Raccogliere i log di Microsoft 365
Questo documento descrive come raccogliere i log di Microsoft 365 configurando un feed Chronicle e in che modo i campi dei log vengono mappati ai campi del Chronicle Unified Data Model (UDM). Questo documento elenca anche le attività controllate supportate e la versione di Microsoft 365 supportata.
Per una panoramica sull'importazione dati in Chronicle, consulta Importazione dei dati in Chronicle.
Panoramica
Il seguente diagramma dell'architettura di deployment mostra come è configurato il feed di Microsoft 365 e Chronicle per l'invio dei log a Chronicle. Ogni deployment del cliente potrebbe essere diverso da questa rappresentazione e potrebbe essere più complesso.
Il diagramma dell'architettura mostra i seguenti componenti:
Microsoft 365. Il servizio Microsoft 365 da cui raccogli i log.
Feed Chronicle. Il feed Chronicle che recupera i log da Microsoft 365 e scrive i log in Chronicle.
Chronicle. Chronicle conserva e analizza i log di Microsoft 365.
Un'etichetta di importazione identifica l'analizzatore sintattico che normalizza i dati di log non elaborati in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser
con l'etichetta di importazione OFFICE_365.
Prima di iniziare
Utilizzare Microsoft 365 versione 2204 Build 16.0.15128.20248 o successiva e verificare di disporre di un abbonamento a Microsoft 365 Enterprise E5 con funzionalità del Centro sicurezza e conformità Microsoft.
Concedi all'utente le autorizzazioni e i privilegi necessari per generare ed esportare eventi diversi per tutti i prodotti Microsoft supportati. Per un'autorizzazione di esempio, vedi Autorizzazioni per accedere alle API di gestione
Configura Microsoft 365 per la ricerca e l'esportazione dei log. Microsoft Azure Active Directory (Azure AD) è il servizio di directory per Microsoft 365. La generazione dei log può richiedere fino a 24 ore. Per maggiori informazioni, vedi Eseguire ricerche nel log di controllo.
Assicurati che tutti i sistemi nell'architettura di deployment siano configurati con il fuso orario UTC.
Esamina le attività e i prodotti supportati dall'analizzatore sintattico di Chronicle. Nella tabella seguente sono elencati le attività e i prodotti supportati dall'analizzatore sintattico Chronicle:
Attività Prodotti Attività di file e pagine SharePoint Online e OneDrive for Business Attività cartella SharePoint Online e OneDrive for Business SharePoint elenca attività SharePoint Online Attività di richiesta di condivisione e accesso SharePoint Online e OneDrive for Business Attività di sincronizzazione SharePoint Online e OneDrive for Business Attività di autorizzazione dei siti SharePoint Online Attività di amministrazione del sito SharePoint Online Attività casella di posta Exchange Caselle di posta di gruppo di Microsoft 365 Attività di amministrazione utenti Centro di amministrazione Microsoft 365 Attività di amministrazione dei gruppi Azure AD Centro di amministrazione Microsoft 365 Attività di amministrazione delle applicazioni Quando un amministratore aggiunge o modifica un'applicazione registrata in Azure AD Attività di amministrazione dei ruoli Centro di amministrazione Microsoft 365 Attività di amministrazione della directory Centro di amministrazione Microsoft 365 Attività di Power BI Logo Power BI Attività di Microsoft Teams Microsoft Teams Attività di Microsoft Teams Shifts Cambia l'app in Microsoft Teams Attività di Microsoft Teams Healthcare Applicazione dei pazienti in Microsoft Teams Attività di Microsoft Teams Shifts Cambia l'app in Microsoft Teams Attività di Yammer Yammer Attività di Microsoft Power Automation Power Automatizza (in precedenza Microsoft Flow) Attività di Microsoft PowerApps App avanzate Attività di Microsoft Stream Microsoft Stream Attività di quarantena Mettere in quarantena i messaggi email in Office 365 Attività di Moduli Microsoft Microsoft Teams Attività etichetta sensibilità Attività di etichettatura per SharePoint Online e Teams Attività relative ai criteri di conservazione e alle etichette di conservazione NA Briefing delle attività via email Email con la rassegna stampa Attività di Le mie analisi MyAnalytics Attività relative alle barriere informative NA Attività di revisione della disposizione NA Attività di conformità della comunicazione NA Attività non definita NA
Configura un feed in Chronicle per importare i log di Microsoft 365
- Vai alle impostazioni di Chronicle e fai clic su Feed.
- Fai clic su Add New (Aggiungi nuovo).
- Seleziona API di terze parti come Tipo di origine.
- Seleziona Office 365 come Tipo di log.
- Tocca Avanti.
- In base alla configurazione di Microsoft 365, specifica i dettagli ID client OAuth, Client secret OAuth e ID tenant.
- Seleziona il tipo di contenuti per cui stai creando il feed. Devi creare un feed separato per ogni tipo di contenuto richiesto.
- Fai clic su Avanti e poi su Invia.
Per saperne di più sui feed Chronicle, consulta la documentazione sui feed Chronicle.
Riferimento per la mappatura dei campi
Questa sezione spiega in che modo l'analizzatore sintattico Chronicle mappa i campi dei log di Microsoft 365 ai campi UDM (Chronicle Unified Data Model) per le operazioni e i carichi di lavoro supportati.
Campi comuni
Nella tabella seguente sono elencati i campi di log comuni e i campi UDM corrispondenti.
| Common log field | UDM field |
|---|---|
| ID | metadata.product_log_id |
| RecordType | security_result.detection_fields.key/value security_result.detection_fields.key is set to {RecordeType} - RecordTypeNameFromDoc security_result.detection_fields.value is set to RecordTypeDescriptionFromDoc |
| CreationTime | metadata.event_timestamp |
| Operation | metadata.product_event_type |
| OrganizationId | principal.resource.product_object_id |
| UserType | principal.user.attribute.roles.name |
| UserId | principal.user.email_addresses or principal.user.userid target.user.email_addresses or target.user.userid If is Operation is UserLoggedIn, UserLoginFailed, Add OAuth2PermissionGrant, TeamsUserSignedOut, or Add delegated permission grant then UserId is mapped to target.user else UserId is mapped to principal.user If UserId value contains email address then it is mapped to email_address, else it is mapped to userid. |
| ClientIP | principal.ip and principal.port |
| Workload | target.application |
| AppAccessContext | network.session.id security_result.detection_fields.key/value AADSessionId is mapped to network.session.id CorrelationId is mapped to security_result.detection_fields.key/value |
Per informazioni di riferimento sulle mappature UDM per le operazioni supportate, consulta le seguenti sezioni:
FileAccessed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Fileaccessed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileAccessedExtended
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileAccessedExtended" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileDeleted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Filedeleted" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileCopied
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileCopy" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_COPY
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | src.file.full_path
target.file.full_path Extract SourceFileUrl is mapped to src_file_full_path TargetFileUrl is mapped to target_file_full_path |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileModified" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MODIFICATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
FileDownloaded
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Filescaricata" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| UserSessionId | network.http.session_id |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ZipFileName | principal.resource.parent |
FileModifiedExtended
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileModifiedExtended" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MODIFICATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
FileMoved
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileMoved" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FilePreviewed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FilePreviewed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileRenamed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileRenamed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
FileUploaded
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileUploaded" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| ImplicitShare | target.resource.attribute.labels.key/value |
FileVersionsAllDeleted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileVersionsAlldeleted" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
FileCheckedIn
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileCheckedIn" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | workload map with intermediary.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileCheckedOut
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileCheckedOut" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | Uniquely Identify resource in site like File or Folder |
| ItemType | This field contain values like File, Folder, Web, Site, Tenant, and DocumentLibrary |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | Information about the user's browser. This information is provided by the browser. |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | We can not map it with target.file.full_path because of SiteUrl field not contains value related to system path |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ComplianceSettingChanged
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ComplianceSettingChanged" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| SharingType | target.labels.key/value |
LockRecord
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "LockRecord" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
UnlockRecord
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UnlockRecord" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileDeletedFirstStageRecycleBin
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FiledeletedFirstStageRecycleBin" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SharingType | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileDeletedSecondStageRecycleBin
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FiledeletedSecondStageRecycleBin" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
RecordDelete
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "RecordDelete" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
DocumentSensitivityMismatchDetected
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "DocumentSensitivityMismatchDetected" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
DocumentSensitivityMismatchDetected
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "DocumentSensitivityMismatchDetected" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileCheckOutDiscarded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "FileCheckOutOUTed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionsAllMinorsRecycled
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "FileVersionsAllMinorsRecycled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionsAllRecycled
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileVersionsAllRecycled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileVersionRecycled
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileVersionRecycled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileRestored
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileRipristinad" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SharingType | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileMalwareDetected
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileMalwareDetected" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| VirusInfo | security_result.threat_name |
| VirusVendor | target.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
SearchQueryPerformed
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchQueryPerformed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| EventData | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
PageViewed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "PageViewed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
PagePrefetched
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "PagePrefetched" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ClientViewSignaled
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ClientViewSignaled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url NOTE: Because ClientViewSignaled events are signaled by the client, rather than the server, it's possible the event may not be logged by the server and therefore may not appear in the audit log. It's also possible that information in the audit record may not be trustworthy. However, because the user's identity is validated by the token used to create the signal, the user's identity listed in the corresponding audit record is accurate. |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
PageViewedExtended
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "PageViewedExtended" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
FolderCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderDeleted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaEliminata" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderMoved
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaMoved" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE
target.resource.resource_type is set to STORAGE_OBJECT |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName}
SourceRelativeUrl field not getting in log |
| DestinationRelativeUrl | DestinationRelativeUrl field not getting in log
target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | DestinationFileName field not getting in log
target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | src.file.full_path
target.file.full_path Extract SourceFileUrl is mapped to src_file_full_path TargetFileUrl is mapped to target_file_full_path grok is mapped to {SourceFileUrl}{src_file_full_path}{/SourceFileUrl}{TargetFileUrl}{target_file_full_path}{/TargetFileUrl} |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderRenamed
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CartellaRenamed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaModified" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderCopied
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Cartella copiata" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_COPY
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path |
| SourceRelativeUrl | src.file.full_path |
| DestinationRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| DestinationFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderRestored
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaRipristinad" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderDeletedFirstStageRecycleBin
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaDeletedFirstStageRecycleBin" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FolderDeletedSecondStageRecycleBin
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaDeletedSecondStageRecycleBin" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncDownloadedFull
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileSyncDownloadFull" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is set to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | src.file.size |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncDownloadedPartial
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileSyncDownloadPartial" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to src.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | src.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | src.file.size |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncUploadedFull
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileSyncUploadedFull" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | target.file.size |
| ImplicitShare | target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
FileSyncUploadedPartial
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileSyncUploadedPartial" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| FileSyncBytesCommitted | target.file.size |
| ImplicitShare | target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
ManagedSyncClientAllowed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ManagedSyncClientAllowed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_WRITTEN | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
UnmanagedSyncClientBlocked
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UnmanagedSyncClientBlocked" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
AddedToGroup
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AddedToGroup" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | target.group.group_display_name |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
GroupAdded
