Coletar registros do Microsoft 365
Neste documento, descrevemos como coletar registros do Microsoft 365 configurando um feed do Chronicle e como os campos de registro são mapeados para os campos do Chronicle Unified Data Model (UDM). Este documento também lista as atividades auditadas compatíveis e a versão compatível do Microsoft 365.
Para ter uma visão geral sobre a ingestão de dados no Chronicle, consulte Ingestão de dados no Chronicle.
Informações gerais
O diagrama da arquitetura de implantação a seguir mostra como o feed do Microsoft 365 e do Chronicle é configurado para enviar registros ao Chronicle. Cada implantação de cliente pode ser diferente dessa representação e pode ser mais complexa.
O diagrama da arquitetura mostra os seguintes componentes:
Microsoft 365: O serviço do Microsoft 365 de que você coleta registros.
Feed do Chronicle. O feed do Chronicle que busca registros do Microsoft 365 e os grava no Chronicle.
Chronicle (em inglês). O Chronicle retém e analisa os registros do Microsoft 365.
Um rótulo de ingestão identifica o analisador que normaliza os dados de registro brutos
para o formato UDM estruturado. As informações neste documento se aplicam ao analisador
com o rótulo de ingestão OFFICE_365.
Antes de começar
Use o Microsoft 365 versão 2204 Build 16.0.15128.20248 ou mais recente e verifique se você tem uma assinatura do Microsoft 365 Enterprise E5 com o recurso Central de Segurança e Compliance da Microsoft.
Conceda os privilégios e as permissões necessários ao usuário para gerar e exportar diferentes eventos para todos os produtos da Microsoft com suporte. Veja um exemplo de permissão em Permissões para acessar APIs de gerenciamento.
Configure o Microsoft 365 para pesquisar e exportar registros. O Microsoft Azure Active Directory (Azure AD) é o serviço de diretório do Microsoft 365. Leva até 24 horas para gerar os registros. Veja mais informações em Pesquisar no registro de auditoria.
Verifique se todos os sistemas na arquitetura de implantação estão configurados no fuso horário UTC.
Revise as atividades e os produtos compatíveis com o analisador do Chronicle. A tabela a seguir lista as atividades e os produtos compatíveis com o analisador do Chronicle:
Atividades Produtos Atividades de arquivos e páginas Outlook Online e OneDrive for Business Atividades da pasta Outlook Online e OneDrive for Business Atividades de lista do Outlook SharePoint Online Atividades de solicitação de compartilhamento e acesso Outlook Online e OneDrive for Business Atividades de sincronização Outlook Online e OneDrive for Business Atividades de permissões do site SharePoint Online Atividades de administração de sites SharePoint Online Atividades da caixa de e-mails do Exchange Caixas de e-mails do grupo do Microsoft 365 Atividades de administração de usuários Central de administração do Microsoft 365 Atividades de administração do grupo do Azure AD Central de administração do Microsoft 365 Atividades de administração de aplicativos Quando um administrador adiciona ou altera um aplicativo registrado no Azure AD Atividades de administração de papéis Central de administração do Microsoft 365 Atividades de administração de diretório Central de administração do Microsoft 365 Atividades do Power BI Power BI Atividades do Microsoft Teams Microsoft Teams Atividades do Microsoft Teams Shifts Muda o app no Microsoft Teams Atividades do Microsoft Teams para o setor de saúde Aplicação de pacientes no Microsoft Teams Atividades do Microsoft Teams Shifts Muda o app no Microsoft Teams Atividades do Yammer Yammer Atividades do Microsoft Power Automate Power Automate (antigo Microsoft Flow) Atividades do Microsoft PowerApps Apps avançados Atividades do Microsoft Stream Microsoft Stream Atividades de quarentena Colocar mensagens de e-mail em quarentena no Office 365 Atividades do Formulários Microsoft Microsoft Teams Atividades do marcador de sensibilidade Como rotular atividades para o Outlook Online e o Teams Atividades de etiqueta de retenção e política de retenção Não relevante Atividades de resumo por e-mail E-mail de resumo Atividades do MyAnalytics MyAnalytics Atividades de barreiras de informação Não relevante Atividades de revisão de disposição Não relevante Atividades de compliance da comunicação Não relevante Atividade indefinida Não relevante
Configurar um feed no Chronicle para processar registros do Microsoft 365
- Acesse as configurações do Chronicle e clique em Feeds.
- Clique em Add New.
- Selecione API de terceiros em Tipo de origem.
- Selecione Office 365 em Tipo de registro.
- Clique em Próxima.
- Com base na configuração do Microsoft 365, especifique os detalhes do ID do cliente OAuth, da Chave secreta do cliente OAuth e do ID do locatário.
- Selecione o Tipo de conteúdo para que você está criando o feed. É necessário criar um feed separado para cada tipo de conteúdo necessário.
- Clique em Próxima e em Enviar.
Para ver mais informações, consulte a documentação sobre feeds do Chronicle.
Referência de mapeamento de campo
Esta seção explica como o analisador do Chronicle mapeia campos de registro do Microsoft 365 para os campos do Chronicle Unified Data Model (UDM) das operações e cargas de trabalho com suporte.
Campos comuns
A tabela a seguir lista os campos de registro comuns e os campos do UDM correspondentes.
| Common log field | UDM field |
|---|---|
| ID | metadata.product_log_id |
| RecordType | security_result.detection_fields.key/value security_result.detection_fields.key is set to {RecordeType} - RecordTypeNameFromDoc security_result.detection_fields.value is set to RecordTypeDescriptionFromDoc |
| CreationTime | metadata.event_timestamp |
| Operation | metadata.product_event_type |
| OrganizationId | principal.resource.product_object_id |
| UserType | principal.user.attribute.roles.name |
| UserId | principal.user.email_addresses or principal.user.userid target.user.email_addresses or target.user.userid If is Operation is UserLoggedIn, UserLoginFailed, Add OAuth2PermissionGrant, TeamsUserSignedOut, or Add delegated permission grant then UserId is mapped to target.user else UserId is mapped to principal.user If UserId value contains email address then it is mapped to email_address, else it is mapped to userid. |
| ClientIP | principal.ip and principal.port |
| Workload | target.application |
| AppAccessContext | network.session.id security_result.detection_fields.key/value AADSessionId is mapped to network.session.id CorrelationId is mapped to security_result.detection_fields.key/value |
Para informações de referência sobre os mapeamentos de UDM para operações compatíveis, consulte as seguintes seções:
Arquivo acessado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Fileaccessed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileAccessedExtended
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileAccessedExtended" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo excluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileDeleted" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo copiado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Fileencoded" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_COPY
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | src.file.full_path
target.file.full_path Extract SourceFileUrl is mapped to src_file_full_path TargetFileUrl is mapped to target_file_full_path |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo modificado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileModified" e carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MODIFICATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
Arquivo transferido por download
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileDownload" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| UserSessionId | network.http.session_id |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ZipFileName | principal.resource.parent |
FileModifiedExtended
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileModifiedExtended" e pela carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MODIFICATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
Arquivo movido
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileDriven" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo visualizado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FilePreviewed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo renomeado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileRenamed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
Arquivo enviado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileUpload" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ImplicitShare | target.resource.attribute.labels.key/value |
FileVersionsAllDeleted
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileVersionsAllDeleted" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
Check-in de arquivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileCheckedIn" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | workload map with intermediary.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Check-out do arquivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileCheckedOut" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | Uniquely Identify resource in site like File or Folder |
| ItemType | This field contain values like File, Folder, Web, Site, Tenant, and DocumentLibrary |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | Information about the user's browser. This information is provided by the browser. |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | We can not map it with target.file.full_path because of SiteUrl field not contains value related to system path |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ComplianceSettingChanged
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ComplianceSettingChanged" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| SharingType | target.labels.key/value |
Bloquear registro
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "LockRecord" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Desbloquear registro
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UnlockRecord" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileDeletedFirstStageRecycleBin
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileDeletedFirstStageRecycleBin" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SharingType | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileDeletedSecondStageRecycleBin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileDeletedSecondStageRecycleBin" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Exclusão de registro
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "RecordDelete" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
SensibilidadeMismatchDetected
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DocumentSensitivityMismatchDetected" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
SensibilidadeMismatchDetected
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DocumentSensitivityMismatchDetected" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileCheckOut descartado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileCheckOutDismissed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionsAllMinorsReciclado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileVersionsAllMinorsRecycled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionsAllRecycled
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileVersionsAllRecycled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionRecycled
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileVersionRecycled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Arquivo restaurado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileRestored" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SharingType | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileMalwareDetected
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileMalwareDetected" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| VirusInfo | security_result.threat_name |
| VirusVendor | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Consulta de pesquisa realizada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchQueryPerformed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| EventData | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Visualizações de página
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PageViewed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Página pré-buscada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PagePrefetched" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ClientViewSignaled
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ClientViewSignaled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url NOTE: Because ClientViewSignaled events are signaled by the client, rather than the server, it's possible the event may not be logged by the server and therefore may not appear in the audit log. It's also possible that information in the audit record may not be trustworthy. However, because the user's identity is validated by the token used to create the signal, the user's identity listed in the corresponding audit record is accurate. |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
Visualizações de página estendidas
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PageViewedExtended" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
PastaCreated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
PastaExcluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderDeleted" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Pasta movida
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FolderMoed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName}
SourceRelativeUrl field not getting in log |
| DestinationRelativeUrl | DestinationRelativeUrl field not getting in log
target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | DestinationFileName field not getting in log
target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | src.file.full_path
target.file.full_path Extract SourceFileUrl is mapped to src_file_full_path TargetFileUrl is mapped to target_file_full_path grok is mapped to {SourceFileUrl}{src_file_full_path}{/SourceFileUrl}{TargetFileUrl}{target_file_full_path}{/TargetFileUrl} |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Pasta renomeada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderRenamed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
PastaModificada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderModified" e da carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Pasta copiada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Foldercopie" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_COPY
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path |
| SourceRelativeUrl | src.file.full_path |
| DestinationRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| DestinationFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Pasta restaurada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderRestored" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderDeletedFirstStageRecycleBin
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderDeletedFirstStageRecycleBin" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderDeletedSecondStageRecycleBin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FolderDeletedSecondStageRecycleBin" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncDownloadFull
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileSyncUninstallFull" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | src.file.size |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Sincronização de arquivos transferida por download parcial
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileSyncDownloadPartial" e carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | src.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | src.file.size |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncUploadFull
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileSyncUploadFull" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | target.file.size |
| ImplicitShare | target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Sincronização de arquivos enviadas Parcial
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileSyncUpdatedPartial" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | target.file.size |
| ImplicitShare | target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ManagedSyncClientAllowed
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ManagedSyncClientAllowed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_WRITTEN | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Não gerenciadoSyncClientBloqueado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UnmanagedSyncClientUpdated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Adicionado ao Grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddToGroup" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | target.group.group_display_name |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
Adicionado em um grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GroupAdicionada" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
GroupRemoved
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "GroupRemoved" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
WebRequestAccessModified
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "WebRequestAccessModified" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | if Name is RequestAccessEmail then NewValue is mapped to target.user.email_addresses or target.user.userid else target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
WebMembersCanShareModified
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "WebMembersCanShareModified" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| version | metadata.product_version |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
PermissionLevelModified
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PermissionLevelModified" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.resource.attribute.permissions.name
BasePermissions is mapped to target.resource.attribute.permissions.name |
| version | metadata.product_version |
| WebID | about.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SiteCollectionAdminAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SiteCollectionAdminAdicionado" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ModifiedProperties | If Name is set SiteAdmin then NewValue is mapped to target.user.userid or target.user.email_addresses |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SiteCollectionAdminRemoved
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SiteCollectionAdminRemoved" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ModifiedProperties | If Name is set SiteAdmin then NewValue is mapped to target.user.userid or target.user.email_addresses |
| AssertingApplicationId | about.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
PermissionLevelRemoved
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PermissionLevelRemoved" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.permissions.name |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
Removido do Grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RemovedFromGroup" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.group.group_display_name |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
Atualizado em grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "GroupUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.referral_url |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
Check-out do projeto
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ProjectCheckedOut" e a carga de trabalho "Projeto":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
Acesso ao projeto
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ProjectAccessed" e a carga de trabalho "Project":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT |
|
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
ShareInheritanceBroken
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "sharingInheritanceBroken" e da carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
AdicionadoToSecureLink
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddToSecureLink" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| UniqueSharingId | target.labels.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ApplicationDisplayName | target.application |
CompanyLinkCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CompanyLinkCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| ApplicationDisplayName | target.application |
Link da empresa usado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CompanyLinkUsed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
SecureLinkCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SecureLinkCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
Convite criado para compartilhamento
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ShareInvitationCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Sharing level is mapped to target.resource.attribute.labels.key/value ExpirationDate is mapped totarget.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkDeleted
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SecureLinkDeleted" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
Removido doSecureLink
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RemovedFromSecureLink" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
Convite de compartilhamento revogado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "sharingInvitationRevogard" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SecureLinkUpdated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkUsed
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SecureLinkUsed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
Compartilhamento revogado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "sharingRevogard" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
Conjunto de compartilhamento
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "sharingSet" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
PermissionLevelAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PermissionLevelAllowed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.permissions.name
BasePermissions is mapped to target.resource.attribute.permissions.name |
Convite de Compartilhamento aceito
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SharedInvitationAccepted" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.name
Added to Group is mapped to target.resource.name |
Convite de compartilhamento bloqueado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SharedInvitationInvite" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | security_result.summary
Reason is mapped to security_result.summary |
AccessRequestCreated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "AccessRequestCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | target.resource.attribute.labels.key/value
Sharing level is mapped to target.resource.attribute.labels.key/value ExpirationDate is mapped totarget.resource.attribute.labels.key/value |
AnônimoLinkCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "anonymousLinkCreated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
AccessRequestUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "AccessRequestUpdated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| ModifiedProperties | target.labels.key/value |
CompanyLinkRemoved
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CompanyLinkRemoved" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETIONObjectId is mapped to target.url | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
AccessRequestAprovado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AccessRequestAprovado" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| EventData | target.resource.name
Extract using grok grok { match is mapped to { EventData <Added to group>{target_resource_name}.* } } |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
AnônimoLinkRemoved
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "anonymousLinkRemoved" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| MachineId | target.asset.product_object_id |
AnônimoLink atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AnônimoLinkUpdated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ApplicationDisplayName | target.application |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
Convite de Compartilhamento atualizado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "sharingInvitationUpdated" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| event_type is mapped to USER_RESOURCE_ACCESS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
Link anônimo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "anonymousLinkUsed" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ResultStatus is Success Action is set to ALLOW security_result.summary is set to Group creation successful ResultStatus is Failure Action is set to BLOCK security_result.summary is set to Group creation failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is set to additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is set to extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.group.group_display_name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.group.group_display_name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group membership updated successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is set toGroup membership update failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product.object_id
target.group.group_display_name Group.ObjectId is mapped to target.group.product.object_id Group.DisplayName is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar membro ao grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar membro ao grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_CREATION
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if
else map |
| ModifiedProperties | security_result.summary
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Adicionar usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Add user e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
Alterar licença de usuário.
