mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
101 lines
4.5 KiB
YAML
101 lines
4.5 KiB
YAML
name: O365 Update user.
|
|
id: a05fd01e-34d9-4233-9089-11272416b531
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs updates to user account properties in Microsoft 365, including changes to roles, permissions, and profile information.
|
|
mitre_components:
|
|
- User Account Modification
|
|
- User Account Metadata
|
|
- Active Directory Object Modification
|
|
- Application Log Content
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: Update user.
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- ActorContextId
|
|
- Actor{}.ID
|
|
- Actor{}.Type
|
|
- AzureActiveDirectoryEventType
|
|
- CreationTime
|
|
- ExtendedProperties{}.Name
|
|
- ExtendedProperties{}.Value
|
|
- Id
|
|
- InterSystemsId
|
|
- IntraSystemId
|
|
- ModifiedProperties{}.Name
|
|
- ModifiedProperties{}.NewValue
|
|
- ModifiedProperties{}.OldValue
|
|
- ObjectId
|
|
- Operation
|
|
- OrganizationId
|
|
- RecordType
|
|
- ResultStatus
|
|
- SupportTicketId
|
|
- TargetContextId
|
|
- Target{}.ID
|
|
- Target{}.Type
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- action
|
|
- additionalDetails
|
|
- app
|
|
- authentication_service
|
|
- change_type
|
|
- command
|
|
- dataset_name
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- event_type
|
|
- eventtype
|
|
- extendedAuditEventCategory
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- object_attrs
|
|
- object_category
|
|
- punct
|
|
- record_type
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src_user
|
|
- status
|
|
- tag
|
|
- tag::eventtype
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595-90b9-99b8f91811c3", "Operation": "Update user.", "OrganizationId": "99825d50-9544-4061-8e46-68923805cbf2", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@splunkresearch1.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victim@splunkresearch1.onmicrosoft.com", "UserId": "victim@splunkresearch1.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"UserType\":\"Member\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [{"Name": "StrongAuthenticationMethod", "NewValue": "[\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 0,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 5,\r\n \"Default\": false\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n }\r\n]"}, {"Name": "StrongAuthenticationRequirement", "NewValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 1,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationMethod, StrongAuthenticationRequirement", "OldValue": ""}, {"Name": "TargetId.UserType", "NewValue": "Member", "OldValue": ""}], "Actor": [{"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "99825d50-9544-4061-8e46-68923805cbf2", "InterSystemsId": "533a45c6-4f9a-4527-ad8d-e8fec5c7d8e4", "IntraSystemId": "32734207-053e-4ad1-87a3-4da1dfa69c58", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"}'
|