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "GroupAdded" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
GroupRemoved
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "GroupRemoved" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
WebRequestAccessModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "WebRequestAccessModified" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | if Name is RequestAccessEmail then NewValue is mapped to target.user.email_addresses or target.user.userid else target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
WebMembersCanShareModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "WebMembersCanShareModified" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| version | metadata.product_version |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
PermissionLevelModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PermissionLevelModified" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.resource.attribute.permissions.name
BasePermissions is mapped to target.resource.attribute.permissions.name |
| version | metadata.product_version |
| WebID | about.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SiteCollectionAdminAdded
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SiteCollectionAdminAdded" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ModifiedProperties | If Name is set SiteAdmin then NewValue is mapped to target.user.userid or target.user.email_addresses |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SiteCollectionAdminRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SiteCollectionAdminRemoved" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| ModifiedProperties | If Name is set SiteAdmin then NewValue is mapped to target.user.userid or target.user.email_addresses |
| AssertingApplicationId | about.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
PermissionLevelRemoved
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PermissionLevelRemoved" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.permissions.name |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
RemovedFromGroup
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RemovedFromGroup" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.group.group_display_name |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
GroupUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "GroupUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.referral_url |
| ModifiedProperties | if Name is Name then NewValue is mapped to target.group.group_display_name |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
ProjectCheckedOut
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ProjectCheckedOut" e il carico di lavoro "Project":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
ProjectAccessed
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ProjectAccessed" e il carico di lavoro "Project":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT |
|
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
SharingInheritanceBroken
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SharingInheritanceBroken" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SharingType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
AddedToSecureLink
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AddedToSecureLink" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| UniqueSharingId | target.labels.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ApplicationDisplayName | target.application |
CompanyLinkCreated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CompanyLinkCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| ApplicationDisplayName | target.application |
CompanyLinkUsed
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CompanyLinkUsed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
SecureLinkCreated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SecureLinkCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
SharingInvitationCreated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SharingInvitoCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Sharing level is mapped to target.resource.attribute.labels.key/value ExpirationDate is mapped totarget.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkDeleted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SecureLinkdeleted" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
RemovedFromSecureLink
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "RemovedFromSecureLink" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
SharingInvitationRevoked
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SharingInvitoRevocad" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path |
| SourceRelativeUrl | target.file.full_path |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkUpdated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SecureLinkUpdated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
SecureLinkUsed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SecureLinkUsed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| UniqueSharingId | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
SharingRevoked
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "condivisioneRevocad" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to STORAGE_OBJECT ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
SharingSet
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SharingSet" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_SYNC
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
PermissionLevelAdded
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PermissionLevelAdded" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.permissions.name
BasePermissions is mapped to target.resource.attribute.permissions.name |
SharingInvitationAccepted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SharingSendAccepted" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.name
Added to Group is mapped to target.resource.name |
SharingInvitationBlocked
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SharingInviteBlocked" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | security_result.summary
Reason is mapped to security_result.summary |
AccessRequestCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AccessRequestCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| EventData | target.resource.attribute.labels.key/value
Sharing level is mapped to target.resource.attribute.labels.key/value ExpirationDate is mapped totarget.resource.attribute.labels.key/value |
AnonymousLinkCreated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AnonimoLinkCreated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
| UniqueSharingId | target.labels.key/value |
AccessRequestUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AccessRequestUpdated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| ModifiedProperties | target.labels.key/value |
CompanyLinkRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CompanyLinkRemoved" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETIONObjectId is mapped to target.url | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
AccessRequestApproved
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AccessRequestApproved" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| WebId | about.labels.key/value |
| EventData | target.resource.name
Extract using grok grok { match is mapped to { EventData <Added to group>{target_resource_name}.* } } |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
AnonymousLinkRemoved
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AnonimoLinkRemoved" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| UniqueSharingId | target.labels.key/value |
| SiteUrl | network.http.referral_url
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type> } } Type is mapped to target.resource.attribute.labels.key/value |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| MachineId | target.asset.product_object_id |
AnonymousLinkUpdated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UnknownLinkUpdated" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ApplicationDisplayName | target.application |
| WebId | about.labels.key/value |
| UniqueSharingId | target.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
Extract using grok grok { match is mapped to { EventData <Type>{type_value}</Type><MembersCanShareApplied>{members_share_value}</MembersCanShareApplied> } } Type is mapped to target.resource.attribute.labels.key/value MembersCanShareApplied is mapped to target.resource.attribute.labels.key/value |
SharingInvitationUpdated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "condivisioneInvitoaggiornata" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| ApplicationDisplayName | target.application |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| event_type is mapped to USER_RESOURCE_ACCESS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| TargetUserOrGroupName | target.group.group_display_name
target.user.userid or target.user.email_addresses if TargetUserOrGroupType values like SecurityGroup or SharepointGroup then TargetUserOrGroupName is mapped to target.group.group_display_name if TargetUserOrGroupType values like Guest or Member then TargetUserOrGroupName is mapped to target.user.userid or target.user.email_addresses |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| SourceRelativeUrl | target.file.full_path is set to SourceRelativeUrl or SourceFileName |
| ApplicationDisplayName | target.application |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
AnonymousLinkUsed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AnonimoLinkUsed" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ResultStatus is Success Action is set to ALLOW security_result.summary is set to Group creation successful ResultStatus is Failure Action is set to BLOCK security_result.summary is set to Group creation failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is set to additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is set to extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.group.group_display_name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.group.group_display_name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group membership updated successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is set toGroup membership update failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product.object_id
target.group.group_display_name Group.ObjectId is mapped to target.group.product.object_id Group.DisplayName is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi membro al gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi membro al gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_CREATION
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if
else map |
| ModifiedProperties | security_result.summary
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Aggiungi utente
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Add user e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
Modifica licenza utente.
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Modifica licenza utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is Action Client Name then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Modifica password utente
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Modifica password utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group deletion successful ResultStatus is Failure then Action is set to BLOCK security_result.summary is set to Group deletion failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.group.group_display_name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.group.group_display_name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Elimina gruppo
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Elimina gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ResultStatus is Success then Action is set to ALLOW security_result.summary is set to Group membership updated successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is set to Group membership update failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product.object_id
target.group.group_display_name Group.ObjectId is mapped to target.group.product.object_id Group.DisplayName is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Rimuovi membro dal gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Rimuovi membro dal gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION
if status is Success then action ALLOW security_result.summary User deleted successfully |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is Action Client Name then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Elimina utente
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Delete user e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Aggiorna utente
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Update user e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GROUP_MODIFICATION
if |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
ModifiedProperties
|
security_result.detection_fields.key/value
If
If
If
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.group.group_display_name
If
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Aggiornamento gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiorna gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
If ResultStatus is Succeeded or ResultStatus is Success security_result.action is ALLOW security_result.summary is User login successful else if ResultStatus is Failed or LogonError !is security_result.action is BLOCK security_result.summary is User login failed security_result.description is {LogonError} UserId is mapped to target.user.userid or target.user.email_addresses metadata.description is User Login - {Workload} |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
extensions.auth.type extensions.auth.mechanism |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
| DeviceProperties | network.session_id
principal.platform principal.hostname If Name is OS { If Value is match to Windows then principal.platform is WINDOWS If Value is match to Mac then principal_plateform is MAC if Value is match to Linux then principal_plateform is LINUX } If Name is SessionId then Value is mapped to network.session_id If Name is OS then Value is mapped to principal.platform If Name is DisplayName then Value is mapped to principal.hostname |
| ErrorCode | security_result.description
security_result.description is set to ErrorCode - {ErrorCode} |
| LogonError | security_result.description |
UserLoggedIn
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UserLoggedIn" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
security_result.Action is set to BLOCK security_result.summary is User login failed |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
extensions.auth.type extensions.auth.mechanism If Name is RequestType and Value is match to Saml.* or OAuth2.* then extensions.auth.type is mapped to MACHINE If Name is RequestType and Value is match to Login.* then extensions.auth.type is mapped to REMOTE_INTERACTIVE If Name is UserAgent then Value is mapped to network.http.user_agent If Name is UserAuthenticationMethod then Based on Value it will map with extensions.auth.type If Name is requestType then Based on Value it will map with extensions.auth.type |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
| DeviceProperties | network.session_id
principal.platform principal.hostname If Name is OS { If Value is matched to Windows then principal.platform is WINDOWS If Value is matched to Mac then principal_plateform is MAC if Value is matched to Linux then principal_plateform is LINUX } If Name is SessionId then Value is mapped to network.session_id If Name is OS then Value is mapped to principal.platform If Name is DisplayName then Value is mapped to principal.hostname |
| ErrorCode | security_result.description
security_result.description is set to ErrorCode - {ErrorCode} |
| LogonError | security_result.description
If LogonError is UserAccountNotFound then extensions.auth.mechanism is set to USERNAME_PASSWORD |
UserLoginFailed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UserLoginFailed" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiorna timestamp StsrefreshTokenValidFrom
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Update StsUpdatedTokenValidFrom Timestamp" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summary If DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name is DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiorna dispositivo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiorna dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING Required fields for SETTING_MODIFICATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Configura le impostazioni di federazione sul dominio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Imposta le impostazioni di federazione sul dominio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZEDRequired fields for STATUS_UNCATEGORIZED UDM validation : principal.machineid (IP or hostname or assetId or mac etc).
ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Verifica dominio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Verifica dominio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Imposta informazioni aziendali
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Imposta informazioni aziendali" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Reimposta password utente
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Reimposta password utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.description
security_result.summary target.labels.key/value If Name is AccountEnabled then security_result.description is set to AccountEnabled - {NewValue} If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Disabilita account
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Disattiva account" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PASSWORD | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/valueIf Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Elimina la password dell'applicazione per l'utente
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Elimina la password dell'applicazione per l'utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name =DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Elimina dispositivo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Elimina dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent If Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name =DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 1 then ID is mapped to target.resource.name If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi utenti registrati al dispositivo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi utenti registrati al dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.nameIf Name is Device.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Device.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi al dispositivo il proprietario registrato
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi proprietario registrato al dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name If Name is Device.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Device.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi proprietario al gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi proprietario al gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product_object_id
target.group.group_display_nameIf Name is Group.ObjectId then NewValue is mapped to target.group.product_object_id If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi OAuth2PermissionGrant
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi OAuth2PermissionGrant" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summaryIf Name is ServicePrincipal.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is ServicePrincipal.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi dispositivo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is DEVICE ResultStatus is Success Action is set to ALLOW ResultStatus is Failure Action is set to BLOCK |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.resource.product_object_id
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetObjectId then Value is mapped to target.resource.product_object_id If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.ptatform_version security_result.description target.resource.name security_result.summaryIf DisplayName value present in ModifiedProperties field then we will map DisplayName with target.resource.name otherwise map ID of Target field if Type is 1. If Name is DeviceOSType then NewValue is mapped to target.platform If Name is DeviceOSVersion then NewValue is mapped to target.ptatform_version If Name is DevicePhysicalIds then NewValue is mapped to security_result.description If Name is DisplayName then NewVale is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi concessione dell'assegnazione del ruolo dell'app all'utente
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Aggiungi concessione di assegnazione del ruolo app all'utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSION
Workload is mapped to intermediary.application |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | target.application
network.http.user_agent target.resource.attribute.labels.key/value about.labels.key/value If Name is targetName then Value is mapped to target.application If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.user.userid or target.user.email_addresses
If Name is User.UPN then NewValue is mapped to target.user.userid or target.user.email_addresses |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Consenso alla richiesta
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Consenso all'applicazione" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.resource.name
target.user.userid or target.user.email_addresses security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiorna entità di servizio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiorna entità servizio" e carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.nameIf Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi entità di servizio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi entità servizio" e carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Rimuovi entità di servizio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Rimuovi entità servizio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.nameIf Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiungi membro al ruolo
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Add member to role e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | target.resource.product_object_id
if
If
if |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemsId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| TargetContextId | target.labels.key/value
|
| Version | metadata.product_version
|
Rimuovi membro dal ruolo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Rimuovi membro dal ruolo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ResultStatus is Success then Action is set to ALLOW security_result.summary is Removed a user to an admin role successfully ResultStatus is Failure then Action is set to BLOCK security_result.summary is Removed a user to an admin role failed |
|
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.user.attribute.roles.name if Name is Role.ObjectId then NewValue is target.resource.product_object_id If Name is Role.DisplayName then NewValue is target.user.attribute.roles.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
| event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value if Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Aggiungi etichetta
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi etichetta" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is set to target.resource.product_object_id |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemsId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses |
| TargetContextId | target.labels.key/value |
| Version | metadata.product_version |
Crea società
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Crea società" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
ObjectId is set to target.resource.product_object_id |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.labels.key/value |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
TeamsSessionStarted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TeamsSessionStarted" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleGroupAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ScheduleGroupAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_MODIFICATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleGroupEdited
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ScheduleGroupEdited" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_DELETION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleGroupDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ScheduleGroupDelete" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING Required fields for SETTING_CREATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
ShiftAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ShiftAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
ShiftEdited
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "ShiftEdited" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
ShiftDeleted
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "ShiftDelete" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
TimeOffAdded
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "TimeOffAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
TimeOffEdited
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TimeOffEdited" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| Shift | target.resource.attribute.labels.value |
TimeOffDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TimeOffdeleted" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "OpenShiftAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftEdited
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "OpenShiftEdited" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| OpenShift | target.resource.attribute.labels.key/value |
OpenShiftDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "OpenShiftDelete" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleShared
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ScheduleShared" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ClockedIn
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ClockedIn" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
BreakStarted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "BreakStarted" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
BreakEnded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "BreakEnded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.labels.key/value |
RequestAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RequestAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.label.key/value |
RequestRespondedTo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RequestResponseedTo" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
| ShiftRequest | target.resource.attribute.label.key/value |
RequestCancelled
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RequestAnnullata" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| ScheduleId | target.resource.product_object_id |
ScheduleSettingChanged
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ScheduleSettingChanged" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
TeamSettingChanged
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TeamSettingChanged" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
AppInstalled
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "AppInstallata" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| AddOnName | target.resource.name |
| Version | metadata.product_version |
| AppDistributionMode | about.labels.key/value |
| AzureADAppId | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TargetUserId | target.user.product_object_id |
MemberRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MemberRemoved" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
TabRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TabRemoved" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| AddOnName | target.resource.name |
| ChannelName | target.resource.attribute.labels.key/value |
| TeamName | target.group.group_display_name |
AppUninstalled
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "AppDisinstallaed" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| AddOnName | target.resource.name |
| Version | metadata.product_version |
| AppDistributionMode | about.labels.key/value |
| AzureADAppId | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TargetUserId | target.user.product_object_id |
MemberAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MemberAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| CommunicationType | about.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
TabAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TabAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| AddOnGuid | target.resource.product_object_id |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| AddOnName | target.resource.name |
| AddOnUrl | target.url |
| ChannelName | target.labels.key/value |
| TeamName | target.group.group_display_name |
ClockedOut
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ClockedOut" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
| AADGroupId | target.labels.key/value |
| ScheduleId | target.resource.product_object_id |
TeamCreated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TeamCreated" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.resource.product_object_id |
| TeamName | target.resource.name |
| Version | metadata.product_version |
BotAddedToTeam
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "BotAddedToTeam" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AddOnGuid | target.resource.product_object_id |
| AddOnName | target.resource.name |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ChannelAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ChannelAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ConnectorAdded
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ConnectorAdded" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ChannelSettingChanged
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ChannelSettingChanged" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
TeamsTenantSettingChanged
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TeamsTenantSettingChanged" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
MemberRoleChanged
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MemberRoleChanged" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name DisplayName is mapped to about.user.user_display_name Role is mapped to about.user.attribute.roles.name UPN is mapped to about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
DeletedAllOrganizationApps
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "deletedAllOrganizationApps" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ChannelDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Channeldeleted" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
TeamDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Teamdeleted" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.resource.product_object_id |
| TeamName | target.resource.name |
BotRemovedFromTeam
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "BotRemovedFromTeam" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ConnectorRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ConnectorRemoved" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
ConnectorUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ConnectorUpdated" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.email_addresses |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
TabUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TabUpdated" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AddOnGuid | target.labels.key/value |
| AddOnName | target.resource.name |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.labels.key/value |
| ChannelName | target.resource.attribute.labels.key/value |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| Members | about.user.userid or about.user.email_addresses
about.user.user_display_name about.user.attribute.roles.name |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| Name | target.resource.attribute.labels.key |
| NewValue | target.resource.attribute.labels.value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| TabType | target.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| AADGroupId | target.labels.key/value |
| AddOnUrl | target.url |
Aggiorna
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Aggiorna" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism
LogonType is 2 then mechanism is set to INTERACTIVE LogonType is 3 or 8 then mechanism is set to NETWORK LogonType is 4 then mechanism is set to BATCH LogonType is 5 then mechanism is set to SERVICE LogonType is 7 then mechanism is set to UNLOCK LogonType is 9 then mechanism is set to NEW_CREDENTIALS LogonType is 9 then mechanism is set to REMOTE_INTERACTIVE LogonType is 9 then mechanism is set to CACHED_INTERACTIVE else mechanism is set to MECHANISM_UNSPECIFIED |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Item | network.email.subject
target.resource.product_object_id target.resource.name target.file.size network.email.mail_id target.file.full_path Id is mapped to target.resource.product_object_id Subject is mapped to network.email.subject SizeInBytes is mapped to target.file.size Item.ParentFolder.Path is mapped to target.resource.name InternetMessageId is mapped to network.email.mail_id Attachments is mapped to target.file.full_path |
| ModifiedProperties | securiy_result.summary |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
FolderBind
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CartellaBind" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientRequestId | principal.labels.key/value |
| Item | target.resource.product_object_id
target_resource_name network.email.mail_id Item.id is mapped to target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.ParentFolder.Path is mapped to target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
SendOnBehalf
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SendOnBehalf" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id Item.InternetMessageId is mapped to network.email.email_id Item.Subject is mapped to network.email.subject Item.Attachments is mapped to target.file.full_path Item.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| SendOnBehalfOfUserSmtp | target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
SendAs
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SendAs" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SendAsUserMailboxGuid | about.labels.key/value |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.Subject is mapped to network.email.subject Item.Attachments is mapped to target.file.full_path Item.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| SendAsUserSmtp | target.user.userid or target.user.email_addresses |
| Version | metadata.product_version |
Invia
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Invia" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | network.email.subject
network.email.mail_id target.file.full_path target.resource.product_object_id |
| SessionId | network.session_id |
| Version | metadata.product_version |
Nuova-Posta in arrivoRule
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-Posta in arrivo" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING ObjectId is set to target.group.product_object_id |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SessionId | network.session_id |
| Version | metadata.product_version |
| Parameters | security_result.rule_labels.key/value |
| AppId | target.labels.key/value |
Imposta-Posta in arrivo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set- InboxRule" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
ObjectId is set to target.group.product_object_id target.resource.resource_type is set to SETTING |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | security_result.rule_labels.key/value |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
MoveToDeletedItems
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "MoveTodeletedItems" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| DestFolder | target.resource.product_object_id
target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id Subject is mapped to network.email.subject ParentFolder.Path is mapped to about.file.full_path AffectedItems.0.InternetMessageIdis mapped to network.email.mail_id |
| Folder | src.resource.product_object_id
src.resource.name |
| ClientRequestId | principal.labels.key/value |
| AppId | target.labels.key/value |
Sposta
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Sposta" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| DestFolder | target.resource.product_object_id
target.resource.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id |
| Folder | src.resource.product_object_id
src.resource.name |
MailItemsAccessed
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MailItemsAccessed" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| OperationProperties | security_result.detection_fields.key/value. |
| SessionId | network.session_id |
| Version | metadata.product_version |
| OperationCount | about.labels.key/value |
| AppId | target.labels.key/value |
| Folders | about.resource.name
about.resource.product_object_id network.email.mail_id Folders.Path is mapped to about.resource.name Folders.Id is mapped to about.resource.product_object_id Folders.0.FolderItems.0.InternetMessageId network_email_id |
MailboxLogin
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Casella di accesso" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_LOGIN
auth.Type is MACHINE |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| SessionId | network.session_id |
| Version | metadata.product_version |
SoftDelete
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SoftDelete" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id AffectedItems.Attachments is mapped to about.file.full_path AffectedItems.Subject is mapped to network.email.subject AffectedItems.0.InternetMessageIdis mapped to network.email.mail_id |
| Folder | target.resource.name
target.resource.product_object_id Folder.Path is mapped to target.resource.name Folder.Id is mapped to target.resource.product_object_id |
| SessionId | network.session_id |
| ClientRequestId | principal.labels.key/value |
| Version | metadata.product_version |
HardDelete
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Eliminazione definitiva" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| AffectedItems | about.file.full_path
network.email.subject network.email.mail_id |
| Version | metadata.product_version |
| ClientAppId | target.labels.key/value |
| AppId | target.labels.key/value |
| Folder | target.resource.name
target.resource.product_object_id |
Crea
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Crea" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.resource.name
target.resource.product_object_id target.file.full_path network.email.subject network.email.mail_id Item.id is mapped to target.resource.product_object_id Item.InternetMessageId is mapped to network.email.mail_id Item.ParentFolder.Path is mapped to target.resource.name Item.Subject is mapped to network.email.subject Attachment may present or not in log so write grok for this. Item.Attachments is mapped to target.file.full_path |
| SessionId | network.session_id |
| Version | metadata.product_version |
RemoveFolderPermissions
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RemoveCartellePermissions" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.resource.attribute.permissions.name target.user.email_addresses or target.user.userid Item.ParentFolder.MemberUpn is mapped to target.user.email_addresses or target.user.userid Item.ParentFolder.Path is mapped to target.file.full_path User rights is mapped to target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
ModifyFolderPermissions
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ModifiedfolderPermissions" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.user.email_addresses or target.user.userid target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
AddFolderPermissions
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AddCartellePermissions" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ResultStatus is Succeeded Action is set to ALLOW else Action is set to BLOCK |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| Item | target.file.full_path