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Alterar licença de usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is Action Client Name then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Alterar senha de usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Alterar senha do usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group deletion successful ResultStatus is Failure then Action is set to BLOCK security_result.summary is set to Group deletion failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.group.group_display_name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.group.group_display_name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Excluir grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Excluir grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group membership updated successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is set to Group membership update failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product.object_id
target.group.group_display_name Group.ObjectId is mapped to target.group.product.object_id Group.DisplayName is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Remover participante do grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remover membro do grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION
if status is Success then action ALLOW security_result.summary User deleted successfully |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is Action Client Name then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Excluir usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Delete user e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Atualizar usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Update user e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GROUP_MODIFICATION
if |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
ModifiedProperties
|
security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.group.group_display_name
If
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Atualizar grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Grupo de atualização" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
If ResultStatus is Succeeded or ResultStatus is Success security_result.action is ALLOW security_result.summary is User login successful else if ResultStatus is Failed or LogonError !is security_result.action is BLOCK security_result.summary is User login failed security_result.description is {LogonError} UserId is mapped to target.user.userid or target.user.email_addresses metadata.description is User Login - {Workload} |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
extensions.auth.type extensions.auth.mechanism |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
| DeviceProperties | network.session_id
principal.platform principal.hostname If Name is OS { If Value is match to Windows then principal.platform is WINDOWS If Value is match to Mac then principal_plateform is MAC if Value is match to Linux then principal_plateform is LINUX } If Name is SessionId then Value is mapped to network.session_id If Name is OS then Value is mapped to principal.platform If Name is DisplayName then Value is mapped to principal.hostname |
| ErrorCode | security_result.description
security_result.description is set to ErrorCode - {ErrorCode} |
| LogonError | security_result.description |
Login do usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UserLoggedIn" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
security_result.Action is set to BLOCK security_result.summary is User login failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
extensions.auth.type extensions.auth.mechanism If Name is RequestType and Value is match to Saml.* or OAuth2.* then extensions.auth.type is mapped to MACHINE If Name is RequestType and Value is match to Login.* then extensions.auth.type is mapped to REMOTE_INTERACTIVE If Name is UserAgent then Value is mapped to network.http.user_agent If Name is UserAuthenticationMethod then Based on Value it will map with extensions.auth.type If Name is requestType then Based on Value it will map with extensions.auth.type |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
| DeviceProperties | network.session_id
principal.platform principal.hostname If Name is OS { If Value is matched to Windows then principal.platform is WINDOWS If Value is matched to Mac then principal_plateform is MAC if Value is matched to Linux then principal_plateform is LINUX } If Name is SessionId then Value is mapped to network.session_id If Name is OS then Value is mapped to principal.platform If Name is DisplayName then Value is mapped to principal.hostname |
| ErrorCode | security_result.description
security_result.description is set to ErrorCode - {ErrorCode} |
| LogonError | security_result.description
If LogonError is UserAccountNotFound then extensions.auth.mechanism is set to USERNAME_PASSWORD |
Falha no login do usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UserLoginFailed" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Atualizar o carimbo de data/hora StsRefreshTokenValidFrom
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Atualizar StsRefreshTokenValidFrom Timestamp" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summary If DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name is DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Atualizar dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Atualizar dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING Required fields for SETTING_MODIFICATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Definir configurações de federação no domínio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Definir configurações de federação no domínio" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZEDRequired fields for STATUS_UNCATEGORIZED UDM validation : principal.machineid (IP or hostname or assetId or mac etc).
ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Verificar domínio
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Verificar domínio" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Definir informações da empresa
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Definir informações da empresa" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Redefinir senha do usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Redefinir senha do usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.description
security_result.summary target.labels.key/value If Name is AccountEnabled then security_result.description is set to AccountEnabled - {NewValue} If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Desativar conta
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Desativar conta" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/valueIf Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Excluir senha de app do usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Excluir senha do aplicativo para o usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name =DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Excluir dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Excluir dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent If Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name =DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar usuários registrados ao dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar usuários registrados ao dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.nameIf Name is Device.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Device.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar proprietário registrado ao dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar proprietário registrado ao dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name If Name is Device.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Device.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar proprietário ao grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar proprietário ao grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product_object_id
target.group.group_display_nameIf Name is Group.ObjectId then NewValue is mapped to target.group.product_object_id If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar OAuth2Permissiongrant
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar OAuth2Permissiongrant" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summaryIf Name is ServicePrincipal.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is ServicePrincipal.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name is DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar concessão de atribuição de função de app ao usuário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar concessão de atribuição de função de app ao usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSION
Workload is mapped to intermediary.application |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.application
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetName then Value is mapped to target.application If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.user.userid or target.user.email_addresses
If Name is User.UPN then NewValue is mapped to target.user.userid or target.user.email_addresses |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Consentimento para inscrição
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Consentimento para a aplicação" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Atualizar principal de serviço
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Atualizar principal do serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.nameIf Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar principal de serviço
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar principal do serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Remover principal de serviço
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remover principal do serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.nameIf Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Adicionar membro à função
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Add member to role e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | target.resource.product_object_id
if
If
if |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Remover membro da função
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remover membro do papel" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ResultStatus is Success then Action is set to ALLOW security_result.summary is Removed a user to an admin role successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is Removed a user to an admin role failed |
|
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.user.attribute.roles.name if Name is Role.ObjectId then NewValue is target.resource.product_object_id If Name is Role.DisplayName then NewValue is target.user.attribute.roles.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value if Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Adicionar rótulo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar rótulo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is set to target.resource.product_object_id |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Criar a empresa
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Criar empresa" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
ObjectId is set to target.resource.product_object_id |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.labels.key/value |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
TeamsSessionStarted
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TeamsSessionStarted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleGroupAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ScheduleGroupUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_MODIFICATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleGroupEdited
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ScheduleGroupEdited" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_DELETION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ProgramGroupDeleted
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ScheduleGroupDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING Required fields for SETTING_CREATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
ShiftAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ShiftUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
Editado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ShiftEdited" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
ShiftExcluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ShiftDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
TimeOffAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "TimeOffUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
Hora da edição
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TimeOffEdited" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
TimeOffDeleted
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "TimeOffDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "OpenShiftUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftEdited
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "OpenShiftEdited" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftExcluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "OpenShiftDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
Cronograma compartilhado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ScheduleShared" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
Entrada em relógio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ClockedIn" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
Início
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "BreakStarted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
Fim do intervalo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "BreakEnded" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.labels.key/value |
SolicitaçãoAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "RequestAllowed" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.label.key/value |
SolicitaçãoRespondida para
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RequestRespondedTo" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.label.key/value |
Solicitação cancelada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Requestmissão" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleSettingChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ScheduleSettingChanged" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
TeamSettingChanged
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TeamSettingChanged" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
Aplicativo instalado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AppApenas" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| AddOnName | target.resource.name |
| Version | metadata.product_version |
| AppDistributionMode | about.labels.key/value |
| AzureADAppId | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TargetUserId | target.user.product_object_id |
Participante removido
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MemberRemoved" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
Guia removida
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TabRemoved" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| AddOnName | target.resource.name |
| ChannelName | target.resource.attribute.labels.key/value |
| TeamName | target.group.group_display_name |
App desinstalado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "AppUninstalled" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| AddOnName | target.resource.name |
| Version | metadata.product_version |
| AppDistributionMode | about.labels.key/value |
| AzureADAppId | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TargetUserId | target.user.product_object_id |
Membros adicionados
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "MemberAdicionada" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| CommunicationType | about.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
Adicionou
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "TabUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| AddOnName | target.resource.name |
| AddOnUrl | target.url |
| ChannelName | target.labels.key/value |
| TeamName | target.group.group_display_name |
Desligado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ClockedOut" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ScheduleId | target.resource.product_object_id |
Equipe criada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TeamCreated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.resource.product_object_id |
| TeamName | target.resource.name |
| Version | metadata.product_version |
BotAdicionado à Equipe
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "BotAdicionadoToTeam" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnName | target.resource.name |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Canal adicionado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ChannelAdded" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Conector adicionado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ConnectorAdicionado" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ChannelSettingChanged
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ChannelSettingChanged" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
TeamsTenantSettingChanged
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TeamsTenantSettingChanged" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
MemberRoleChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MemberRoleChanged" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name DisplayName is mapped to about.user.user_display_name Role is mapped to about.user.attribute.roles.name UPN is mapped to about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
DeletedAllOrganizationApps
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DeletedAllOrganizationApps" e carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Canal excluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ChannelDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Equipe excluída
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "TeamDeleted" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.resource.product_object_id |
| TeamName | target.resource.name |
BotRemovedFromTeam
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "BotRemovedFromTeam" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ConnectorRemove
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ConnectorRemoved" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Conector atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ConnectorUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
Guia atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "TabUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.resource.name |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.resource.attribute.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| AADGroupId | target.labels.key/value |
| AddOnUrl | target.url |
Atualizar
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Atualizar" e a carga de trabalho "Troca":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism
LogonType is 2 then mechanism is set to INTERACTIVE LogonType is 3 or 8 then mechanism is set to NETWORK LogonType is 4 then mechanism is set to BATCH LogonType is 5 then mechanism is set to SERVICE LogonType is 7 then mechanism is set to UNLOCK LogonType is 9 then mechanism is set to NEW_CREDENTIALS LogonType is 9 then mechanism is set to REMOTE_INTERACTIVE LogonType is 9 then mechanism is set to CACHED_INTERACTIVE else mechanism is set to MECHANISM_UNSPECIFIED |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Item | network.email.subject
target.resource.product_object_id target.resource.name target.file.size network.email.mail_id target.file.full_path Id is mapped to target.resource.product_object_id Subject is mapped to network.email.subject SizeInBytes is mapped to target.file.size Item.ParentFolder.Path is mapped to target.resource.name InternetMessageId is mapped to network.email.mail_id Attachments is mapped to target.file.full_path |
| ModifiedProperties | securiy_result.summary |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
Vinculação de pastas
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderBind" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientRequestId | principal.labels.key/value |
| Item | target.resource.product_object_id
target_resource_name network.email.mail_id Item.id is mapped to target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.ParentFolder.Path is mapped to target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
Enviar em nome
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SendOnBehalf" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id Item.InternetMessageId is mapped to network.email.email_id Item.Subject is mapped to network.email.subject Item.Attachments is mapped to target.file.full_path Item.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| SendOnBehalfOfUserSmtp | target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
Enviar como
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SendAs" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SendAsUserMailboxGuid | about.labels.key/value |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.Subject is mapped to network.email.subject Item.Attachments is mapped to target.file.full_path Item.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| SendAsUserSmtp | target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
Enviar
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Enviar" e a carga de trabalho "Trocar":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id |
| SessionId | network.session_id |
| Version | metadata.product_version |
Nova-Caixa de Entrada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-InboxRule" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING ObjectId is set to target.group.product_object_id |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SessionId | network.session_id |
| Version | metadata.product_version |
| Parameters | security_result.rule_labels.key/value |
| AppId | target.labels.key/value |
Definir-Caixa de Entrada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Set-InboxRule" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
ObjectId is set to target.group.product_object_id target.resource.resource_type is set to SETTING |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | security_result.rule_labels.key/value |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
MoveToDeletedItems
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MoveToDeletedItems" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| DestFolder | target.resource.product_object_id
