mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
124 lines
4.4 KiB
YAML
124 lines
4.4 KiB
YAML
name: O365
|
|
id: 11c0eed5-3f3f-42e4-bf72-30f11295a686
|
|
author: Patrick Bareiss, Splunk
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
supported_TA:
|
|
name: Splunk Add-on for Microsoft Office 365
|
|
version: 4.5.1
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
event_names:
|
|
- event_name: O365
|
|
data_source: data_sources/cloud/event_sources/O365.yml
|
|
- event_name: O365 Add app role assignment grant to user.
|
|
data_source: data_sources/cloud/event_sources/O365_Add_app_role_assignment_grant_to_user..yml
|
|
- event_name: O365 Add app role assignment to service principal.
|
|
data_source: data_sources/cloud/event_sources/O365_Add_app_role_assignment_to_service_principal..yml
|
|
- event_name: O365 Add member to role.
|
|
data_source: data_sources/cloud/event_sources/O365_Add_member_to_role..yml
|
|
- event_name: O365 Add owner to application.
|
|
data_source: data_sources/cloud/event_sources/O365_Add_owner_to_application..yml
|
|
- event_name: O365 Add service principal.
|
|
data_source: data_sources/cloud/event_sources/O365_Add_service_principal..yml
|
|
- event_name: O365 Add-MailboxPermission
|
|
data_source: data_sources/cloud/event_sources/O365_Add-MailboxPermission.yml
|
|
- event_name: O365 Change user license.
|
|
data_source: data_sources/cloud/event_sources/O365_Change_user_license..yml
|
|
- event_name: O365 Consent to application.
|
|
data_source: data_sources/cloud/event_sources/O365_Consent_to_application..yml
|
|
- event_name: O365 Disable Strong Authentication.
|
|
data_source: data_sources/cloud/event_sources/O365_Disable_Strong_Authentication..yml
|
|
- event_name: O365 MailItemsAccessed
|
|
data_source: data_sources/cloud/event_sources/O365_MailItemsAccessed.yml
|
|
- event_name: O365 ModifyFolderPermissions
|
|
data_source: data_sources/cloud/event_sources/O365_ModifyFolderPermissions.yml
|
|
- event_name: O365 Set Company Information.
|
|
data_source: data_sources/cloud/event_sources/O365_Set_Company_Information..yml
|
|
- event_name: O365 Set-Mailbox
|
|
data_source: data_sources/cloud/event_sources/O365_Set-Mailbox.yml
|
|
- event_name: O365 Update application.
|
|
data_source: data_sources/cloud/event_sources/O365_Update_application..yml
|
|
- event_name: O365 Update authorization policy.
|
|
data_source: data_sources/cloud/event_sources/O365_Update_authorization_policy..yml
|
|
- event_name: O365 Update user.
|
|
data_source: data_sources/cloud/event_sources/O365_Update_user..yml
|
|
- event_name: O365 UserLoggedIn
|
|
data_source: data_sources/cloud/event_sources/O365_UserLoggedIn.yml
|
|
- event_name: O365 UserLoginFailed
|
|
data_source: data_sources/cloud/event_sources/O365_UserLoginFailed.yml
|
|
fields:
|
|
- _time
|
|
- AppAccessContext.IssuedAtTime
|
|
- AppAccessContext.UniqueTokenId
|
|
- AppId
|
|
- ClientAppId
|
|
- ClientIP
|
|
- CreationTime
|
|
- ExternalAccess
|
|
- Id
|
|
- Name
|
|
- ObjectId
|
|
- Operation
|
|
- OrganizationId
|
|
- OrganizationName
|
|
- OriginatingServer
|
|
- Parameters{}.Name
|
|
- Parameters{}.Value
|
|
- RecordType
|
|
- RequestId
|
|
- ResultStatus
|
|
- Role
|
|
- SessionId
|
|
- User
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- app
|
|
- authentication_service
|
|
- command
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- punct
|
|
- record_type
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- status
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId":
|
|
"g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a",
|
|
"Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08",
|
|
"RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType":
|
|
2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId":
|
|
"splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com",
|
|
"AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess":
|
|
false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer":
|
|
"BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"},
|
|
{"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}],
|
|
"RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"}'
|