target.user.email_addresses or target.user.userid target.resource.attribute.permissions.name Path is mapped to target.file.full_path Item.ParentFolder.MemberUpn is mapped to target.user.email_addresses or target.user.userid User Rights is mapped to target.resource.attribute.permissions.name |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
Rimozione-Casella di posta
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-CasellaPermission" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Aggiungi-Autorizzazione-cassetta postale
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Add-CreativePermission" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
| AppId | target.resource.attribute.labels.key/value |
| Parameters | security_result.detection_fields.key/value |
| ObjectId | target.resource.attribute.labels.key/value |
UpdateInboxRules
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Update InboxRules" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
| Item | target.resource.product_object_id
target.resource.name Item.ParentFolder.name is mapped to target.resource.name Item.ParentFolder.id is mapped to target.resource.product_object_id |
| OperationProperties | security_result.rule_id
security_result.rule_name security_result.detection_fields.key/value if Name is RuleId then Value is mapped to security_result.rule_id if Name is RuleName then Value is mapped to security_result.rule_name else security_result.detection_fields.key/value |
| ClientRequestId | principal.labels.key/value |
UpdateCalendarDelegation
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateCalendarDelegation" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is SERVICE_ACCOUNT |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
ApplyRecordLabel
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ApplyRecordLabel" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
UpdateFolderPermissions
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateCartellaPermissions" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to STORAGE_OBJECT |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
Imposta-utente
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-User" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION
ObjectId is set to target.user.userid or target.user.email_addresses |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| Version | metadata.product_version |
ViewReport
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ViewReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is mapped to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| ConsumptionMethod | target.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| DistributionMethod | about.labels.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.attribute.labels.key/value |
GenerateEmbedToken
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "GeneraEmbedToken" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| ConsumptionMethod | target.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| DistributionMethod | about.labels.key/value |
| ReportId | target.resource.attribute.labels.key/value |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| EmbedTokenId | target.resource.product_object_id |
| RLSIdentities | about.user.email_addresses
about.user.attribute.roles.name RLSIdentities.UserName is mapped to about.user.email_addresses RLSIdentities.Roles is mapped to about.user.attribute.roles.name |
CreateDataset
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CreateDataset" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
GenerateCustomVisualAADAccessToken
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "GeneraCustom VisualAADAccessToken" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| CustomVisualAccessTokenResourceId | target.resource.product_object_id |
| CustomVisualAccessTokenSiteUri | target.url |
DeleteOrganizationalGalleryItem
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteOrganizationGalleryItem" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
DeleteAlmPipeline
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteAlmPipeline" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
AddDatasourceToGateway
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AddDatasourceToGateway" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| GatewayId | target.resource.attribute.labels.key/value |
| GatewayType | target.labels.key/value |
| DatasourceId | target.resource.product_object_id |
| DatasourceType | target.resource.attribute.labels.key/value |
AssignWorkspaceToPipeline
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AssignWorkspaceToPipeline" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | principal.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | principal.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| DeploymentPipelineStageOrder | target.labels.key/value |
CancelDataflowRefresh
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CancelDataflowrefresh" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
ChangeCapacityState
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ChangeCapacityState" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CapacityName | target.resource.name |
| CapacityUsers | about.labels.key/value |
| CapacityState | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
ChangeGatewayAdministrators
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ChangeGateway Administrators" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.product_object_id |
| UserInformation | about.user.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
InsertOrganizationalGalleryItem
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "InsertOrganizationGalleryItem" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
CreateAlmPipeline
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CreateAlmPipeline" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| DeploymentPipelineId | target.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
CreateApp
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CreateApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
CreateDashboard
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
If IsSuccess is true then security_result.summary is Dashboard created successfully else security_result.summary is Dashboard not created |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
CreateDataflow
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CreateDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_CREATION
If IsSuccess is true then security_result.summary is Dataflow created successfully else security_result.summary is Dataflow not created |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DataflowType | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
CreateEmailSubscription
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateEmailSubscription" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
If IsSuccess is true then security_result.summary is EmailSubscription created successfully else security_result.summary is EmailSubscription not created ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| SubscriptionSchedule | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| SubscribeeInformation | network.email.to |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
CreateFolder
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateCartella" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| FolderDisplayName | target.resource.name |
| FolderObjectId | target.resource.attribute.labels.key/value |
CreateGateway
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateGateway" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| GatewayId | target.resource.product_object_id |
| GatewayType | target.labels.key/value |
CreateTemplateApp
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateTemplateApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
DeleteComment
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "DeleteComment" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| AuditedArtifactInformation | target.resource.name
target.resource.product_object_id target.resource.attribute.labels.key/value Name is mapped to target.resource.name ArtifactObjectId is set to target.resource.product_object_id AnnotatedItemType is mapped to target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
DeleteDashboard
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| DashboardName | target.resource.name |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| DistributionMethod | about.labels.key/value |
DeleteDataflow
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "DeleteDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
DeleteDataset
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "DeleteDataset" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
DeleteEmailSubscription
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteEmailSubscription" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_DELETION
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
DeleteFolder
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteCartella" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
if isSuccess is TRUE then security_result.action is set to ALLOW else security_result.action is set to BLOCK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
DeleteGateway
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteGateway" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
DeleteGroup
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteGroup" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.nameRecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
DeleteReport
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
DownloadReport
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "DownloadReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
EditDataset
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "EditDataset" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
EditDatasetProperties
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "EditDatasetProperty" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetCertificationStage | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
EditReport
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "EditReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| ReportId | target.resource.attribute.labels.key/value |
| ReportType | target.resource.attribute.labels.key/value |
ExportDataflow
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ExportDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
if isSuccess is TRUE then security_result.summary is Dataflow Exported Successfully else security_result.summary is Dataflow Not Exported |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| DataflowName | target.rsource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
ExportReport
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ExportReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
if isSuccess is TRUE then security_result.summary is Report Exported Successfully else security_result.summary is Report Not Exported |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| DatasetId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| LastRefreshTime | about.labels.key/value |
InstallApp
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "InstallApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
InstallTemplateApp
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "InstallTemplateApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppFolderObjectId | about.labels.key/value |
| TemplateAppOwnerTenantObjectId | principal.user.product_object_id |
| TemplateAppVersion | metadata.product_version |
| TemplateAppObjectId | target.resource.product_object_id |
| TemplatePackageName | target.resource.name |
PostComment
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "PostComment" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| AuditedArtifactInformation | target.resource.name
target.resource.product_object_id target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
PrintDashboard
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PrintDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZEDObjectId is set to target.file.full_path | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
PrintReport
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PrintReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
UnassignWorkspaceFromPipeline
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "UnassignWorkspaceFromPipeline" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| DeploymentPipelineId | target.resource.attribute.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
RemoveDatasourceFromGateway
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RemoveDatasourceFromGateway" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.attribute.label.key/value |
| DatasourceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
RenameDashboard
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "RenameDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is set to target.file.full_path |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
RequestDataflowRefresh
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RequestDataflowrefresh" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowRefreshScheduleType | target.labels.key/value |
| DataflowType | target.resource.attribute.label.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
RefreshDataset
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "refreshDataset" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RefreshType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
SensitivityLabelApplied
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SensitivityLabelApplied" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATIONtarget.resource.resource_type is set to SETTING | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| SensitivityLabelId | target.resource.product_object_id |
| ActionSourceDetail | principal.labels.key/value |
| LabelEventType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActionSourceDetail | principal.labels.key/value |
| ArtifactType | about.labels.key/value |
SensitivityLabelRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SensitivityLabelRemoved" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OldSensitivityLabelId | target.resource.product_object_id |
| ActionSource | principal.labels.key is set to ActionSource
principal.labels.value is set to {Value} |
| LabelEventType | target.labels.key/value |
| LastRefreshTime | about.labels.key/value |
| ActionSourceDetail | principal.labels.key/value |
| ArtifactType | about.labels.key/value |
SetScheduledRefreshOnDataflow
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SetScheduleUpdatesOnDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.label.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
SetScheduledRefresh
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SetScheduleUPDATE" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.rsource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| Schedules | target.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
ShareDashboard
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ShareDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| DashboardId | target.resource.product_object_id |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| SharingAction | about.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
ShareReport
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ShareReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| Datasets | about.resource.product_object_id
about.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| ArtifactId | target.resource.product_object_id |
| ArtifactName | target.resource.name |
| SharingAction | about.labels.key/value |
| ShareLinkId | about.labels.key/value |
OptInForProTrial
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "optInForProTrial" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UnpublishApp
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "unsubscribeApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkspaceId | target.resource.product_object_id |
| WorkSpaceName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateOrganizationalGalleryItem
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateOrganizationGalleryItem" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| OrganizationalGalleryItemId | target.resource.product_object_id |
| OrganizationalGalleryItemDisplayName | target.resource.name |
| OrganizationalGalleryItemPublishTime | target.resource.attribute.labels.key/value |
UpdateAlmPipelineAccess
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateAlmPipelineAccess" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DeploymentPipelineObjectId | target.resource.product_object_id |
| DeploymentPipelineDisplayName | target.resource.name |
| DeploymentPipelineAccesses | about.user.userid
about.user.attribute.permissions.name userid is mapped to about.user.userid Rolepermission is mapped to about.user.attribute.permissions.name |
UpdateInstalledTemplateAppParameters
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateInstallTemplateAppParameters" e il carico di lavoro "e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
| TemplatePackageName | target.resource.name |
| TemplateAppVersion | metadata.product_version |
| TemplateAppFolderObjectId | about.labels.key/value |
UpdatedAdminFeatureSwitch
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdatedAdminFeatureSwitch" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is mapped to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| SwitchState | about.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateApp
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateApp" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| WorkspaceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateDataflow
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateDatasetParameters
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateDatasetParameters" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.product_object_id |
| DataConnectivityMode | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| LastRefreshTime | about.labels.key/value |
UpdateEmailSubscription
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateEmailSubscription" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_MODIFICATION
target.resource.type is mapped to TASK |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| SubscriptionSchedule | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| SubscribeeInformation | network.email.to |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
UpdateFolder
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateCartella" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| FolderDisplayName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateFolderAccess
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateCartellaAccess" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| FolderObjectId | target.resource.product_object_id |
| FolderDisplayName | target.resource.name |
| FolderAccessRequests | about.user.userid
about.user.product_object_id about.user.attribute.permissions.type UserId is mapped to about.user.userid UserObjectId is set to about.user.product_object_id RolePermissions is mapped to about.user.attribute.permissions.type |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateDatasourceCredentials
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateDatasourceCredentials" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| GatewayId | target.resource.attribute.labels.key/value |
| DatasourceId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
UpdateTemplateAppSettings
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateTemplateAppSettings" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| ActivityId | principal.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
UpdateTemplateAppTestPackagePermissions
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateTemplateAppTestPackagePermissions" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| TemplateAppObjectId | target.resource.product_object_id |
ViewDashboard
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ViewDashboard" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ConsumptionMethod | target.labels.key/value |
| DistributionMethod | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| Datasets | about.resource.product_object_id
about.resource.name DatasetId is mapped to about.resource.product_object_id DatasetName is mapped to about.resource.name |
| DashboardId | target.resource.product_object_id |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DashboardName | target.resource.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
ViewDataflow
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ViewDataflow" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| CapacityId | about.labels.key/value |
| CapacityName | about.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DataflowId | target.resource.product_object_id |
| DataflowName | target.resource.name |
| DataflowType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
AddTile
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AddTile" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| TileText | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
RunEmailSubscription
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RunEmailSubscription" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCHEDULED_TASK_CREATION
target.resource.resource_type is TASK If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AppName | target.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.label.key/value |
| DashboardName | target.resource.name |
| WorkspaceId | target.resource.attribute.label.key/value |
| DashboardId | target.resource.product_object_id |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
CreateReport
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CreateReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| UserAgent | network.http.user_agent |
| WorkSpaceName | target.resource.attribute.label.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.label.key/value |
| DatasetId | target.resource.attribute.label.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| DistributionMethod | about.labels.key/value |
GetSnapshots
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "GetSnapshots" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
OptInForPPUTrial
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "optInForPPUTrial" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
Imposta-Utente-mail
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-MailUser" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Imposta contatto di posta
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-MailContact" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Imposta casella di posta
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-Casella" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
Object is mapped to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Imposta-DistributionGroup
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-DistributionGroup" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is Group members definition ResultStatus is True Action is set to ALLOW else Action is set to BLOCK |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
security_result.description target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is AcceptMessagesOnlyFromSendersOrMembers then Value is mapped to security_result.description else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Imposta contatto