target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id Subject is mapped to network.email.subject ParentFolder.Path is mapped to about.file.full_path AffectedItems.0.InternetMessageIdis mapped to network.email.mail_id |
| Folder | src.resource.product_object_id
src.resource.name |
| ClientRequestId | principal.labels.key/value |
| AppId | target.labels.key/value |
Mover
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Mover" e a carga de trabalho "Trocar":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| DestFolder | target.resource.product_object_id
target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id |
| Folder | src.resource.product_object_id
src.resource.name |
MailItemsAccessed
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MailItemsAccessed" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| OperationProperties | security_result.detection_fields.key/value. |
| SessionId | network.session_id |
| Version | metadata.product_version |
| OperationCount | about.labels.key/value |
| AppId | target.labels.key/value |
| Folders | about.resource.name
about.resource.product_object_id network.email.mail_id Folders.Path is mapped to about.resource.name Folders.Id is mapped to about.resource.product_object_id Folders.0.FolderItems.0.InternetMessageId network_email_id |
Login na caixa de e-mails
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MailboxLogin" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
auth.Type is MACHINE |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SessionId | network.session_id |
| Version | metadata.product_version |
Fazer a exclusão reversível
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SoftDelete" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id AffectedItems.Attachments is mapped to about.file.full_path AffectedItems.Subject is mapped to network.email.subject AffectedItems.0.InternetMessageIdis mapped to network.email.mail_id |
| Folder | target.resource.name
target.resource.product_object_id Folder.Path is mapped to target.resource.name Folder.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
Exclusão irreversível
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "HardDelete" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id |
| Version | metadata.product_version |
| ClientAppId | target.labels.key/value |
| AppId | target.labels.key/value |
| Folder | target.resource.name
target.resource.product_object_id |
Criar
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Criar" e a carga de trabalho "Troca":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.resource.name
target.resource.product_object_id target.file.full_path network.email.subject network.email.mail_id Item.id is mapped to target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.ParentFolder.Path is mapped to target.resource.name Item.Subject is mapped to network.email.subject Attachment may present or not in log so write grok for this. Item.Attachments is mapped to target.file.full_path |
| SessionId | network.session_id |
| Version | metadata.product_version |
RemoveFolderPermissions
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "RemoveFolderPermissions" e da carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.resource.attribute.permissions.name target.user.email_addresses or target.user.userid Item.ParentFolder.MemberUpn is mapped to target.user.email_addresses or target.user.userid Item.ParentFolder.Path is mapped to target.file.full_path User rights is mapped to target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
ModificarPastaPermissions
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ModifyFolderPermissions" e da carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.user.email_addresses or target.user.userid target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
AddFolderPermissions
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddFolderPermissions" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.user.email_addresses or target.user.userid target.resource.attribute.permissions.name Path is mapped to target.file.full_path Item.ParentFolder.MemberUpn is mapped to target.user.email_addresses or target.user.userid User Rights is mapped to target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
Remove-MailboxPermission
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-MailboxPermission" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Add-MailboxPermission
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Add-MailboxPermission" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AppId | target.resource.attribute.labels.key/value |
| Parameters | security_result.detection_fields.key/value |
| ObjectId | target.resource.attribute.labels.key/value |
UpdateInboxRules
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateInboxRules" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
| Item | target.resource.product_object_id
target.resource.name Item.ParentFolder.name is mapped to target.resource.name Item.ParentFolder.id is mapped to target.resource.product_object_id |
| OperationProperties | security_result.rule_id
security_result.rule_name security_result.detection_fields.key/value if Name is RuleId then Value is mapped to security_result.rule_id if Name is RuleName then Value is mapped to security_result.rule_name else security_result.detection_fields.key/value |
| ClientRequestId | principal.labels.key/value |
AtualizarDelegaçãodaAgenda
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateCalendarDelegation" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is SERVICE_ACCOUNT |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
ApplyRecordLabel
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ApplyRecordLabel" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
UpdateFolderPermissions
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateFolderPermissions" e da carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to STORAGE_OBJECT |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
Usuário que define
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-User" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION
ObjectId is set to target.user.userid or target.user.email_addresses |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| Version | metadata.product_version |
Ver relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ViewReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is mapped to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| ConsumptionMethod | target.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| DistributionMethod | about.labels.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.attribute.labels.key/value |
GerarEmbedToken
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GenerateEmbedToken" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| ConsumptionMethod | target.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| DistributionMethod | about.labels.key/value |
| ReportId | target.resource.attribute.labels.key/value |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| EmbedTokenId | target.resource.product_object_id |
| RLSIdentities | about.user.email_addresses
about.user.attribute.roles.name RLSIdentities.UserName is mapped to about.user.email_addresses RLSIdentities.Roles is mapped to about.user.attribute.roles.name |
CreateDataset
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CreateDataset" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
GerarCustomVisualAADAccessToken
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "GenerateCustomVisualAADAccessToken" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| CustomVisualAccessTokenResourceId | target.resource.product_object_id |
| CustomVisualAccessTokenSiteUri | target.url |
ExcluirItemdaGaleriaOrgano
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteOrganizationGalleryItem" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
DeleteAlmPipeline
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteAlmPipeline" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
AddDatasourceToGateway
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddDatasourceToGateway" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| GatewayId | target.resource.attribute.labels.key/value |
| GatewayType | target.labels.key/value |
| DatasourceId | target.resource.product_object_id |
| DatasourceType | target.resource.attribute.labels.key/value |
AtribuirParaPipeline
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AtribuirWorkspaceToPipeline" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | principal.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | principal.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| DeploymentPipelineStageOrder | target.labels.key/value |
CancelarDataflowRefresh
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CancelDataflowRefresh" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
Alterar capacidade
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Change EspaçoState" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CapacityName | target.resource.name |
| CapacityUsers | about.labels.key/value |
| CapacityState | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Administradores do ChangeGateway
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ChangeGatewayAdministrators" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.product_object_id |
| UserInformation | about.user.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
InserirItemGaleriaOrganizacional
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "InsertOrganizationGalleryItem" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
CreateAlmPipeline
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateAlmPipeline" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
CreateApp
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Criar painel
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
If IsSuccess is true then security_result.summary is Dashboard created successfully else security_result.summary is Dashboard not created |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
Criar Dataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_CREATION
If IsSuccess is true then security_result.summary is Dataflow created successfully else security_result.summary is Dataflow not created |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DataflowType | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
CreateEmailSubscription
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateEmailSubscription" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
If IsSuccess is true then security_result.summary is EmailSubscription created successfully else security_result.summary is EmailSubscription not created ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| SubscriptionSchedule | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| SubscribeeInformation | network.email.to |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
CriarPasta
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateFolder" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| FolderDisplayName | target.resource.name |
| FolderObjectId | target.resource.attribute.labels.key/value |
CreateGateway
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateGateway" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| GatewayId | target.resource.product_object_id |
| GatewayType | target.labels.key/value |
CreateTemplateApp
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateTemplateApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
Excluir comentário
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteComment" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| AuditedArtifactInformation | target.resource.name
target.resource.product_object_id target.resource.attribute.labels.key/value Name is mapped to target.resource.name ArtifactObjectId is set to target.resource.product_object_id AnnotatedItemType is mapped to target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
ExcluirPainel
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| DashboardName | target.resource.name |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| DistributionMethod | about.labels.key/value |
DeleteDataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
DeleteDataset
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DeleteDataset" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
Excluir assinatura de e-mail
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteEmailSubscription" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_DELETION
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
ExcluirPasta
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteFolder" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
if isSuccess is TRUE then security_result.action is set to ALLOW else security_result.action is set to BLOCK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
ExcluirGateway
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DeleteGateway" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
ExcluirGrupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteGroup" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.nameRecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Excluir relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
Fazer download do relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DownloadReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
EditarConjunto de dados
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "EditDataset" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
EditDatasetProperties
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "EditDatasetProperties" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetCertificationStage | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
Editar relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "EditReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.attribute.labels.key/value |
| ReportType | target.resource.attribute.labels.key/value |
ExportDataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ExportDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
if isSuccess is TRUE then security_result.summary is Dataflow Exported Successfully else security_result.summary is Dataflow Not Exported |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| DataflowName | target.rsource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Relatório de exportação
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ExportReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
if isSuccess is TRUE then security_result.summary is Report Exported Successfully else security_result.summary is Report Not Exported |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
App Instalar
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "InstallApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
AppTemplateApp
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "InstallTemplateApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppFolderObjectId | about.labels.key/value |
| TemplateAppOwnerTenantObjectId | principal.user.product_object_id |
| TemplateAppVersion | metadata.product_version |
| TemplateAppObjectId | target.resource.product_object_id |
| TemplatePackageName | target.resource.name |
Postar comentário
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PostComment" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| AuditedArtifactInformation | target.resource.name
target.resource.product_object_id target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Painel de impressão
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PrintDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZEDObjectId is set to target.file.full_path | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
Relatório de impressão
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PrintReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
Remover atribuição do espaço de trabalho do pipeline
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UnassignWorkspaceFromPipeline" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| DeploymentPipelineId | target.resource.attribute.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
RemoverFontedeDadosDeGateway
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RemoveDatasourceFromGateway" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.attribute.label.key/value |
| DatasourceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Renomear painel
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RenameDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
RequestDataflowRefresh
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RequestDataflowRefresh" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowRefreshScheduleType | target.labels.key/value |
| DataflowType | target.resource.attribute.label.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
RefreshDataset
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "RefreshDataset" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RefreshType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
SensitivityLabelApplied
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SensitivityLabelApplied" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATIONtarget.resource.resource_type is set to SETTING | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| SensitivityLabelId | target.resource.product_object_id |
| ActionSourceDetail | principal.labels.key/value |
| LabelEventType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActionSourceDetail | principal.labels.key/value |
| ArtifactType | about.labels.key/value |
SensitivityLabelRemoved
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SensitivityLabelRemoved" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OldSensitivityLabelId | target.resource.product_object_id |
| ActionSource | principal.labels.key is set to ActionSource
principal.labels.value is set to {Value} |
| LabelEventType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActionSourceDetail | principal.labels.key/value |
| ArtifactType | about.labels.key/value |
SetScheduledRefreshOnDataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SetScheduledRefreshOnDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.label.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
DefinirAgendarAtualização
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SetScheduledRefresh" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.rsource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| Schedules | target.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
Painel de controle
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ShareDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| SharingAction | about.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
Compartilhar Relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ShareReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| Datasets | about.resource.product_object_id
about.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| ArtifactId | target.resource.product_object_id |
| ArtifactName | target.resource.name |
| SharingAction | about.labels.key/value |
| ShareLinkId | about.labels.key/value |
Testes de ativação
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "OptInForProTrial" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Cancelar publicação do app
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UnpublishApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.product_object_id |
| WorkSpaceName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Atualizar item da galeria organizacional
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateOrganizationGalleryItem" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
UpdateAlmPipelineAccess
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateAlmPipelineAccess" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| DeploymentPipelineDisplayName | target.resource.name |
| DeploymentPipelineAccesses | about.user.userid
about.user.attribute.permissions.name userid is mapped to about.user.userid Rolepermission is mapped to about.user.attribute.permissions.name |
UpdateInstaladoTemplateAppParameters
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateMonitorAppParameters" e a carga de trabalho "e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
| TemplatePackageName | target.resource.name |
| TemplateAppVersion | metadata.product_version |
| TemplateAppFolderObjectId | about.labels.key/value |
Atualização de AdminFeatureSwitch
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdatedAdminFeatureSwitch" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is mapped to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| SwitchState | about.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
App Update
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateApp" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
AtualizarDataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateDatasetParameters
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateDatasetParameters" e da carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
Atualizar inscrição de e-mail
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateEmailSubscription" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_MODIFICATION
target.resource.type is mapped to TASK |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| SubscriptionSchedule | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| SubscribeeInformation | network.email.to |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
AtualizarPasta
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateFolder" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| FolderDisplayName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Upgrade de pasta
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateFolderAccess" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| FolderDisplayName | target.resource.name |
| FolderAccessRequests | about.user.userid
about.user.product_object_id about.user.attribute.permissions.type UserId is mapped to about.user.userid UserObjectId is set to about.user.product_object_id RolePermissions is mapped to about.user.attribute.permissions.type |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateDatasourceCredentials
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateDatasourceCredentials" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.attribute.labels.key/value |
| DatasourceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateTemplateAppSettings
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateTemplateAppSettings" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| ActivityId | principal.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
UpdateTemplateAppTestPackagePermissions.
