mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
101 lines
3.5 KiB
YAML
101 lines
3.5 KiB
YAML
name: O365 UserLoggedIn
|
|
id: ed29c8c4-4053-419c-b133-16abf2a1c4c9
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs successful login events by users in Microsoft 365, including details about the user account, IP address, and session metadata.
|
|
mitre_components:
|
|
- User Account Authentication
|
|
- Logon Session Creation
|
|
- User Account Metadata
|
|
- Logon Session Metadata
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: UserLoggedIn
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- ActorContextId
|
|
- ActorIpAddress
|
|
- Actor{}.ID
|
|
- Actor{}.Type
|
|
- ApplicationId
|
|
- AzureActiveDirectoryEventType
|
|
- BrowserType
|
|
- ClientIP
|
|
- CreationTime
|
|
- DeviceProperties{}.Name
|
|
- DeviceProperties{}.Value
|
|
- ErrorNumber
|
|
- ExtendedProperties{}.Name
|
|
- ExtendedProperties{}.Value
|
|
- Id
|
|
- InterSystemsId
|
|
- IntraSystemId
|
|
- OS
|
|
- ObjectId
|
|
- Operation
|
|
- OrganizationId
|
|
- RecordType
|
|
- RequestType
|
|
- ResultStatus
|
|
- ResultStatusDetail
|
|
- SessionId
|
|
- SupportTicketId
|
|
- TargetContextId
|
|
- Target{}.ID
|
|
- Target{}.Type
|
|
- UserAgent
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- app
|
|
- authentication_service
|
|
- command
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- event_type
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- punct
|
|
- record_type
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- status
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_agent
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}'
|