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-Contact" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| Version | metadata.product_version |
Imposta-CASCasella di posta
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-CASCasella di posta" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to target.group.group_display_name |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| ModifiedObjectResolvedName | about.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Elaborazione-calendario
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-CalendarProcessing" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.user_display_name
If Name is ResourceDelegates then Value is mapped to target.user.user_display_name |
| SessionId | network.session_id |
| Version | metadata.product_version |
Set-AdminAuditLogConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-AdminAuditLogConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. ObjectId is mapped to target.url target.resource.resource_type is set to SETTING |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| ModifiedObjectResolvedName | about.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Rimuovi-UnifiedGroup
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-UnifiedGroup" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| Version | metadata.product_version |
Rimuovi utente migrazione
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove- MigrationUser" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION
ObjectId is set to target.user.userid or target.user.email_addresses |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.detection_fields.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
Aggiornamento-eDiscoveryCaseAdmin
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Update-eDiscoveryCaseAdmin" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-DistributionGroupMember
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-DistributionGroupMember" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
ViewedSearchExported
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ViewedSearchExported" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
AddWorkingSetQueryToWorkingSet
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AddWorkingSetQueryToWorkingSet" e del carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AddQueryToWorkingSet
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AddQueryToWorkingSet" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
RunAlgo
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RunAlgo" e il carico di lavoro "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AnnotateDocument
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AnnotateDocument" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
BurnJob
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "BurnJob" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
CreateWorkingSet
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateWorkingSet" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
CreateWorkingsetSearch
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateWorkingsetSearch" e il carico di lavoro "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
CreateTag
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateTag" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
DeleteWorkingsetSearch
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteWorkingsetSearch" e il carico di lavoro "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
DeleteTag
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DeleteTag" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
DownloadDocument
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "DownloadDocument" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
UpdateTag
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateTag" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
ExportJob
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ExportJob" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
UpdateCaseSettings
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateCaseSettings" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
UpdateWorkingsetSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "UpdateWorkingsetSearch" e il carico di lavoro "Compliance":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
TagFiles
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TagFiles" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
ViewDocument
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ViewDocument" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| CaseId | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| StartTime | target.resource.attribute.creation_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
SearchViewed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchViewed" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
If Name is SearchIds then Value is mapped to target.resource.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
CaseMemberAdded
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CaseMemberMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} Extract target_user information using grok grok { match is mapped to { Parameters .*-(Member|User) \{DATA:target_user}\ } } |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
SearchUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
CaseAdminUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CaseAdminUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | about.user.email_address
about.user.product_object_id If Name is CaseAdminsSmtp then Value is mapped to about.user.email_addresses if Name is CaseAdminsGuid then Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
CaseUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CaseUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_idIf Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
CaseMemberUpdated
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CaseMemberUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resrource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchPermissionUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchPermissionUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
HoldUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "holdUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
CaseAdminRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CaseAdminRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
target.user.email_address target.user.userid If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} target_user is mapped to target.user.email_addresses or target.user.userid |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
CaseRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CaseRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchPermissionRemoved
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchPermissionRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
HoldRemoved
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "holdRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
HoldCreated
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "holdCreated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchCreated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_detail |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
CaseAdminAdded
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CaseAdminAdded" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.prdouct_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchStarted
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchStarted" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
SearchReport
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchReport" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
SearchStopped
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchSSUFFIX" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
CaseViewed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CaseViewed" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_detail |
| ExtendedProperties | target.resource.product_object_id
about.user.email_addresses about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Nameis CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_detail |
| Query | security_result.description |
| SharepointLocations | security_result.category_detail |
SearchExportDownloaded
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "SearchExportscaricata" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
CaseMemberRemoved
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CaseMemberRemoved" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_id If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} Extract target_user information using grok grok { match is mapped to { Parameters .*-(Member|User) \{DATA:target_user}\ } } |
| Version | metadata.product_version |
CaseAdded
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "CaseAdded" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.user.email_address about.user.product_object_idIf Name is CaseId then ID is mapped to target.resource.product_object_id If Name is CaseMembersSmtp then each Value is mapped to about.user.email_addresses If Name is CaseMembersGuid then each Value is mapped to about.user.product_object_id |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
SearchPermissionCreated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchPermissionCreated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | principal.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
| Version | metadata.product_version |
NetworkConfigurationUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "NetworkConfigurationUpdated" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
ProcessProfileFields
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ProcessProfileFields" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
SupervisorAdminToggled
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SupervisorAdminToggled" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
NetworkSecurityConfigurationUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "NetworkSecurityConfigurationUpdated" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
FileCreated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "FileCreated" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATIONIf ResultStatus is TRUE {
security_result.action is ALLOW} else {security_result.action is BLOCK} |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
GroupCreation
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "GroupCreation" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
MessageDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Messagedeleted" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
GroupDeletion
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "GroupDeletion" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
DataExport
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "DataExport" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
FileVisited
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileVisited" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_READ
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
StreamInvokeVideoView
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamInvokeVideoView" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoShare
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoShare" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoLike
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoLike" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoUnLike
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoUnLike" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoUpload
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoUpload" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoDownload
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoDownload" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoSetLink
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamInvokeVideoSetLink" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateGroup
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamCreateGroup" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditGroup
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditGroup" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteGroup
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamDeleteGroup" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_DELETION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditGroupMemberships
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditGroupMemberships" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateChannel
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamCreateChannel" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditChannel
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamEditChannel" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteChannel
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamDeleteChannel" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeChannelSetThumbnail
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeChannelSetthumbnail" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | network.http.referral_url |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditVideoPermissions
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditVideoPermissions" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is Succeeded then action is ALLOW else action is BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditVideo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamEditVideo" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamDeleteVideo" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditUserSettings
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditUserSettings" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamEditAdminTenantSettings
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditAdminTenantSettings" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateVideoComment
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamCreateVideoComment" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideoComment
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamDeleteVideoComment" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoTextTrackUpload
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamInvokeVideoTextTrackUpload" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamDeleteVideoTextTrack
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamDeleteVideoTextTrack" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoThumbnailUpload
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideothumbnailUpload" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is Succeeded then action is ALLOW else action is BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamCreateVideo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamCreateVideo" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url_back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
DlpRuleMatch
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione DlpRuleMatch e il carico di lavoro Exchange/SharePoint/OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to EMAIL_TRANSACTION
|
|
| SharePointMetaData | network.http.referral_url
|
| ExchangeMetaData | network.email.from
|
| ExceptionInfo | about.labels.key/value
|
| PolicyDetails | target.resource.product_object_id
|
| IncidentId | about.labels.key/value
|
| Version | metadata.product_version
|
| Site | target.labels.key/value
|
| ItemType | target.resource.attribute.labels.key/value
|
| EventSource | principal.application
|
| SourceName | principal.labels.key/value
|
| UserAgent | network.http.user_agent
|
| MachineDomainInfo | target.asset.attribute.labels.key/value
|
| MachineId | target.asset.product_object_id
|
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
DlpRuleUndo
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DlpRuleAnnulla" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
security_result.category is set to DATA_EXFILTRATION ObjectId is set to network.email.mail_id |
|
| SharePointMetaData | network.http.referral_url
network.email.from target.file.full_path target.url target.file.size SiteCollectionUrl is mapped to network.http.referral_url From is mapped to network.email.from (if ExchangeMetadata field not getting in log) FileName is mapped to target.file.full_path FilePathUrl is mapped to target.url FileSize is mapped to target.file.size |
| ExceptionInfo | about.labels.key/value |
| PolicyDetails | target.resource.product_object_id
security_result.summary security_result.description security_result.rule_id security_result.rule_name security_result.severity PolicyId is mapped to target.resource.product_object_id PolicyName is mapped to security_result.summary SensitiveInformationTypeName is mapped to security_result.description RuleId is mapped to security_result.rule_id RuleName is mapped to security_result.rule_name Severity is mapped to security_result.severity |
| IncidentId | about.labels.key/value |
| Version | metadata.product_version |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
DlpInfo
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "DlpInfo" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
security_result.category is set to DATA_EXFILTRATION ObjectId is set to network.email.mail_id |
|
| SharePointMetaData | network.http.referral_url
network.email.from target.file.full_path target.url target.file.size SiteCollectionUrl is mapped to network.http.referral_url From is mapped to network.email.from (if ExchangeMetadata field not getting in log) FileName is mapped to target.file.full_path FilePathUrl is mapped to target.url FileSize is mapped to target.file.size |
| ExceptionInfo | about.labels.key/value |
| PolicyDetails | target.resource.product_object_id
security_result.summary security_result.description security_result.rule_id security_result.rule_name security_result.severity PolicyId is mapped to target.resource.product_object_id PolicyName is mapped to security_result.summary SensitiveInformationTypeName is mapped to security_result.description RuleId is mapped to security_result.rule_id RuleName is mapped to security_result.rule_name Severity is mapped to security_result.severity |
| IncidentId | about.labels.key/value |
| Version | metadata.product_version |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| EndpointMetaData.SensitiveInfoTypeData.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.Confidence | security_result.confidence_details |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Name | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Confidence | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.ClassifierType | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetailedClassificationAttributes.Count | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveTypeSource | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.UniqueCount | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInfoTypeId | security_result.detection_fields.key/value |
| EndpointMetaData.SensitiveInfoTypeData.SensitiveInformationDetectionsInfo.DetectedValues.Value | security_result.detection_fields.key/value |
MipLabel
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "MipLabel" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_UNCATEGORIZED
ObjectId is set to network.email.mail_id |
|
| ApplicationMode | about.labels.key/value |
| ItemName | network.email.subject |
| LabelAppliedDateTime | principal.labels.key/value |
| LabelId | target.resource.product_object_id |
| LabelName | target.resource.name |
| Receivers | network.email.to |
| Sender | network.email.from |
| Version | metadata.product_version |
SiteCollectionCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SiteCollectionCreated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value |
| EventData | target.resource.name |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
| Version | metadata.product_version |
SiteDeleted
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Sitedeleted" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | src.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationFileExtension | target.file.mime_type |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| MachineId | target.asset.product_object_id |
PreviewModeEnabledSet
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "PreviewModeEnabledSet" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is mapped to SETTING |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
OfficeOnDemandSet
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "OfficeOnDemandSet" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteJoined
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "HubSitejoined" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
target.resource.attribute.labels.key/value PreviousHubSiteIdis mapped to target.resource.attribute.labels.key/value HubSiteIdis mapped to target.resource.attribute.labels.key/value IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteRegistered
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "HubSite Registered" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
target.resource.attribute.labels.key/value HubSiteIdis mapped to target.resource.attribute.labels.key/value IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteUnjoined
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "HubSiteUnjoined" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectID is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value
IsHubSiteIdis mapped to target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
HubSiteUnregistered
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "HubSiteUnregistered" e il carico di lavoro "HubSiteUnregistered":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
ObjectID is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| EventData | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
SharingPolicyChanged
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SharingPolicyChanged" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| AssertingApplicationId | about.labels.key/value |
| ModifiedProperties | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
NetworkAccessPolicyChanged
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "NetworkAccessPolicyChanged" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.ip
target.labels.key/value if Name is IPAddressAllowList then NewValue is mapped to target.ip else target.labels.key/value |
| Site | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
AlertEntityGenerated
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione " AlertEntityUGC" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AlertTriggered
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione " AlertTriggered" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
AlertUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione " AlertUpdated" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT
security_result.category is set to DATA_EXFILTRATION |
|
| AlertId | target.resource.product_object_id |
| AlertType | target.resource.attribute.labels.key/value |
| Name | security_result.summary |
| PolicyId | target.labels.key/value |
| Status | target.resource.attribute.labels.key/value |
| Severity | security_result.severity |
| Category | security_result.category_details |
| Source | security_result.description |
| Comments | about.labels.key/value |
| Data | about.labels.key/value |
| AlertEntityId | target.user.userid or target.user.email_addresses |