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateTemplateAppTestPackagePermissions" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
Painel de visualização
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ViewDashboard" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ConsumptionMethod | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
ViewDataflow
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ViewDataflow" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Adicionar Bloco
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddTile" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| TileText | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
RunEmailSubscription
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RunEmailSubscription" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.label.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.label.key/value |
| DashboardId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
Criar relatório
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.label.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.label.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
GetSnapshots
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GetSnapshots" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Ativar paraPPUAvaliação
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "OptInForPPUTrial" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Set-MailUser
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-MailUser" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Definir contato de e-mail
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-MailContact" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Definir caixa de correio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-Mailbox" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
Object is mapped to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Set-DistributeGroup
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-DistributeGroup" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is Group members definition ResultStatus is True Action is set to ALLOW else Action is set to BLOCK |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
security_result.description target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is AcceptMessagesOnlyFromSendersOrMembers then Value is mapped to security_result.description else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Definir contato
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-Contact" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Set-CASMailbox
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-CASMailbox" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| ModifiedObjectResolvedName | about.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Configurar-AgendaProcessamento
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Set-Calendar Processing" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.user_display_name
If Name is ResourceDelegates then Value is mapped to target.user.user_display_name |
| SessionId | network.session_id |
| Version | metadata.product_version |
Set-AdminAuditoriaLogConfig
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Set-AdminAuditoriaLogConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. ObjectId is mapped to target.url target.resource.resource_type is set to SETTING |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| ModifiedObjectResolvedName | about.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Remover GrupoUnificado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-UnifiedGroup" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| Version | metadata.product_version |
Remove-MigrationUser
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-MigrationUser" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION
ObjectId is set to target.user.userid or target.user.email_addresses |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Update-eDiscoveryCaseAdmin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Update-eDiscoveryCaseAdmin" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remover-DistributeGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-DistributeGroupMember" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
ViewedSearchExported
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ViewedSearchExported" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
AddWorkingSetQueryToWorkingSet
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddWorkingSetQueryToWorkingSet" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AddQueryToWorkingSet
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AddQueryToWorkingSet" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
RunAlgo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RunAlgo" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AnotarDocument
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "AnnotateDocument" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
BurnJob
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "BurnJob" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
CreateWorkingSet
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateWorkingSet" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
CreateWorkingsetSearch
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateWorkingsetSearch" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Criar tag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateTag" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
DeleteWorkingsetSearch
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteWorkingsetSearch" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Excluir tag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DeleteTag" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Fazer o download do documento
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DownloadDocument" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Atualizar tag
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateTag" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
ExportJob
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ExportJob" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
UpdateCaseSettings
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateCaseSettings" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AtualizarPesquisa de Trabalho
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdateWorkingsetSearch" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
TagFiles
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "TagFiles" e "Compliance" da carga de trabalho:
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
ViewDocument
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ViewDocument" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Visualização de pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchViewed" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
If Name is SearchIds then Value is mapped to target.resource.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
CasoMembroAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "CaseMember Login" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} Extract target_user information using grok grok { match is mapped to { Parameters .*-(Member|User) \{DATA:target_user}\ } } |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
Pesquisa atualizada
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
Gerenciador de casos atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "CaseAdminUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | about.user.email_address
about.user.product_object_id If Name is CaseAdminsSmtp then Value is mapped to about.user.email_addresses if Name is CaseAdminsGuid then Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
Caso atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "CaseUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_idIf Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Caso membro atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "CaseMemberUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resrource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
PermissãoPesquisaAtualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchPermissionUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Manter atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "HoldUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Pesquisa removida
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
CasoAdminRemoved
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CaseAdminRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
target.user.email_address target.user.userid If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} target_user is mapped to target.user.email_addresses or target.user.userid |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
CasoRemove
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CaseRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchPermissionRemoved
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchPermissionRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Retenção removida
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "HoldRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
A retenção foi criada
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "HoldCreated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchCreated
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchCreated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_detail |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
CasoAdminAdicionado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "CaseAdminUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.prdouct_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Pesquisa iniciada
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchStarted" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
Relatório de Pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchReport" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Pesquisa interrompida
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchStopped" e da carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
Visualização de casos
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CaseViewed" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_detail |
| ExtendedProperties | target.resource.product_object_id
about.user.email_addresses about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Nameis CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
Download de pesquisa exportado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchExportUpload" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
CasoMembroRemovido
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CaseMemberRemoved" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} Extract target_user information using grok grok { match is mapped to { Parameters .*-(Member|User) \{DATA:target_user}\ } } |
| Version | metadata.product_version |
Adicionado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CaseAdiciona" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_idIf Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
SearchPermissionCreated
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchPermissionCreated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
Configuração de rede atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "NetworkConfigurationUpdated" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
ProcessProfileFields
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ProcessProfileFields" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
SupervisorAdminAlterado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SupervisorAdminToggled" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Configuração de segurança de rede atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "NetworkSecurityConfigurationUpdated" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Arquivo criado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileCreated" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATIONIf ResultStatus is TRUE {
security_result.action is ALLOW} else {security_result.action is BLOCK} |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Criação de grupos
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GroupCreation" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Mensagem excluída
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MessageDeleted" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Exclusão de grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GroupDeletion" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Exportação de dados
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DataExport" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Arquivo visitado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileVisited" e carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_READ
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
InvocarVideoView
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamInvocVideoView" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
InvocarVideoShare
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "StreamInvocVideoShare" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
InvocarVideoLike
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoLike" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocarVideoUnLike
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoUnLike" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
InvocarVideoUpload
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoUpload" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvoctVideoDownload
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoDownload" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocVideoSetLink
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoSetLink" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateGroup
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamCreateGroup" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Grupo de edição de streams
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditGroup" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteGroup
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamDeleteGroup" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditGroupMemberships
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditGroupMemberships" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Canal de criação
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamCreateChannel" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Editar canal
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditChannel" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteChannel
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamDeleteChannel" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocChannelSetMiniatura
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocChannelSetMiniatura" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditVideoPermissions
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditVideoPermissions" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is Succeeded then action is ALLOW else action is BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Editar vídeo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditVideo" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamDeleteVideo" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditUserSettings
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditUserSettings" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditAdminTenantSettings
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamEditAdminTenantSettings" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateVideoComment
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamCreateVideoComment" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideoComment
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamDeleteVideoComment" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvoctVideoTextTrackUpload
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoTextTrackUpload" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideoTextTrack
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamDeleteVideoTextTrack" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvoctVideoMiniaturaUpload
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "StreamInvocVideoMiniaturaUpload" e carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is Succeeded then action is ALLOW else action is BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateVideo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamCreateVideo" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url_back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
DlpRuleMatch.
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação DlpRuleMatch e a carga de trabalho Exchange/SharePoint/OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to EMAIL_TRANSACTION
|
|
| SharePointMetaData | network.http.referral_url
|
| ExchangeMetaData | network.email.from
|
| ExceptionInfo | about.labels.key/value
|
| PolicyDetails | target.resource.product_object_id
|
| IncidentId | about.labels.key/value
|
| Version | metadata.product_version
|
| Site | target.labels.key/value
|
| ItemType | target.resource.attribute.labels.key/value
|
| EventSource | principal.application
|
| SourceName | principal.labels.key/value
|
| UserAgent | network.http.user_agent
|
| MachineDomainInfo | target.asset.attribute.labels.key/value
|
| MachineId | target.asset.product_object_id
|
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
DlpRuleDesfazer
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "DlpRuleUndo" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
security_result.category is set to DATA_EXFILTRATION ObjectId is set to network.email.mail_id |
|
| SharePointMetaData | network.http.referral_url
network.email.from target.file.full_path target.url target.file.size SiteCollectionUrl is mapped to network.http.referral_url From is mapped to network.email.from (if ExchangeMetadata field not getting in log) FileName is mapped to target.file.full_path FilePathUrl is mapped to target.url FileSize is mapped to target.file.size |
| ExceptionInfo | about.labels.key/value |
| PolicyDetails | target.resource.product_object_id
security_result.summary security_result.description security_result.rule_id security_result.rule_name security_result.severity PolicyId is mapped to target.resource.product_object_id PolicyName is mapped to security_result.summary SensitiveInformationTypeName is mapped to security_result.description RuleId is mapped to security_result.rule_id RuleName is mapped to security_result.rule_name Severity is mapped to security_result.severity |
| IncidentId | about.labels.key/value |
| Version | metadata.product_version |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
DlpInfo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DlpInfo" e carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
security_result.category is set to DATA_EXFILTRATION ObjectId is set to network.email.mail_id |
|
| SharePointMetaData | network.http.referral_url
network.email.from target.file.full_path target.url target.file.size SiteCollectionUrl is mapped to network.http.referral_url From is mapped to network.email.from (if ExchangeMetadata field not getting in log) FileName is mapped to target.file.full_path FilePathUrl is mapped to target.url FileSize is mapped to target.file.size |
| ExceptionInfo | about.labels.key/value |
| PolicyDetails | target.resource.product_object_id
security_result.summary security_result.description security_result.rule_id security_result.rule_name security_result.severity PolicyId is mapped to target.resource.product_object_id PolicyName is mapped to security_result.summary SensitiveInformationTypeName is mapped to security_result.description RuleId is mapped to security_result.rule_id RuleName is mapped to security_result.rule_name Severity is mapped to security_result.severity |
| IncidentId | about.labels.key/value |
| Version | metadata.product_version |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
Rótulo Mip
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MipLabel" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to network.email.mail_id |
|
| ApplicationMode | about.labels.key/value |
| ItemName | network.email.subject |
| LabelAppliedDateTime | principal.labels.key/value |
| LabelId | target.resource.product_object_id |
| LabelName | target.resource.name |
| Receivers | network.email.to |
| Sender | network.email.from |
| Version | metadata.product_version |
SiteCollectionCreated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteCollectionCreated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value |
| EventData | target.resource.name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| Version | metadata.product_version |
Site excluído
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteDeleted" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| MachineId | target.asset.product_object_id |
PreviewModeEnabledSet
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PreviewModeEnabledSet" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is mapped to SETTING |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
OfficeOnDemandSet
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "OfficeOnDemandSet" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteJoin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "HubSiteJoined" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
target.resource.attribute.labels.key/value PreviousHubSiteIdis mapped to target.resource.attribute.labels.key/value HubSiteIdis mapped to target.resource.attribute.labels.key/value IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteRegistered
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "HubSiteRegistered" e carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
target.resource.attribute.labels.key/value HubSiteIdis mapped to target.resource.attribute.labels.key/value IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSitedesativado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "HubSiteUnjoined" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectID is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteUnregistered
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "HubSiteUnregistered" e a carga de trabalho "HubSiteUnregistered":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectID is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SharePolicyChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SharedPolicyChanged" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| AssertingApplicationId | about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
NetworkAccessPolicyChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "NetworkAccessPolicyChanged" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.ip
target.labels.key/value if Name is IPAddressAllowList then NewValue is mapped to target.ip else target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
AlertEntityGenerated
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AlertEntityGenerated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Acionado por alerta
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AlertTriggered" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Alerta atualizado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AlertUpdated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Get-ComplianceCase
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-ComplianceCase" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-CaseHoldPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-CaseHoldPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-ComplianceSearch
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Remove-CaseHoldPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-CaseHoldPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Set-CaseHoldPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-CaseHoldPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
New-CaseHoldRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-CaseHoldRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Remove-CaseHoldRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-CaseHoldRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-CaseHoldRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-CaseHoldRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Get-ComplianceSearchAction
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-ComplianceSearchAction" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Novo caso de compliance
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-ComplianceCase" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.name |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Remover-ComplianceCase
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remove-ComplianceCase" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Set-ComplianceCase
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ComplianceCase" e a carga de trabalho "Set-ComplianceCase":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Add-ComplianceCaseMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Add-ComplianceCaseMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remover-ComplianceCaseMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-ComplianceCaseMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Update-ComplianceCaseMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Update-ComplianceCaseMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Nova Pesquisa de Compliance
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remover-CompliancePesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Definir-CompliancePesquisa
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Iniciar-Pesquisa de Compliance
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Start-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Interromper pesquisa de compliance
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Stop-ComplianceSearch" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
New-ComplianceSearchAction
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-ComplianceSearchAction" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remover-ComplianceSearchAction
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-ComplianceSearchAction" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
New-ComplianceSecurityFilter
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-ComplianceSecurityFilter" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remove-ComplianceSecurityFilter
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-ComplianceSecurityFilter" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-ComplianceSecurityFilter
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ComplianceSecurityFilter" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Add-eDiscoveryCaseAdmin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Add-eDiscoveryCaseAdmin" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Remover-eDiscoveryCaseAdmin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-eDiscoveryCaseAdmin" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
New-CaseHoldPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-CaseHoldPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-AadProtectionLevel
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-AadProtectionLevel" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-AutoSensitivityLabelPolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-AutoSensitivityLabelPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-DlpSensitiveInformationType
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-DlpSensitiveInformationType" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Receber rótulo
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-Label" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Acessar política de rótulos
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-LabelPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-PolicyConfig
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-PolicyConfig" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
ValidaterbacAccessCheck
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ValidaterbacAccessCheck" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| AadAppId | target.labels.key/value |
| DataType | security_result.description |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| Version | metadata.product_version |
AplicávelAdaptiveScopeChange
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AplicávelAdaptiveScopeChange" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.resource.product_object_id
If Name is AssociatedAdaptiveScopeIds then Value is target.resource.product_object_id |
| CorrelationId | security_result.detection_fields |
| ObjectType | security_result.summary |
Nova tag de compliance
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "NewComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
NewRetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "NewRetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
NewRetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "NewRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
RemoverComplianceTag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RemoveComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/valueIf Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
RemoveRetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "RemoveRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetComplianceTag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SetComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetRetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SetRetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING Required fields for SETTING_MODIFICATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetRetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SetRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
Get-CsTeamsUpgradeOverridePolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-CsTeamsUpgradeOverridePolicy" e a carga de trabalho "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | security_result.description
If Name is Tenant then Value is mapped to tenate_value If Name is Identity then Vale is mapped to identity_value security_result.description is Tenant = {tenate_value} / Identity = {identity_value} |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
TeamsAdminAction
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TeamsAdminAction" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
If ResultStatus is Succeeded then Action is set to ALLOW If ResultStatus is Failed then Action is set to BLOCK |
|
| AdminActionDetail | security_result.summary |
| ClientApplication | network.http.user_agent |
| ExtraProperties | additional.fields.key/value.string_value |
| UserClaims | security_result.description |
| Version | metadata.product_version |
Update-DistribuiçãoGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Update-DistributeGroupMember" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.description
target.group.product_object_id or target.group.email_addresses target.group.attribute.labels.key/value If Name is Members then Value is mapped to security_result.description If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
SupervisoryReviewOLAuditoria
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SupervisoryReviewOLAuditoria" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
extract auditscore form ResultStatus using ResultStatus .*?Score:{auditScore} and map with security_result.confidenece_details is {auditScore} security_result.confidence will map based on auditScore |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ExchangeDetails | network.direection
network.email.from network.email.mail_id network.email.to network.email.subject If Directionality is Incoming then network.direction is mapped to INBOUND If Directionality is Outgoining then network.direction is mapped to OUTBOUND From is mapped to network.email.from InternetMessageId is mapped to network.email.mail_id Recipients is mapped to network.email.to Subject is mapped to network.email.subject |
| Version | metadata.product_version |
Atividade padrão do cliente
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CrmDefaultActivity" e a carga de trabalho "CRM":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| CrmOrganizationUniqueName | principal.resource.name |
| InstanceUrl | target.url |
| ItemUrl | principal.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| Fields | about.labels.key/value |
| EntityId | principal.labels.key/value |
| EntityName | principal.labels.key/value |
| Message | security_result.summary |
| Query | security_result.description |
| PrimaryFieldValue | about.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| QueryResults | about.labels.key/value |
| ServiceContextId | principal.labels.key/value |
| ServiceContextIdType | about.labels.key/value |
| ServiceName | principal.application |
| SystemUserId | principal.labels.key/value |
| Version | metadata.product_version |
TIMailData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TIMailData" e a carga de trabalho "ThreatIntelligence":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
ObjectId is set to metadata.product_log_id |
|
| AttachmentData | about.file.full_path
about.file.mime_type about.file.sha256 security_result.category_details AttachmentData.FileName is mapped to about.file.full_path AttachmentData.FileType is mapped to about.file.mime_type AttachmentData.SHA256 is mapped to about.file.sha256 AttachmentData.FileVerdict is 0 then AttachmentData.MalwareFamily is mapped to security_result.category_details |
| DetectionType | security_result.summary |
| DetectionMethod | security_result.description |
| InternetMessageId | about.labels.key/value |
| NetworkMessageId | about.labels.key/value |
| P1Sender | principal.user.email_addresses |
| P2Sender | network.email.from |
| Policy | security_result.rule_name |
| PolicyAction | security_result.action
PolicyAction is Quarantine then action is set to QUARANTINE PolicyAction is MoveToJmf then action is set to ALLOW_WITH_MODIFICATION |
| Recipients | network.email.to |
| SenderIp | src.ip |
| Subject | network.email.subject |
| Verdict | security_result.category |
| MessageTime | target.resource.attribute.labels.key/value |
| EventDeepLink | metadata.url_back_to_product |
| DeliveryAction | about.labels.key/value |
| OriginalDeliveryLocation | about.labels.key/value |
| LatestDeliveryLocation | about.labels.key/value |
| Directionality | network.direction |
| ThreatsAndDetectionTech | about.labels.key/value |
| AdditionalActionsAndResults | about.labels.key/value |
| Connectors | about.labels.key/value |
| AuthDetails | about.labels.key/value |
| PhishConfidenceLevel | about.labels.key/value |
| Version | metadata.product_version |
SearchMtpStatus
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchMtpStatus" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| Version | metadata.product_version |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
Removido doSiteCollection
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "RemovedFromSiteCollection" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupType | target.group.group_display_name
target.user.userid target.user.email_addresses |
| WebId | about.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
Comentários desativados
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CommentsDisabled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| SourceRelativeUrl | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| WebId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
Arquivo reciclado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileRecycled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
Comentários ativados
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "CommentsEnabled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| ApplicationDisplayName | target.application |
PastaReciclada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FolderRecycled" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
Transcrição solicitada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileCaption Requests" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
WACTokenCompartilhado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "WACTokenShared" e a carga de trabalho "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
Atualizar marcador
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Atualizar rótulo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
SiteLocksChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteLocksChanged" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteIBModeSet
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteIBModeSet" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
Invocado pelo SiteDesign
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SiteDesign permissão" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
SiteDesignId is mapped to target.resource.attribute.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteContentTypeCreated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteContentTypeCreated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| ListTitle | about.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteCollectionQuotaModified
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteCollectionQuotaModified" e pela carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
Atalho adicionado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ShortcutADDED" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATIONObjectId is mapped to target.url | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SPOIBIsEnabled
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SPOIBIsEnabled" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
WebAccessRequestApprovalrModified
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "WebAccessRequestApprovalrModified" e pela carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ModifiedProperties | target.labels.key/value
if Name is RequestAccessEmail then NewValue is mapped to target.user.email_addresses or target.user.userid else target.labels.key/value |
Set-TransportConfig
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-TransportConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| AppId | target.labels.key/value |
| Parameters | principal.user.email_addresses
principal.user.userid If Name is Identity then Valueis mapped toprincipal.user.email_addresses or principal.user.userid |
Definir-TenantObjectVersion
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-TenantObjectVersion" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value
If Name is DomainController then Value is mapped to target.administrative_domain else target.labels.key/value |
Set-RecipientEnforcementProvisioningPolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-RecipientEnforcementProvisioningPolicy" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Set-PolicyConfig
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-PolicyConfig" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to ACCESS_POLICY |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-OwaMailboxPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-OwaMailboxPolicy" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Configurar Plano de Caixa de Correio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-MailboxPlan" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Definir-Propriedades de rótulo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-LabelProperties" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
Definir rótulo
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-Label" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-ExchangeAssistanceConfig
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ExchangeAssistanceConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.url
target.labels.key/value If Name is PrivacyStatementURL then Value is mapped to target.url else target.labels.key/value |
Set-ConditionalAccessPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ConditionalAccessPolicy" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.labels.key/value If Name is DisplayName then Value is mapped to target.resource.name else target.labels.key/value |
| SessionID | network.session_id |
New-ConditionalAccessPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-ConditionalAccessPolicy" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.labels.key/value If Name is DisplayName then Value is mapped to target.resource.name else target.labels.key/value |
| SessionID | network.session_id |
RemovidoSearchReport
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "RemovedSearchReport" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Acessar-PrivacyManagementPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-PrivacyManagementPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
Definir-RetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-RetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Parameters | target.process.command_line |
SearchTrialOffer
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchTrialOffer" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchTIKustoClusterInformation
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchTIKustoClusterInformation" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchMtpRoleInfo
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchMtpRoleInfo" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchMailflowEncaminhamentoData
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchMailflow comunicaData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchDataInsightsSubscription
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchDataInsightsSubscription" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchCustomerInsight
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchCustomerInsight" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchConnectorReportData.
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchConnectorReportData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertAggregate
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchAlertAggregate" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Alerta de pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchAlert" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Ativar-AddressListPaging
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Enable-AddressListPaging" e da carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Install-AdminAuditoriaLogConfig
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Install-AdminAuditoriaLogConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
AccessedAggregates
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AccessedAggregates" e a carga de trabalho "Mip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| DataType | security_result.description |
| version | metadata.product_version |
Listadesites acessados
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AccessedSiteList" e a carga de trabalho "Mip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| DataType | security_result.description |
| version | metadata.product_version |
Install-DataClassificationConfig.
