor{}.ID
|
|
- Actor{}.Type
|
|
- AzureActiveDirectoryEventType
|
|
- CreationTime
|
|
- ExtendedProperties{}.Name
|
|
- ExtendedProperties{}.Value
|
|
- Id
|
|
- InterSystemsId
|
|
- IntraSystemId
|
|
- ModifiedProperties{}.Name
|
|
- ModifiedProperties{}.NewValue
|
|
- ModifiedProperties{}.OldValue
|
|
- ObjectId
|
|
- Operation
|
|
- OrganizationId
|
|
- RecordType
|
|
- ResultStatus
|
|
- SupportTicketId
|
|
- TargetContextId
|
|
- Target{}.ID
|
|
- Target{}.Type
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- action
|
|
- additionalDetails
|
|
- app
|
|
- authentication_service
|
|
- change_type
|
|
- command
|
|
- dataset_name
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- event_type
|
|
- eventtype
|
|
- extendedAuditEventCategory
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- object_attrs
|
|
- object_category
|
|
- punct
|
|
- record_type
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- status
|
|
- tag
|
|
- tag::eventtype
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_agent
|
|
- user_agent_change
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"CreationTime": "2023-09-01T17:16:20", "Id": "c428c85c-4fa0-4e97-9033-6a76d9dee45d", "Operation": "Update application.", "OrganizationId": "58aee3b9-7433-46a0-b54e-2429487992a0", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "UserId": "attacker@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"AppId\":\"95106c0e-3519-450e-8e38-7f326d873454\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "RequiredResourceAccess", "NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"b633e1c5-b582-4048-a93e-9f11b44c7e96\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "RequiredResourceAccess", "OldValue": ""}], "Actor": [{"ID": "attacker@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "58aee3b9-7433-46a0-b54e-2429487992a0", "InterSystemsId": "6a0bc9d4-eb2d-4eb0-a524-601dac6914a6", "IntraSystemId": "a2d4d7c4-727c-401b-9e6c-70413a080855", "SupportTicketId": "", "Target": [{"ID": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}], "TargetContextId": "58aee3b9-7433-46a0-b54e-2429487992a0"}'
|