| EntityType | target.resource.attribute.labels.key/value |
| Version | metadata.product_version |
Recupero della richiesta di conformità
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceCase" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Ottieni-CaseholdPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-CaseholdPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Rimuovi-CaseholdPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-CaseholdPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Imposta-CaseCaseholdPolicy
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Set-CaseholdPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Nuova-CaseholdRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-CaseholdRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Rimuovi-CaseholdRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-CaseholdRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Imposta-CaseholdRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-CaseholdRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Get-ComplianceSearchAction
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceSearchAction" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Nuova richiesta di conformità
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceCase" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.name |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Rimuovi-ComplianceCase
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceCase" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Imposta-conformità
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ComplianceCase" e il carico di lavoro "Set-ComplianceCase":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Aggiungi-ComplianceCaseMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Add-ComplianceCaseMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-ComplianceCaseMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceCaseMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Update-ComplianceCaseMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Update-ComplianceCaseMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
New-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Start-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Start-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Stop-ComplianceSearch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Stop-ComplianceSearch" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
New-ComplianceSearchAction
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceSearchAction" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-ComplianceSearchAction
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceSearchAction" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Nuovo-filtro sicurezza-conformità
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceSecurityFilter" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-Filtro-Sicurezza-Conformità
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceSecurityFilter" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-ComplianceSecurityFilter
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ComplianceSecurityFilter" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Aggiunta-eDiscoveryCaseAdmin
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Add-eDiscoveryCaseAdmin" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Rimuovi-eDiscoveryCaseAdmin
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-eDiscoveryCaseAdmin" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_DELETION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.user.email_addresses target.user.userid |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Nuovo-CaseCaseholdPolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New-CaseholdPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Recupero AadProtectionLevel
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-AadProtectionLevel" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Recupero-AutoSensitivityLabelPolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-AutoSensitivityLabelPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Recupero-DlpSensitiveInformationType
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-DlpSensitiveInformationType" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Ottieni etichetta
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-Label" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-LabelPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-LabelPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
Get-PolicyConfig
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-PolicyConfig" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Version | metadata.product_version |
ValidaterbacAccessCheck
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ConvalidarbacAccessCheck" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| AadAppId | target.labels.key/value |
| DataType | security_result.description |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| Version | metadata.product_version |
ApplicableAdaptiveScopeChange
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ApplyAdaptiveScopeChange" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.resource.product_object_id
If Name is AssociatedAdaptiveScopeIds then Value is target.resource.product_object_id |
| CorrelationId | security_result.detection_fields |
| ObjectType | security_result.summary |
NewComplianceTag
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "NewComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
NewRetentionComplianceRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "NewFidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
NewRetentionCompliancePolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "NewFidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_CREATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
RemoveComplianceTag
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "RemoveComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/valueIf Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
RemoveRetentionCompliancePolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RemoveKeepCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetComplianceTag
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SetComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is LabelName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetRetentionComplianceRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SetFidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING Required fields for SETTING_MODIFICATION UDM validation : principal.machineid (IP or hostname or assetId or mac etc). ClientIP field is mandatory field for all the office 365 activities as per official doc of Office 365, but in some cases ClientIP field is absent If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
SetRetentionCompliancePolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SetFidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATIONtarget.resource.resource_type is set to SETTING
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
Get-CsTeamsUpgradeOverridePolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-CsTeamsUpgradeOverridePolicy" e il carico di lavoro "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | security_result.description
If Name is Tenant then Value is mapped to tenate_value If Name is Identity then Vale is mapped to identity_value security_result.description is Tenant = {tenate_value} / Identity = {identity_value} |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
TeamsAdminAction
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "TeamsAdminAction" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_CHANGE_PERMISSIONS
If ResultStatus is Succeeded then Action is set to ALLOW If ResultStatus is Failed then Action is set to BLOCK |
|
| AdminActionDetail | security_result.summary |
| ClientApplication | network.http.user_agent |
| ExtraProperties | additional.fields.key/value.string_value |
| UserClaims | security_result.description |
| Version | metadata.product_version |
Update-DistributionGroupMember
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Update-DistributionGroupMember" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| ClientVersion | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.description
target.group.product_object_id or target.group.email_addresses target.group.attribute.labels.key/value If Name is Members then Value is mapped to security_result.description If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
| Version | metadata.product_version |
SupervisoryReviewOLAudit
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SupervisoryReviewOLAudit" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
extract auditscore form ResultStatus using ResultStatus .*?Score:{auditScore} and map with security_result.confidenece_details is {auditScore} security_result.confidence will map based on auditScore |
|
| LogonType | extensions.auth.mechanism |
| InternalLogonType | about.labels.key/value |
| MailboxGuid | target.labels.key/value |
| MailboxOwnerUPN | target.user.email_addresses or target.user.userid |
| MailboxOwnerSid | target.user.windows_sid |
| MailboxOwnerMasterAccountSid | target.labels.key/value |
| LogonUserSid | principal.user.windows_sid |
| LogonUserDisplayName | principal.user.user_display_name |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientInfoString | network.http.user_agent |
| ClientIPAddress | principal.ip and principal.port |
| ClientMachineName | principal.hostname |
| ClientProcessName | principal.process.file.full_path |
| ClientVersion | metadata.product_version |
| ExchangeDetails | network.direection
network.email.from network.email.mail_id network.email.to network.email.subject If Directionality is Incoming then network.direction is mapped to INBOUND If Directionality is Outgoining then network.direction is mapped to OUTBOUND From is mapped to network.email.from InternetMessageId is mapped to network.email.mail_id Recipients is mapped to network.email.to Subject is mapped to network.email.subject |
| Version | metadata.product_version |
CrmDefaultActivity
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CrmDefaultActivity" e il carico di lavoro "CRM":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| CrmOrganizationUniqueName | principal.resource.name |
| InstanceUrl | target.url |
| ItemUrl | principal.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| Fields | about.labels.key/value |
| EntityId | principal.labels.key/value |
| EntityName | principal.labels.key/value |
| Message | security_result.summary |
| Query | security_result.description |
| PrimaryFieldValue | about.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| QueryResults | about.labels.key/value |
| ServiceContextId | principal.labels.key/value |
| ServiceContextIdType | about.labels.key/value |
| ServiceName | principal.application |
| SystemUserId | principal.labels.key/value |
| Version | metadata.product_version |
TIMailData
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "TIMailData" e il carico di lavoro "ThreatIntelligence":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to EMAIL_TRANSACTION
ObjectId is set to metadata.product_log_id |
|
| AttachmentData | about.file.full_path
about.file.mime_type about.file.sha256 security_result.category_details AttachmentData.FileName is mapped to about.file.full_path AttachmentData.FileType is mapped to about.file.mime_type AttachmentData.SHA256 is mapped to about.file.sha256 AttachmentData.FileVerdict is 0 then AttachmentData.MalwareFamily is mapped to security_result.category_details |
| DetectionType | security_result.summary |
| DetectionMethod | security_result.description |
| InternetMessageId | about.labels.key/value |
| NetworkMessageId | about.labels.key/value |
| P1Sender | principal.user.email_addresses |
| P2Sender | network.email.from |
| Policy | security_result.rule_name |
| PolicyAction | security_result.action
PolicyAction is Quarantine then action is set to QUARANTINE PolicyAction is MoveToJmf then action is set to ALLOW_WITH_MODIFICATION |
| Recipients | network.email.to |
| SenderIp | src.ip |
| Subject | network.email.subject |
| Verdict | security_result.category |
| MessageTime | target.resource.attribute.labels.key/value |
| EventDeepLink | metadata.url_back_to_product |
| DeliveryAction | about.labels.key/value |
| OriginalDeliveryLocation | about.labels.key/value |
| LatestDeliveryLocation | about.labels.key/value |
| Directionality | network.direction |
| ThreatsAndDetectionTech | about.labels.key/value |
| AdditionalActionsAndResults | about.labels.key/value |
| Connectors | about.labels.key/value |
| AuthDetails | about.labels.key/value |
| PhishConfidenceLevel | about.labels.key/value |
| Version | metadata.product_version |
SearchMtpStatus
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchMtpStatus" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| Version | metadata.product_version |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
RemovedFromSiteCollection
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "RemovedFromSiteCollection" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| TargetUserOrGroupType | target.group.group_display_name
target.user.userid target.user.email_addresses |
| WebId | about.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ApplicationDisplayName | target.application |
CommentsDisabled
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione " commentsDisabled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| SourceRelativeUrl | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| WebId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
FileRecycled
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileRecycled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
CommentsEnabled
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione " commentsEnabled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | if ObjectId field is not present in log then
target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| ApplicationDisplayName | target.application |
FolderRecycled
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "CartellaRecycled" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_DELETION
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
FileTranscriptRequested
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileTranscriptRequested" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
WACTokenShared
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "WACTokenShared" e il carico di lavoro "SharePoint/OneDrive":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| ListItemUniqueId | principal.asset_id |
| ListId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application |
| SiteUrl | network.http.referral_url |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceFileExtension | target.file.mime_type |
| UserSharedWith | target.labels.key/value |
| SharingType | target.labels.key/value |
| SensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value. |
| WebId | about.labels.key/value |
Aggiorna etichetta
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiorna etichetta" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
SiteLocksChanged
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SiteLocksChanged" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteIBModeSet
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SiteIBModeSet" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| ModifiedProperties | target.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteDesignInvoked
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SiteDesignInvoked" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| EventData | target.resource.attribute.labels.key/value
SiteDesignId is mapped to target.resource.attribute.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteContentTypeCreated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SiteContentTypeCreated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| ListTitle | about.labels.key/value |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SiteCollectionQuotaModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SiteCollectionQuotaModified" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING ObjectId is mapped to target.url |
|
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
ShortcutAdded
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ScorciatoiaAdded" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATIONObjectId is mapped to target.url | |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| Site | target.labels.key/value |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceName | principal.labels.key/value |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
SPOIBIsEnabled
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SPOIBIsEnabled" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
WebAccessRequestApproverModified
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "WebAccessRequestApprovarModified" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ModifiedProperties | target.labels.key/value
if Name is RequestAccessEmail then NewValue is mapped to target.user.email_addresses or target.user.userid else target.labels.key/value |
Set-TransportConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-TransportConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| AppId | target.labels.key/value |
| Parameters | principal.user.email_addresses
principal.user.userid If Name is Identity then Valueis mapped toprincipal.user.email_addresses or principal.user.userid |
Set-TenantObjectVersion
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "Set-TenantObjectVersion" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value
If Name is DomainController then Value is mapped to target.administrative_domain else target.labels.key/value |
Criteri di provisioning Set-RecipientEnforcementProvisioning
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Set-RecipientEnforcementProvisioningPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Set-PolicyConfig
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-PolicyConfig" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
target.resource.resource_type is set to ACCESS_POLICY |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-OwaCasellaPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-OwaCasellaPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Imposta-Casella di posta
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-CasellaPlan" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Imposta-Proprietà Etichetta
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Set-LabelProperty" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
Imposta-etichetta
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-Label" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Set-ExchangeAssistanceConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ExchangeAssistanceConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.url
target.labels.key/value If Name is PrivacyStatementURL then Value is mapped to target.url else target.labels.key/value |
Criterio di accesso condizionale impostato
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ConditionalAccessPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.labels.key/value If Name is DisplayName then Value is mapped to target.resource.name else target.labels.key/value |
| SessionID | network.session_id |
Nuovo-ConditionalAccessPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ConditionalAccessPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.labels.key/value If Name is DisplayName then Value is mapped to target.resource.name else target.labels.key/value |
| SessionID | network.session_id |
RemovedSearchReport
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RemovedSearchReport" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Recupero-PrivacyManagementPolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-PrivacyManagementPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
Criterio di conformità della conservazione
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-FidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| Parameters | target.process.command_line |
SearchTrialOffer
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchTrialOffer" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchTIKustoClusterInformation
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchTIKustoClusterInformation" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchMtpRoleInfo
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchMtpRoleInfo" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchMailflowForwardingData
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchMailflowForwardingData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchDataInsightsSubscription
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchDataInsightsSubscription" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchCustomerInsight
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchCustomerInsight" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchConnectorReportData
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchConnectorReportData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertAggregate
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchAlertAggregate" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlert
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchAlert" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Enable-AddressListPaging
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Enable-AddressListPaging" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Installa-AdminAuditLogConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Install-AdminAuditLogConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
AccessedAggregates
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AccessedAggregates" e il carico di lavoro "Mip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| DataType | security_result.description |
| version | metadata.product_version |
AccessedSiteList
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AccessedSiteList" e il carico di lavoro "Mip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| DataType | security_result.description |
| version | metadata.product_version |
Install-DataClassificationConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Install-DataClassificationConfig" e carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Imposta-UnifiedGroup
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-UnifiedGroup" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. if ResultStatus is TRUE then security_result.action is set to ALLOW else security_result.action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | network.application_protocol
target.user.email_addresses target.group.email_addresses If Name is EmailAddresses then extract value of Value, then emails and mail_key from that Value field, email_addresses with target.user.email_addresses, mail_key with network.email.mail_id If Name is ExternalEmailAddress then extract value of Value field, then extract protocol and emails from it, map protocol with network.application_protocol and emails with target.group.email_addresses. Protocol is mapped to network.application_protocol EmailAddresses is mapped to target.user.email_addresses ExternalEmailAddress is mapped to target.group.email_addresses |
| SessionId | network.session_id |
ApplicableAdaptivePolicyChange
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "EnforceAdaptivePolicyChange" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | security_result.detection_fields.key/value.