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Install-DataClassificationConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Definir grupo unificado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-UnifiedGroup" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. if ResultStatus is TRUE then security_result.action is set to ALLOW else security_result.action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| SessionId | network.session_id |
AppliedAdaptivePolicyChange
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AplicávelAdaptivePolicyChange" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | security_result.detection_fields.key/value.
target.resource.product_object_id if Name is CorrelationId then Name is mapped to security_result.detection_fields.key/value. if Name is AssociatedAdaptivePolicyIds then AssociatedAdaptivePolicyIds is mapped to target.resource.product_object_id |
| ObjectType | security_result.summary |
Get-AppRetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-AppRetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{:target_resource_product_object_id}\ } } |
New-AppRetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-AppRetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| ClientRequestId | principal.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name target.resource.product_object_id Extract Policy and Name using grok Name is mapped to target.resource.name Policy is mapped to target.resource.product_object_id |
| StartTime | target.resource.attribute.creation_time |
New-AppKeepCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-AppRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| ClientRequestId | principal.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| StartTime | target.resource.attribute.creation_time |
Definir-AppKeepCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-AppRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
Instalar política de compartilhamento
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Install-DefaultSharedPolicy" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Install-ResourceConfig
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Install-ResourceConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Nova caixa de e-mails
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Nova caixa de e-mails" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZEDObjectId is mapped to target.url | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
Add-MailboxFolderPermission
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Add-MailboxFolderPermission" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.user.user_display_name target.user.attribute.permissions.name target.labels.key/value If Name is Identity then Value is mapped to target.resource.name If Name is User then Value is mapped to target.user.user_display_name If Name is AccessRights then Value is mapped to target.user.attribute.permissions.name else target.labels.key/value |
Novo-LabelPolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-LabelPolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to ACCESS_POLICY |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Novo rótulo
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Novo rótulo" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Get-ActivityAlert
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ActivityAlert" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Receber alerta de proteção
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ProtectionAlert" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
CasodeCompliancedaPesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchComplianceCase" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Remover-ComplianceTag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-ComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Remove-AppKeepCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-AppRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource_resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Remover-RetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Remove-RetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource_resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nova tag de compliance
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-ComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Ativar-ComplianceTagStorage
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Enable-ComplianceTagStorage" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ComplianceRetainEventType
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ComplianceretentionEventType" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AggregateActivityData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateActivityData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Set-ComplianceTag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-ComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-FilePlanPropertyStructure
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-FilePlanPropertyStructure" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
New-ComplianceRetainEventType
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-ComplianceRetainEventType" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is mapped to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name target_resource_name is mapped to target.resource.name |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-DlpSensitiveInformationTypeRulePackage
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-DlpSensitiveInformationTypeRulePackage" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ComplianceRetainEvent
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ComplianceRetainEvent" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
ComplianceSecurityFilter
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ComplianceSecurityFilter" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Receber mensagem em quarentena
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-ApenasMessage" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AggregateThreatProfileDetails
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateThreatProfileDetails" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Get-DlpDetectionsReport
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-DlpDetectionsReport" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-AppKeepCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-AppRetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Adicionar-FunçãoGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Add-RoleGroupMember" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
Update-RoleGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Update-RoleGroupMember" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
Novo grupo de papéis
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-RoleGroup" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| SessionId | network.session_id |
| ClientAppId | target.labels.key/value |
Provision-ComplianceMailboxFolder
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Provision-ComplianceMailboxFolder" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.product_object_id
target.labels.key/value need to discuss mapping of MultiStageReviewFolderSetting in parameter fields If Name is FolderName then Value is mapped to target.resource_product_object_id else target.labels.key/value |
Remover caixa de correio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Remove-Mailbox" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.name
target.labels.key/value If Name is Identity then Value is mapped to target.resource.name else target.labels.key/value |
Nova Política de Quarentena
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "New-quaPolicy" e a carga de trabalho "Troca":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.name
target.labels.key/value If Name is Name then Value is mapped to target.resource.name All other parameters will map with target.labels.key/value |
| SessionId | network.session_id |
Get-RoleGroup
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-RoleGroup" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
SearchLabelAnalyticsActivityData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchLabelAnalyticsActivityData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Get-DlpCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-DlpCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
Redirecionamento de SegurançadePesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchSecurityRedirection" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Get-ComplianceCaseMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ComplianceCaseMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Visualização em espera
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "HoldViewed" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Get-eDiscoveryCaseAdmin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-eDiscoveryCaseAdmin" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-RoleGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-RoleGroupMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ManagementRole
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-ManagementRole" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Set-RoleGroup
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-RoleGroup" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.group.group_display_name
target.process.command_line Extract DisplayName using grok Name is mapped totarget.group.group_display_name |
| Version | metadata.product_version |
| ResultCountSecurityComplianceCenterEventType | about.labels.key/value |
Get-SecurityPrincipal
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-SecurityPrincipal" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-CaseHoldRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-CaseHoldRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Relatório de Pesquisa Viewed
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "ViewedSearchReport" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.summary |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Get-AdaptiveScope
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-AdaptiveScope" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-RetainCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-RetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nova política de compliance de retenção
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-RetainCompliancePolicy" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
New-RetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-retentionComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ComplianceTag
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-ComplianceTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Definir-RetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-RetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-RegulamentoComplianceUI
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Get-RestrictComplianceUI" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-RetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-RetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
New-AdaptiveScope
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-AdaptiveScope" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Ativar-AdaptiveScopeStorage
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Enable-AdaptiveScopeStorage" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Tag personalizada de pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchCustomTag" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Definir compliance regulamentar
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "Set-RestrictComplianceUI" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
RemoveRetainComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "RemoveRetainComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | If Name is CmdletOptions then store value of Value in process_args variable.
If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} The name and value for the parameters that were used with the corresponding cmdlet. |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
NewAdaptiveScope
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "NewAdaptiveScope" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
The name and value for the parameters that were used with the corresponding cmdlet. If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| ObjectType | security_result.summary |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
Comentário criado
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CommentCreated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| CommentId | about.labels.key/value |
DeviceAccessPolicyChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DeviceAccessPolicyChanged" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ModifiedProperties | target.labels.key/value |
Batimento de Coração
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "HeartBeat" e a carga de trabalho "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| Version | metadata.product_version |
Criação de mensagens
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MessageCreation" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
| MessageID | target.resource.product_object_id |
ThreadView
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ThreadViewed" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
| ThreadID | about.labels.key/value |
StreamEditAdminGlobalRoleMembers
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamEditAdminGlobalRoleMembers" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocGetTextTrack
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamInvocGetTextTrack" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocChannelView
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamInvocChannelView" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvocarVideoMakePublic
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "StreamInvocVideoMakePublic" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
InvocarGroupView
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamInvocGroupView" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Set-CsOnlineDirectoryTenant
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-CsOnlineDirectoryTenant" e a carga de trabalho "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
Set-CsHostedVoicemailPolicy
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-CsHostedVoicemailPolicy" e a carga de trabalho "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.administrative_domain
target.url target.labels.key/value If Name is Organization then Value is mapped to target.administrative_domain If Name is Destination then Value is mapped to target.url else target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
Get-CSSimpleUrlConfiguration
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Get-CSSimpleUrlConfiguration" e a carga de trabalho "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.administrative_domain
target.labels.key/value If Name is Organization then Value is mapped to target.administrative_domain else target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
New-ExchangeAssistanceConfig
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-ExchangeAssistanceConfig" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Novo app
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Novo app" e a carga de trabalho "Troca":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
PublicarToWebReport
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PublishToWebReport" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
Atualizar gateway
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "UpdateGateway" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| GatewayId | target.resource.product_object_id |
ShareDataset
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ShareDataset" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| ArtifactId | target.resource.product_object_id |
| ArtifactName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| SharingAction | about.labels.key/value |
GetRefreshablesAsAdmin
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GetRefreshablesAsAdmin" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
CreateTagJob
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateTagJob" e a carga de trabalho "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| CaseID | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
Adicionar permissão delegada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Add delegated permission grant e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | target.resource.product_object_id
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If |
| TargetContextId | target.labels.key/value
|
Adicionar atribuição de papel de app ao principal de serviço
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar atribuição de função do app ao principal de serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summary If Name is ServicePrincipal.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is ServicePrincipal.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Atualizar para o aplicativo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Atualizar para o aplicativo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Atualizar aplicativo: gerenciamento de certificados e secrets
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Update application – Certificates and secrets management e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
if |
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
|
| TargetContextId | target.labels.key/value
|
Adicionar proprietário ao aplicativo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar proprietário ao aplicativo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summaryIf Name is Application.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Application.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.labels.key/value |
| TargetContextId | target.labels.key/value |
Adicionar ao aplicativo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar ao aplicativo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Adicionar configuração do dispositivo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar configuração do dispositivo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Adicionar domínio não verificado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar domínio não verificado" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is Name then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Adicionar política
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Adicionar política" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
CreateResponse
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "CreateResponse" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
Formulário de edição
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "EditForm" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
SubmitResponse
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SubmitResponse" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
Respostas de visualização
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ViewResponses" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
ViewRuntimeForm
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ViewRuntimeForm" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
DeleteFlow
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "DeleteFlow" e a carga de trabalho "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| FormsUserTypes | target.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
Visualização na lista
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ListViewed" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| ItemCount | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| TemplateTypeId | about.labels.key/value |
ListColumnUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListColumnUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListContentTypeUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListContentTypeUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListItemDeleted
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListItemDeleted" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
Lista atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| ItemCount | target.labels.key/value |
ListItemCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ListItemCreated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ItemCount | target.labels.key/value |
ListColumnCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ListColumnCreated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ItemCount | target.labels.key/value |
SiteContentTypeUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SiteContentTypeUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListItemViewed
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListItemViewed" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| ItemCount | target.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListItemUniqueId | principal.asset_id |
ListItemUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "ListItemUpdated" e a carga de trabalho "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| target.file.size | target.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListItemUniqueId | principal.asset_id |
Arquivo renomeado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileRenamed" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE | |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileType | target.resource.attribute.labels.key/value |
| PreviousFileName | src.file.full_path |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
Atualizar o PowerApp
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UpdatePowerApp" e a carga de trabalho "PowerApps":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AppName | target.labels.key/value |
| Id | metadata.product_log_id |
Mensagens Inscritos
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SubscribedToMessages" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| ExtraProperties | additional.fields.key/value.string_value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessageCreatedNotification
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MessageCreatedNotification" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| MessageVersion | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
Notificação atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MessageUpdatedNotification" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| MessageVersion | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessageCreatedHasLink
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MessageCreatedHasLink" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
Mensagens listadas
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MessagesListed" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| ChannelGuid | target.resource.product_object_id |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
PerformedCardAction.
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "PerformedCardAction" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| CommunicationType | about.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
MensagemEditedHasLink
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MessageEditedHasLink" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
Detalhes do participante da reunião
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MeetingParticipantDetail" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Attendees | about.resource.product_object_id
about.user.product_object_id about.user.attribute.roles.name OrganizationId is mapped to about.resource.product_object_id Role is mapped to about.user.attribute.roles.name UserObjectId is set to about.user.product_object_id |
| ExtraProperties | additional.fields.key/value.string_value |
| JoinTime | target.resource.attribute.creation_time |
| LeaveTime | target.resource.attribute.last_update_time |
| MeetingDetailId | target.resource.product_object_id |
| Version | metadata.product_version |
Detalhes da reunião
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MeetingDetail" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| StartTime | target.resource.attribute.creation_time |
| EndTime | target.resource.attribute.last_update_time |
| ExtraProperties | additional.fields.key/value.string_value |
| MeetingURL | target.url |
| MessageId | target.resource.product_object_id |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| Modalities | security_result.summary |
| Organizer | principal.user.product_object_id |
| Version | metadata.product_version |
Mensagem atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MessageUpdated" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| MessageId | target.resource.product_object_id |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| Version | metadata.product_version |
AggregateTransportQueueData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateTransportQueueData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AutorizarCustomerInsight
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AutorizarCustomerInsight" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AutorizarConnectorReportData
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AutorizarConnectorReportData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Substituição de alerta de pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchAlertOverride" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AutorizarMailflowEncaminhamentoData
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "AutorizarMailflowForwardData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchDomainTrafficStatus
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchDomainTrafficStatus" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertActivity
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchAlertActivity" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AggregateMailmetadata
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateMailmetadata" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Insight gerado
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "InsightGenerated" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Category | security_result.category_details |
| Description | security_result.description |
| InsightId | target.resource.product_object_id |
| Name | target.resource.name |
| Version | metadata.product_version |
Envio de usuário
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UserSubmission" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCAN_UNCATEGORIZED
security_result.category is MAIL_SPAM |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| KesMailId | network.email.mail_id |
| ExtendedProperties | security_result.rule_name
security_result.rule_id security_result.category_details SubmissionSource is mapped to security_result.rule_name SubmissionId is mapped to security_result.rule_id SubmissionCategory is mapped to security_result.category_details |
| P1SenderDomain | principal.administrative_domain |
| Recipients | network.email.to |
| SenderIP | principal.ip |
| Subject | network.email.subject |
| P2Sender | network.email.from |
| SubmissionState | security_result.summary |
| P1Sender | principal.user.email_addresses |
| Version | metadata.product_version |
SaveRoleGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SaveRoleGroupMember" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Dados de Inteligência da Campanha de Agregação
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateCampaignIntelligenceData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchEmailTimelineEvents
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchEmailTimelineEvents" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
História de alertas de pesquisa
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "SearchAlertStory" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AggregateThreatDetailsBulk
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AggregateThreatDetailsBulk" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Get-User
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-User" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-DlpComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Get-DlpComplianceRule" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AnalyzedByExternalApplication
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AnalyzedByExternalApplication" e a carga de trabalho "Power BI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.name |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
New-MigrationBatch
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "New-MigrationBatch" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.administrative_domain target.resource.attribute.key/value If Name is Name then Value is mapped to target.resource.name if Name is TargetDeliveryDomain then Value is mapped to target.administrative_domain If Name is AutoStart then Value is mapped to target.resource.attribute.key/value If Name is AutoComplete then Value is mapped to target.resource.attribute.key/value |
| SessionId | network.session_id |
UserSubmissionTriage.