target.resource.product_object_id if Name is CorrelationId then Name is mapped to security_result.detection_fields.key/value. if Name is AssociatedAdaptivePolicyIds then AssociatedAdaptivePolicyIds is mapped to target.resource.product_object_id |
| ObjectType | security_result.summary |
Get-AppFidelizzazioneComplianceRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-AppFidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{:target_resource_product_object_id}\ } } |
New-AppOwnerComplianceRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-AppFidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| ClientRequestId | principal.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name target.resource.product_object_id Extract Policy and Name using grok Name is mapped to target.resource.name Policy is mapped to target.resource.product_object_id |
| StartTime | target.resource.attribute.creation_time |
Nuova norma di conservazione delle app
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-AppFidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| ClientRequestId | principal.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| StartTime | target.resource.attribute.creation_time |
Impostazione della norma di conservazione delle app
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Set-AppFidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| StartTime | target.resource.attribute.creation_time |
Criteri di condivisione predefiniti per l'installazione
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Install-DefaultSharingPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Installazione-ResourceConfig
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Install-ResourceConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Nuova-cassetta della posta
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Nuova-cassetta postale" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZEDObjectId is mapped to target.url | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
Aggiungi-autorizzazioneCasella-cassetta-Casella
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Add-CasellaCartellaPermission" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.user.user_display_name target.user.attribute.permissions.name target.labels.key/value If Name is Identity then Value is mapped to target.resource.name If Name is User then Value is mapped to target.user.user_display_name If Name is AccessRights then Value is mapped to target.user.attribute.permissions.name else target.labels.key/value |
Nuovo-LabelPolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-LabelPolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to ACCESS_POLICY |
|
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Nuova etichetta
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-Label" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name |
| StartTime | target.resource.attribute.creation_time |
| UserServicePlan | principal.labels.key/value |
Ricevi-Activityalert
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Get-Activityalert" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Ricevi-Protection Alert
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Get-ProtectionAlert" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
SearchComplianceCase
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchComplianceCase" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Rimuovi-Tag di conformità
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-ComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Rimuovi-App ConservationCompliancePolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-AppOwnerCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource_resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Rimuovi-conformità di conservazione
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-FidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource_resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nuovo tag-conformità
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Enable-ComplianceTagStorage
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Enable-ComplianceTagStorage" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ComplianceComplianceEventType
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceComplianceEventType" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AggregateActivityData
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AggregateActivityData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Tag-Conformità
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-ComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-FilePlanPropertyProperty
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Get-FilePlanPropertyProperty" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
New-ComplianceComplianceEventType
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ComplianceComplianceEventType" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is mapped to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line
target.resource.name target_resource_name is mapped to target.resource.name |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-DlpSensitiveInformationTypeRulePackage
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-DlpSensitiveInformationTypeRulePackage" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Recupero-ConformitàFidelizzazioneEvent
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceComplianceEvent" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
ComplianceSecurityFilter
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ComplianceSecurityFilter" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-Quarantena
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get- pianoMessage" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AggregateThreatProfileDetails
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AggregateThreatProfileDetails" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Recupero-DlpDetectionsReport
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-DlpDetectionsReport" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| ClientApplication | principal.application |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| Parameters | target.process.command_line |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Recupero-AppFidelizzazioneCompliancePolicy
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-AppFidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Aggiungi-RoleGroupMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Add-RoleGroupMember" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
Aggiornamento-RoleGroupMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Update-RoleGroupMember" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| SessionId | network.session_id |
Nuovo gruppo di ruoli
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-RoleGroup" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| SessionId | network.session_id |
| ClientAppId | target.labels.key/value |
Provisioning-ComplianceCasella di posta
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione " provision-ComplianceComplianceCartella" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.product_object_id
target.labels.key/value need to discuss mapping of MultiStageReviewFolderSetting in parameter fields If Name is FolderName then Value is mapped to target.resource_product_object_id else target.labels.key/value |
Rimuovi-cassetta postale
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Rimuovi-cassetta postale" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.name
target.labels.key/value If Name is Identity then Value is mapped to target.resource.name else target.labels.key/value |
New-QuarantePolicy
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New- pianoPolicy" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| ClientVersion | metadata.product_version |
| version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.resource.name
target.labels.key/value If Name is Name then Value is mapped to target.resource.name All other parameters will map with target.labels.key/value |
| SessionId | network.session_id |
Get-RoleGroup
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-RoleGroup" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True { Action is set to ALLOW } else { Action is set to BLOCK } |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses else target.group.attribute.labels.key/value |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
SearchLabelAnalyticsActivityData
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchLabelAnalyticsActivityData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Criterio di conformità Recupero
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-DlpCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| UserServicePlan | principal.labels.key/value |
SearchSecurityRedirection
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchSecurity Redirection" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Get-ComplianceCaseMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceCaseMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
HoldViewed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "holdViewed" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.category_details |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is HoldId then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Get-eDiscoveryCaseAdmin
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-eDiscoveryCaseAdmin" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-RoleGroupMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-RoleGroupMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Recupero-Ruolo di gestione
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ManagementRole" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Imposta-gruppo di ruoli
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-RoleGroup" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.group.group_display_name
target.process.command_line Extract DisplayName using grok Name is mapped totarget.group.group_display_name |
| Version | metadata.product_version |
| ResultCountSecurityComplianceCenterEventType | about.labels.key/value |
Get-SecurityPrincipal
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-SecurityPrincipal" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-CaseholdRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-CaseholdRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
ViewedSearchReport
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ViewedSearchReport" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| Case | metadata.description |
| ExchangeLocations | security_result.summary |
| ExtendedProperties | target.resource.product_object_id
about.labels.key/value If Name is CaseId then ID is mapped to target.resource.product_object_id If Name is SearchIds then ID is mapped to about.labels.key/value |
| ObjectType | security_result.summary |
| PublicFolderLocations | security_result.category_details |
| Query | security_result.description |
| SharepointLocations | security_result.category_details |
Recupero-AdaptiveScope
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-AdaptiveScope" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Criteri di conformità della conservazione
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-FidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nuova norma di conformità alla conservazione
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-FidelizzazioneCompliancePolicy" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
target.resource.resource_type is set to ACCESS_POLICY |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nuova regola-conformità di conservazione
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-FidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Get-ComplianceTag
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-ComplianceTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Set-FidelizzazioneComplianceRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Set-FidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Interfaccia utente di conformità per la conformità alle normative
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-RegulatoryComplianceUI" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Recupero-ComplianceRule
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Get-FidelizzazioneComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line
target.resource.product_object_id Extract Policy using grok grok { match is mapped to { Parameters .*-Policy \{target_resource_product_object_id}\ } } |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Nuovo-AdaptiveScope
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-AdaptiveScope" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.resource.name
target.process.command_line Extract Name using grok Name is mapped to target.resource.name |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Abilita-AdaptiveScopeStorage
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Enable-AdaptiveScopeStorage" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
SearchCustomTag
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchCustomTag" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | about.labels.key/value |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Interfaccia utente per la conformità alle normative
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-RegulatoryComplianceUI" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | target.process.command_line |
| Version | metadata.product_version |
RemoveRetentionComplianceRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "RemoveTransparencyComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | If Name is CmdletOptions then store value of Value in process_args variable.