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "UserSubmissionTriage" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCAN_UNCATEGORIZED
security_result.category is set to MAIL_SPAM |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | security_result.rule_name
security_result.rule_id security_result.category_details SubmissionSource is mapped to security_result.rule_name SubmissionId is mapped to security_result.rule_id SubmissionCategory is mapped to security_result.category_details |
| GradingResult | security_result.category_details |
| KesMailId | network.email.mail_id |
| P1Sender | principal.user.email_addresses |
| P1SenderDomain | principal.administrative_domain |
| P2Sender | network.email.from |
| Recipients | network.email.to |
| SenderIP | principal.ip |
| Subject | network.email.subject |
| SubmissionState | security_result.summary |
Arquivo arquivado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileArchive" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
FileCreatedOnNetworkShare
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileCreatedOnNetworkShare" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATION | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
FileCreatedOnRemovableMedia
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "FileCreatedOnRemovableMedia" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATION | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
SlimFilePrint
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "SlimFilePrinted" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
target.asset.type is PRINTER |
|
| Application | target.application |
| DeviceName | target.hostname |
| FileType | target.resource.attribute.labels.key/value |
| TargetPrinterName | target.asset.hostname |
| Version | metadata.product_version |
Arquivo impresso
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FilePrinted" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
target.asset.type is PRINTER |
|
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetPrinterName | target.asset.hostname |
| Version | metadata.product_version |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| PreviousFileName | src.file.full_path |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
ArchiveCreated
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ArchiveCreated" e a carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
Downloads do navegador
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "FileDownloadFromBrowser" e carga de trabalho "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
Criar senha de app para o usuário
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Criar senha do aplicativo para o usuário" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
SearchNdrDetailData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "SearchNdrDetailData" e a carga de trabalho "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Mensagem atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "MessageUpdated" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Acesso
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Acesso" e a carga de trabalho "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is set to target.file.full_path |
|
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| DataState | security_result.summary |
| Version | metadata.product_version |
Descobrir
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Discover" e a carga de trabalho "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is set to target.file.full_path |
|
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| DataState | security_result.summary |
| Version | metadata.product_version |
TIUrlClickData
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "TIUrlClickData" e a carga de trabalho "ThreatIntelligence":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.application |
| AppVersion | metadata.product_version |
| EventDeepLink | metadata.url_back_to_product |
| SourceId | AppName is Mail then SourceId is mapped to network.email.id |
| Url | target.url |
| UserIp | principal.ip |
| Version | metadata.product_version |
O dispositivo não é mais gerenciado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Dispositivo não gerenciado mais" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is set to DEVICE |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.asset.product_object_id
target.platform If Name is TargetId.DeviceId then NewValue is mapped to target.asset.product_object_id If Name is TargetId.DeviceOSType then NewValue is mapped to target.platform |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Dados de investigação do ar
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "AirInvestData" e a carga de trabalho "AirInvest".
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| LastUpdateTimeUtc | target.resource.attribute.last_update_time |
| Status | security_result.summary |
| InvestigationId | target.resource.product_object_id |
| InvestigationType | target.resource.attribute.labels.key/value |
| Data | security_result.description
security_result.category_details network.email.to network.email.from network.email.mail_id network.email.subject network.direction principal.ip principal.administrative_domain principal.user.email_addresses Data.Description is mapped to security_result.description Data.Category is mapped to security_result.category_details Data.Entities.1.Recipient is mapped to network.email.to Data.Entities.1.Sender is mapped to network.email.from Data.Entities.1.InternetMessageId is mapped to network.email.mail_id Data.Entities.1.Subject is mapped to network.email.subject Data.Entities.1.AntispamDirection is mapped to network.direction Data.Entities.1.SenderIP is mapped to principal.ip Data.Entities.1.P1SenderDomain is mapped to principal.administrative_domain Data.Entities.1.P1Sender is mapped to principal.user.email_addresses |
| InvestigationName | target.resource.name |
| StartTimeUtc | target.resource.attribute.creation_time |
| Version | metadata.product_versionn |
| DeepLinkUrl | metadata.url_back_to_product |
Set-MailboxJunkEmailConfiguration
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-MailboxJunkEmailConfiguration" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.user.email_addresses
If Name is BlockedSendersAndDomains then Value is mapped to target.user.email_addresses (all email addresses comes as ; separated) |
| SessionId | network.session_id |
| Version | metadata.product_version |
Novo grupo de distribuição
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-DistributionGroup" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name security_result.description target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is ManagedBy then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Member then Value is mapped to security_result.description else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
Add-DistributeGroupMember
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Add-DistributeGroupMember" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
Remove-InboxRule
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remove-InboxRule" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING ObjectId is set to target.group.product_object_id |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.rule_labels.key/value |
| SessionId | network.session_id |
Ativar caixa de correio
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Enable-Mailbox" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
target.resource.attribute.labels.key/value If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid if Name is Archive then Value is mapped to target.resource.attribute.labels.key/value |
| SessionId | network.session_id |
Importar
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Importar" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| SwitchState | about.labels.key/value |
| ImportSource | about.labels.key/value |
| ImportType | target.file.mime_type |
| ImportDisplayName | target.file.full_path |
O dispositivo não está mais em compliance
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "O dispositivo não é mais compatível" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to DEVICE |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.resource.product_object_id If Name is TargetId.DeviceId then NewValue is mapped to target.resource.product_object_id If Name is TargetId.DeviceOSType then NewValue is mapped to target.platform |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Ativar conta
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Enable account e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| version | metadata.product_version
|
| TargetContextId | target.labels.key/value
|
Adicionar credenciais principais de serviço
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar credenciais principais do serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Set-SyncUser
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Set-SyncUser" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid |
| SessionId | network.session_id |
Mensagem enviada
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "MessageSent" e a carga de trabalho "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| ChannelGuid | target.labels.key/value |
| OperationScope | about.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| MessageId | target.resource.product_object_id |
| Version | metadata.product_version |
| MessageVersion | target.resource.attribute.labels.key/value |
Remover credenciais principais de serviço
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remover credenciais principais do serviço" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Remove-MoveRequest
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remove-MoveRequest" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
target.resource.attribute.labels.key/value If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid If Name is ExecutingIdentity then Value is mapped to target.resource.attribute.labels.key/value |
StreamInvocGetTranscrição
A tabela a seguir lista os campos de registro e os mapeamentos do UDM correspondentes para a operação "StreamInGet cota" e a carga de trabalho "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Remover proprietário do grupo
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "Remover proprietário do grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product_object_id
target.group.group_display_nameIf Name is Group.ObjectID then NewValue is mapped to target.group.product_object_id If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Adicionar atribuição de função de app ao grupo
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar atribuição de função de app ao grupo" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name target.group.group_display_name If Name is AppRole.Id then NewValue is mapped to target.resource.product_object_id If Name is AppRole.DisplayName then NewValue is mapped to target.resource.name If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Desativar-MailUser
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Desativar-MailUser" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ResultStatus is True Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid |
New-FolderMoveRequest
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "New-FolderMoveRequest" e a carga de trabalho "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | If Name is Name then Value is mapped to target.resource.name
If Name is DomainController then Value is mapped to target.administrative_domain If Name is Folders then Value is mapped to target.resource.attribute.labels.key/value |
Adicionar proprietário à política
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "Adicionar proprietário à política" e a carga de trabalho "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent
if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | If Name is Policy.ObjectID then NewValue is mapped to target.resource.product_object_id
If Name is Policy.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
EditContentProviderProperties
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação "EditContentProviderProperties" e a carga de trabalho "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | We map this field based on value of UpdateApp Operation value.
recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | RecipientEmail is mapped to about.user.email_addresses
RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| SwitchState | about.labels.key/value |
| ContentProviderCertificationStage | security_result.summary |
| AppId | target.labels.key/value |
| RequestId | about.labels.key/value |
Relatórios acessados
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "ReportingAccessed" e a carga de trabalho "Projeto":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
GroupAccessFailure
A tabela a seguir lista os campos de registro e os mapeamentos de UDM correspondentes para a operação "GroupAccessFailure" e a carga de trabalho "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description is set to IsSoftDelete - {IsSoftDelete} |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
FileSensitivityLabelChanged
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação FileSensitivityLabelChanged e a carga de trabalho SharePoint/OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_UNCATEGORIZED
|
|
| AppAccessContext.CorrelationId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| DestinationFileExtension | target.file.mime_type |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationLabel | target.labels |
| EventSource | principal.application |
| HighPriorityMediaProcessing | about.labels |
| IsManagedDevice | about.labels |
| ItemType | target.resource.attribute.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ListServerTemplate | security_result.detection_fields.key/value |
| SensitivityLabelEventData.ActionSource | principal.labels.key/value |
| SensitivityLabelEventData.LabelEventType | target.labels.key/value |
| SensitivityLabelEventData.OldSensitivityLabelId | target.resource.product_object_id |
| SensitivityLabelEventData.OldSensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelEventData.SensitivityLabelId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path = %{SourceRelativeUrl}/%{SourceFileName} |
| SourceRelativeUrl | src.file.full_path = %{SourceRelativeUrl}/%{SourceFileName} |
| SourceLabel | src.labels.key/value |
| UserAgent | network.http.user_agent |
| UserKey | target.labels |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
Leitura de Arquivos
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação FileRead e a carga de trabalho Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_READ
|
|
| Application | principal.application |
| DeviceName | target.hostname |
| DlpAuditEventMetadata.DlpPolicyMatchId | security_result.detection_fields.key/value |
| DlpAuditEventMetadata.EvaluationTime | security_result.detection_fields.key/value |
| EnforcementMode | target.labels |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Hidden | security_result.detection_fields.key/value |
| JitTriggered | security_result.detection_fields.key/value |
| MDATPDeviceId | security_result.detection_fields.key/value |
| PolicyMatchInfo | target.resource.product_object_id
|
| RMSEncrypted | security_result.detection_fields.key/value |
| SensitiveInfoTypeData | security_result.detection_fields.key/value
|
| SensitivityLabelEventData.SensitivityLabelId | security_result.detection_fields.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
MessageReadConfirmReceived
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação MessageReadReceiptReceived e a carga de trabalho MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE |
|
| ChatThreadId | target.user.group_identifiers
|
| CommunicationType | about.labels.key/value |
| MessageId | target.resource.product_object_id |
| MessageVersion | target.resource.attribute.labels.key/value |
| MessageVisibilityTime | target.resource.attribute.labels.key/value |
| ParticipantInfo.HasForeignTenantUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasGuestUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasOtherGuestUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasUnauthenticatedUsers | security_result.detection_fields.key/value |
| ParticipantInfo.ParticipatingTenantIds | security_result.detection_fields.key/value |
Pesquisar
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Search e a carga de trabalho SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UNCATEGORIZED |
|
| AadAppId | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| Version | metadata.product_version |
| DataType | security_result.description |
Tarefa excluída
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação TaskDeleted e a carga de trabalho MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_DELETION
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
Tarefa atualizada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação TaskUpdated e a carga de trabalho MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_WRITTEN
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
Criação de tarefas
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação TaskCreation e a carga de trabalho MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_CREATION
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
GrupodesegurançaModificado
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação SecurityGroupModified e a carga de trabalho Project:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GROUP_MODIFICATION |
|
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| UserKey | target.labels |
| Version | metadata.product_version |
| AppAccessContext.UniqueTokenId | target.labels |
| AppAccessContext.CorrelationId | security_result.detection_fields.key/value |
Iniciar o PowerApp
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação LaunchPowerApp e a carga de trabalho PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GENERIC_EVENT |
|
| AppName | target.labels.key/value
|
| Version | metadata.product_version |
DeleteDatasetRows
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação DeleteDatasetRows e a carga de trabalho PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_DELETION.
If
else |
|
| UserAgent | network.http.user_agent
|
| WorkSpaceName | target.resource.attribute.labels.key/value
|
| DatasetName | target.resource.attribute.labels.key/value
|
| WorkspaceId | target.resource.attribute.labels.key/value
|
| DatasetId | target.resource.product_object_id
|
| DataConnectivityMode | target.resource.attribute.labels.key/value
|
| ArtifactId | target.resource.attribute.labels.key/value
|
| RequestId | about.labels.key/value
|
| ActivityId | principal.labels.key/value
|
| TableName | target.resource.attribute.labels.key/value
|
| LastRefreshTime | about.labels.key/value
|
| ArtifactKind | target.resource.attribute.labels.key/value
|
New-DlpCompliancePolicy
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação New-DlpCompliancePolicy e a carga de trabalho SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
New-DlpComplianceRule
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação New-DlpComplianceRule e a carga de trabalho SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
Get-InsiderRiskPolicy
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Get-InsiderRiskPolicy e a carga de trabalho SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
Set-HostedContentFilterPolicy
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Set-HostedContentFilterPolicy e a carga de trabalho Exchange:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
If
else |
|
| ExternalAccess | about.labels.key/value
|
| ObjectId | target.resource.product_object_id
|
| Version | metadata.product_version
|
| Parameters | target.resource.attribute.labels.key/value
|
| UserKey | target.labels.key/value
|
Ative a autenticação forte.
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Enable Strong Authentication. e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS.
|
|
| ExtendedProperties | If Name is equal to additionalDetails then User-Agent is mapped with network.http.user_agent
else if else |
| ModifiedProperties | If Name is equal to Included Updated Properties then NewValue is mapped with security_result.summary
else |
ReagidoToMessage
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ReactedToMessage e a carga de trabalho MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.IssuedAtTime | target.labels.key/value
|
| AppAccessContext.UniqueTokenId | target.labels.key/value
|
| ChatThreadId | target.user.group_identifiers
|
| ChatThreadId | target.group.product_object_id
|
| MessageReactionType | target.resource.attribute.labels.key/value
|
| ChatName | target.group.group_display_name
|
| MessageId | target.resource.product_object_id
|
| ParticipantInfo.HasForeignTenantUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasGuestUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasOtherGuestUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasUnauthenticatedUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.ParticipatingTenantIds | security_result.detection_fields.key/value
|
RemovebleMediaUnmount
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação RemovableMediaUnmount e a carga de trabalho Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| MDATPDeviceId | target.asset.asset_id
|
| Platform | target.labels.key/value
|
| Scope | target.labels.key/value
|
| RemovableMediaDeviceAttributes.Manufacturer | target.asset.hardware.manufacturer
|
| RemovableMediaDeviceAttributes.Model | target.asset.hardware.model
|
| RemovableMediaDeviceAttributes.SerialNumber | target.asset.hardware.serial_number
|
FileUploadToCloud
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação FileUploadedToCloud e a carga de trabalho Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_SYNC.
|
|
| DlpAuditEventMetadata.DlpPolicyMatchId | security_result.detection_fields.key/value
|
| DlpAuditEventMetadata.EvaluationTime | security_result.detection_fields.key/value
|
| EnforcementMode | target.labels.key/value
|
| EvidenceFile.FullUrl | target.file.full_path
|
| EvidenceFile.StorageName | target.file.names
|
| Hidden | security_result.detection_fields.key/value
|
| JitTriggered | security_result.detection_fields.key/value
|
| MDATPDeviceId | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.Count | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.Confidence | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value
|
| TargetPrinterName | target.asset.hostname
|
target.asset.type is set to PRINTER | |
| TargetDomain | target.labels.key/value
|
GenerateDataflowSasToken
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação GenerateDataflowSasToken e a carga de trabalho PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_CHANGE_PERMISSIONS.
|
|
| DataflowAccessTokenRequestParameters.entityName | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.partitionUri | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.permissions | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.tokenLifetimeInMinutes | principal.labels.key/value
|
| DataflowId | target.resource.product_object_id
|
| DataflowName | target.resource.name
|
| IsSuccess |
If
else |
| ItemName | target.labels.key/value
|
Gerar captura de tela
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação GenerateScreenshot e a carga de trabalho PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
Avaliações do MDC
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação MDCAssessments e a carga de trabalho CompliancePostureManagement:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to SCAN_UNCATEGORIZED.
|
|
| PropertyBag.AssessmentStatusPerInitiative.ArnEventId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.CloudProvider | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.CustomerResourceId | about.resource.product_object_id
|
| PropertyBag.AssessmentStatusPerInitiative.EventType | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.PolicyInitiativeId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.PolicyInitiativeName | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.ResourceName | about.resource.name
|
| PropertyBag.AssessmentStatusPerInitiative.ResourceType | about.resource.resource_subtype
|
| PropertyBag.AssessmentStatusPerInitiative.SecurityAssessmentId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusChangeDate | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusCode | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusFirstEvaluationDate | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.SubscriptionId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.SubscriptionName | about.labels.key/value
|
| PropertyBag.DataType | about.labels.key/value
|
RemovableMediaMount
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação RemovableMediaMount e a carga de trabalho Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| MDATPDeviceId | target.asset.asset_id
|
| Platform | target.labels.key/value
|
| Scope | target.labels.key/value
|
| RemovableMediaDeviceAttributes.Manufacturer | target.asset.hardware.manufacturer
|
| RemovableMediaDeviceAttributes.Model | target.asset.hardware.model
|
| RemovableMediaDeviceAttributes.SerialNumber | target.asset.hardware.serial_number
|
Evento de login
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação SignInEvent e a carga de trabalho SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| AuthenticationType | principal.labels.key/value
|
| BrowserName | principal.labels.key/value
|
| BrowserVersion | principal.labels.key/value
|
| DeviceDisplayName | principal.labels.key/value
|
| IsManagedDevice | principal.labels.key/value
|
Solicitação aprovada
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ApprovedRequest e a carga de trabalho MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS.
|
|
| ItemName | target.labels.key/value
|
CriarFormulário
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação CreateForm e a carga de trabalho MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| FormsUserType | target.labels.key/value
|
| SourceApp | principal.application
|
ListForms
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ListForms e a carga de trabalho MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
Avaliações de conformidade regulamentar do MDC
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação MDCRegulatoryComplianceAssessments e a carga de trabalho CompliancePostureManagement:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to SCAN_UNCATEGORIZED.
|
|
| PropertyBag.DataType | about.labels.key/value
|
| PropertyBag.Policy.ArnEventId | about.labels.key/value
|
| PropertyBag.Policy.Description | about.labels.key/value
|
| PropertyBag.Policy.DetailsLink | about.labels.key/value
|
| PropertyBag.Policy.EventTime | about.labels.key/value
|
| PropertyBag.Policy.EventType | about.labels.key/value
|
| PropertyBag.Policy.PolicyInitiativeId | about.labels.key/value
|
| PropertyBag.Policy.PolicyInitiativeName | about.labels.key/value
|
Formulário de pré-visualização
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação PreviewForm e a carga de trabalho MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_ACCESS.
|
ViewedApprovalRequest
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ViewedApprovalRequest e a carga de trabalho MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_ACCESS.
|
|
| ItemName | target.labels.key/value
|
Criado na lista
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ListCreated e a carga de trabalho SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.UniqueTokenId | target.labels.key/value
|
| ListColor | target.labels.key/value
|
| ListIcon | target.labels.key/value
|
SiteColumnCreated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação SiteColumnCreated e a carga de trabalho OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| ObjectId | target.resource.product_object_id
|
ListViewUpdated
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ListViewUpdated e a carga de trabalho SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.UniqueTokenId | target.labels.key/value |
| AuthenticationType | principal.labels.key/value |
| BrowserName | principal.labels.key/value |
| BrowserVersion | principal.labels.key/value |
| CustomizedDoclib | principal.labels.key/value |
| DeviceDisplayName | principal.labels.key/value |
| FromApp | principal.labels.key/value |
| IsManagedDevice | principal.labels.key/value |
| ItemCount | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| ObjectId | target.url |
| Platform | target.labels.key/value |
| RecordType | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| Source | security_result.description |
| TemplateTypeId | about.labels.key/value |
| WebId | about.labels.key/value |
usuários desconectados
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação TeamsUserSignedOut e a carga de trabalho MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_LOGOUT.
|
|
extension.auth.auth_type is mapped to SSO.
|
|
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers |
| DeviceInformation | principal.labels.key/value |
| ItemName | target.labels.key/value |
| MessageId | target.labels.key/value |
| MessageVersion | target.labels.key/value |
| ObjectId | target.labels.key/value |
| TeamGuid | target.group.product_object_id |
| TeamName | target.group.group_display_name |
| UserKey | target.labels.key/value |
| UserType | target.user.attribute.roles |
| Version | metadata.product_version |
GetWorkspaces
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação GetWorkspaces e a carga de trabalho PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| Activity | about.labels.key/value |
| ActivityId | about.labels.key/value |
| AggregatedWorkspaceInformation.WorkspaceCount | target.labels.key/value |
| AggregatedWorkspaceInformation.WorkspacesByCapacitySku | target.labels.key/value |
| AggregatedWorkspaceInformation.WorkspacesByType | target.labels.key/value |
| IsSuccess | security_result.action |
| UserAgent | network.http.user_agent |
ConnectFromExternalApplication
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação ConnectFromExternalApplication e a carga de trabalho PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| Activity | about.labels.key/labels |
| CustomData | about.labels.key/value |
Leitura de Tarefas
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação TaskListRead e a carga de trabalho Planner:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| UserKey | principal.labels.key/labels |
| ObjectId | target.labels.key/labels |
| TaskList | target.labels.key/value |
PutConnection
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação PutConnection e a carga de trabalho PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE. |
|
| ObjectId | target.labels.key/value |
| Version | metadata.product_version |
| AdditionalInfo.actionName | security_result.detection_fields.key/value |
| ResourceId | target.labels.key/value |
| UserKey | target.label.key/value |
| AdditionalInfo.environmentName | target.labels.key/value |
AdminSubmissionTablAllow
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação AdminSubmissionTablAllow e a carga de trabalho SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GENERIC_EVENT. |
|
| SubmissionContent | security_result.detection_fields.key/value |
| SubmissionContentType | security_result.detection_fields.key/value |
| ObjectId | target.labels.key/value |
| Recipients | network.email.to |
| SubmissionState | security_result.summary |
| SubmissionId | security_result.detection_fields.key/value |
| ExtendedProperties | principal.labels.key/value
If Else |
| SubmissionConfidenceLevel | security_result.detection_fields.key/value |
| SubmissionType | security_result.detection_fields.key/value |
| MessageDate | about.labels.key/value |
| P1SenderDomain | principal.administrative_domain |
| UserKey | target.label.key/value |
| P2SenderDomain | about.administrative_domain |
| Subject | network.email.subject |
| Version | metadata.product_version |
Adicionar contato.
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação Add contact. e a carga de trabalho AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_CREATION.
|
|
| ObjectId | target.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| ActorContextId | principal.labels.key/value |
| SupportTicketId | about.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| TargetContextId | target.labels.key/value |
| UserKey | target.label.key/value |
| Target | security_result.detection_fields.key/value |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ExtendedProperties | target.resource.attribute.labels.key/value
If Else |
| ModifiedProperties | target.resource.name
If Else if Else |
WorkspacePortalUrlReceived
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação WorkspacePortalUrlReceived e a carga de trabalho MicrosoftDefenderForIdentity:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE. |
|
| ResultDescription | security_result.detection_fields.key.value |
| UserKey | target.labels.key/value |
PutConnectionPermission
A tabela a seguir lista os campos de registro e os mapeamentos UDM correspondentes para a operação PutConnectionPermission e a carga de trabalho PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE.
|
|
| ObjectId | target.labels.key/value |
| Version | metadata.product_version |
| AdditionalInfo.actionName | security_result.detection_fields.key/value |
| ResourceId | target.resource.attribute.labels.key/value |
| UserKey | target.label.key/value |
| AdditionalInfo.environmentName | target.resource.attribute.labels.key/value |
| AdditionalInfo.targetObjectId | target.resource.product_object_id |