If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} The name and value for the parameters that were used with the corresponding cmdlet. |
| Version | metadata.product_version |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
| ObjectType | security_result.summary |
NewAdaptiveScope
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "NewAdaptiveScope" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Parameters | principal.process.command_line
The name and value for the parameters that were used with the corresponding cmdlet. If Name is CmdletOptions then store value of Value in process_args variable. If Name is Cmdlet then store value of Value in process_value variable. then map principal.process.command_line is {process_value} {process_args} |
| Version | metadata.product_version |
| ObjectType | security_result.summary |
| ExtendedProperties | target.user.user_display_name
target.resource.name security_result.description target.resource.attribute.labels.key/value If Name is CreatedBy then Value is mapped to target.user.user_display_name If Name is PolicyName then Value is mapped to target.resource.name If Name is Description then Value is security_result.description If Name is RetentionAction or WorkLoad or LabelName then target.resource.attribute.labels.key/value |
CommentCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CommentCreated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| WebId | about.labels.key/value |
| SourceFileExtension | target.file.mime_type |
| SiteUrl | network.http.referral_url |
| SourceFileName | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| SourceRelativeUrl | target.file.full_path is set to {SourceRelativeUrl}/{SourceFileName} |
| CommentId | about.labels.key/value |
DeviceAccessPolicyChanged
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "DeviceAccessPolicyChanged" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | metadata.product_version |
| CorrelationId | security_result.detection_fields.key/value. |
| ModifiedProperties | target.labels.key/value |
HeartBeat
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "HeartBeat" e il carico di lavoro "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| Version | metadata.product_version |
MessageCreation
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MessageCreation" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
| MessageID | target.resource.product_object_id |
ThreadViewed
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ThreadViewed" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
| ThreadID | about.labels.key/value |
StreamEditAdminGlobalRoleMembers
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamEditAdminGlobalRoleMembers" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION
if ResultStatus is SUCCEEDED then action is set to ALLOW else action is set to BLOCK |
|
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeGetTextTrack
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeGetTextTrack" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeChannelView
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "StreamInvokeChannelView" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeVideoMakePublic
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeVideoMakePublic" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
StreamInvokeGroupView
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeGroupView" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Imposta-CsOnlineDirectoryTenant
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Set-CsOnlineDirectoryTenant" e il carico di lavoro "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
Impostazione-CriterioCsHostedMessaggio vocale
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Set-CsHostedSpeechPolicy" e il carico di lavoro "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.administrative_domain
target.url target.labels.key/value If Name is Organization then Value is mapped to target.administrative_domain If Name is Destination then Value is mapped to target.url else target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
Get-CSSimpleUrlConfiguration
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-CSSimpleUrlConfiguration" e il carico di lavoro "SkypeForBusiness":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| CmdletVersion | metadata.product_version |
| Parameters | target.administrative_domain
target.labels.key/value If Name is Organization then Value is mapped to target.administrative_domain else target.labels.key/value |
| SkypeForBusinessEventType | about.labels.key/value |
| TenantName | target.resource.product_object_id |
| Version | metadata.product_version |
New-ExchangeAssistanceConfig
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New-ExchangeAssistanceConfig" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
Nuova app
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Nuova app" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.labels.key/value |
| SessionId | network.session_id |
PublishToWebReport
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "publishToWebReport" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| ReportName | target.resource.name |
| WorkspaceId | target.resource.attribute.labels.key/value |
| DatasetId | target.resource.attribute.labels.key/value |
| ReportId | target.resource.product_object_id |
| ReportType | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| DistributionMethod | about.labels.key/value |
UpdateGateway
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "UpdateGateway" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| SwitchState | about.labels.key/value |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
| RequestId | about.labels.key/value |
| GatewayId | target.resource.product_object_id |
ShareDataset
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ShareDataset" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| WorkspaceId | target.resource.attribute.labels.key/value |
| ArtifactId | target.resource.product_object_id |
| ArtifactName | target.resource.name |
| RequestId | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| SharingAction | about.labels.key/value |
GetRefreshablesAsAdmin
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "GetAggiornaablesAsAdmin" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| RequestId | about.labels.key/value |
| UserAgent | network.http.user_agent |
| ActivityId | principal.labels.key/value |
CreateTagJob
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "CreateTagJob" e il carico di lavoro "Conformità":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| CaseID | target.resource.product_object_id |
| CaseName | target.resource.name |
| EndTime | target.resource.attribute.last_update_time |
| ExtendedProperties | target.resource.attribute.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
Aggiungi concessione di autorizzazioni delegate
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Add delegated permission grant e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | target.resource.product_object_id
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If |
| TargetContextId | target.labels.key/value
|
Aggiungi assegnazione del ruolo app all'entità servizio
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Aggiungi assegnazione del ruolo app all'entità servizio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summary If Name is ServicePrincipal.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is ServicePrincipal.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiorna applicazione
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiornamento dell'applicazione" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiornamento dell'applicazione - Gestione di certificati e secret
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Update application – Certificates and secrets management e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
if |
|
| Version | metadata.product_version
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
|
| TargetContextId | target.labels.key/value
|
Aggiungi proprietario all'applicazione
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi proprietario all'applicazione" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name security_result.summaryIf Name is Application.ObjectId then NewValue is mapped to target.resource.product_object_id If Name is Application.DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.labels.key/value |
| TargetContextId | target.labels.key/value |
Aggiungi all'applicazione
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi all'applicazione" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiungi configurazione dispositivo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi configurazione dispositivo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiungi dominio non verificato
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi dominio non verificato" e carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is Name then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
Aggiungi criterio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi criterio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Version | metadata.product_version |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.name
security_result.summary If Name is DisplayName then NewValue is mapped to target.resource.name If Name is Included Updated Properties then NewValue is mapped to security_result.summary |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | security_result.detection_fields.key/value |
| TargetContextId | target.labels.key/value |
CreateResponse
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "CreateResponse" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
EditForm
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "EditForm" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
SubmitResponse
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SubmitResponse" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
ViewResponses
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ViewResponses" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
ViewRuntimeForm
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ViewRuntimeForm" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
DeleteFlow
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "DeleteFlow" e il carico di lavoro "MicrosoftForms":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION | |
| FormsUserTypes | target.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
ListViewed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ListViewed" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| ItemCount | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| TemplateTypeId | about.labels.key/value |
ListColumnUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ListColumnUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListContentTypeUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ListContentTypeUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListItemDeleted
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ListItemdeleted" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "ListUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ApplicationDisplayName | target.application |
| ItemCount | target.labels.key/value |
ListItemCreated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ListItemCreated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ItemCount | target.labels.key/value |
ListColumnCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "ListColumnCreated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| TemplateTypeId | about.labels.key/value |
| ItemCount | target.labels.key/value |
SiteContentTypeUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SiteContentTypeUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
ListItemViewed
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ListItemViewed" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| ItemCount | target.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListItemUniqueId | principal.asset_id |
ListItemUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ListItemUpdated" e il carico di lavoro "SharePoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
ObjectId is mapped to target.url |
|
| Site | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| EventSource | principal.application |
| SourceName | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| MachineDomainInfo | target.asset.attribute.labels.key/value |
| MachineId | target.asset.product_object_id |
| Version | medata.product_version |
| CorrelationId | security_result.detection_fields.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| WebId | about.labels.key/value |
| target.file.size | target.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListItemUniqueId | principal.asset_id |
FileRenamed
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "FileRenamed" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_MOVE | |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileType | target.resource.attribute.labels.key/value |
| PreviousFileName | src.file.full_path |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
UpdatePowerApp
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UpdatePowerApp" e il carico di lavoro "PowerApps":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| AppName | target.labels.key/value |
| Id | metadata.product_log_id |
SubscribedToMessages
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione " SubscribedToMessage" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| ExtraProperties | additional.fields.key/value.string_value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessageCreatedNotification
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "MessageCreatedNotification" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| MessageVersion | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessageUpdatedNotification
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MessageUpdatedNotification" e al carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| MessageVersion | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessageCreatedHasLink
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "MessageCreatedHasLink" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MessagesListed
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MessageListed" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| ChannelGuid | target.resource.product_object_id |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| OperationScope | about.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
PerformedCardAction
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "PerformedCardAction" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| AddOnGuid | target.labels.key/value |
| AddOnName | target.labels.key/value |
| AddOnType | target.labels.key/value |
| ChannelGuid | target.resource.product_object_id |
| ChannelName | target.resource.name |
| ChannelType | target.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| CommunicationType | about.labels.key/value |
| TeamGuid | target.user.group_identifiers and target.group.product_object_id |
| TeamName | target.group.group_display_name |
| Version | metadata.product_version |
MessageEditedHasLink
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "MessageEditedHasLink" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| MessageId | target.resource.product_object_id |
| MessageURLs | target.resource.attribute.labels.key/value |
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| SubscriptionId | target.resource.attribute.labels.key/value |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| OperationScope | about.labels.key/value |
| Version | metadata.product_version |
MeetingParticipantDetail
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "MeetingPARTICIPANTDetails" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Attendees | about.resource.product_object_id
about.user.product_object_id about.user.attribute.roles.name OrganizationId is mapped to about.resource.product_object_id Role is mapped to about.user.attribute.roles.name UserObjectId is set to about.user.product_object_id |
| ExtraProperties | additional.fields.key/value.string_value |
| JoinTime | target.resource.attribute.creation_time |
| LeaveTime | target.resource.attribute.last_update_time |
| MeetingDetailId | target.resource.product_object_id |
| Version | metadata.product_version |
MeetingDetail
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MeetingDetails" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| StartTime | target.resource.attribute.creation_time |
| EndTime | target.resource.attribute.last_update_time |
| ExtraProperties | additional.fields.key/value.string_value |
| MeetingURL | target.url |
| MessageId | target.resource.product_object_id |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| Modalities | security_result.summary |
| Organizer | principal.user.product_object_id |
| Version | metadata.product_version |
MessageUpdated
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MessageUpdated" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| ExtraProperties | additional.fields.key/value.string_value |
| MessageVersion | target.resource.attribute.labels.key/value |
| MessageId | target.resource.product_object_id |
| ChatThreadId | target.user.group_identifiers
target.group.product_object_id |
| CommunicationType | about.labels.key/value |
| Version | metadata.product_version |
AggregateTransportQueueData
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AggregateTransportQueueData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AuthorizeCustomerInsight
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AutorizzaCustomerInsight" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AuthorizeConnectorReportData
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "AutorizzaConnectorReportData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertOverride
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchAvvisiOverride" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AuthorizeMailflowForwardingData
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AutorizzaMailflowForwardingData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchDomainTrafficStatus
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchDomainTrafficStatus" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertActivity
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SearchalertActivity" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AggregateMailmetadata
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AggregateMailmetadata" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
InsightGenerated
La tabella seguente elenca i campi di log e le mappature UDM corrispondenti per l'operazione "InsightUGC" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| Category | security_result.category_details |
| Description | security_result.description |
| InsightId | target.resource.product_object_id |
| Name | target.resource.name |
| Version | metadata.product_version |
UserSubmission
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UserSubmission" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCAN_UNCATEGORIZED
security_result.category is MAIL_SPAM |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| ClientApplication | principal.application |
| KesMailId | network.email.mail_id |
| ExtendedProperties | security_result.rule_name
security_result.rule_id security_result.category_details SubmissionSource is mapped to security_result.rule_name SubmissionId is mapped to security_result.rule_id SubmissionCategory is mapped to security_result.category_details |
| P1SenderDomain | principal.administrative_domain |
| Recipients | network.email.to |
| SenderIP | principal.ip |
| Subject | network.email.subject |
| P2Sender | network.email.from |
| SubmissionState | security_result.summary |
| P1Sender | principal.user.email_addresses |
| Version | metadata.product_version |
SaveRoleGroupMember
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SaveRoleGroupMember" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AggregateCampaignIntelligenceData
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "AggregateCampaignIntelligenceData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchEmailTimelineEvents
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchEmailTimelineEvents" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
SearchAlertStory
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "SearchAlertStory" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
AggregateThreatDetailsBulk
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "AggregateThreatDetailsbulk" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
Recupera utente
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-User" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
Recupero-DlpComplianceRule
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Get-DlpComplianceRule" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
AnalyzedByExternalApplication
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "AnalyzedByExternalApplication" e il carico di lavoro "Power BI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to RESOURCE_READ | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.name |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.attribute.labels.key/value |
| SwitchState | about.labels.key/value |
| ActivityId | principal.labels.key/value |
| UserAgent | network.http.user_agent |
| RequestId | about.labels.key/value |
New-MigrazioneBatch
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "New- MigrationBatch" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.resource.name
target.administrative_domain target.resource.attribute.key/value If Name is Name then Value is mapped to target.resource.name if Name is TargetDeliveryDomain then Value is mapped to target.administrative_domain If Name is AutoStart then Value is mapped to target.resource.attribute.key/value If Name is AutoComplete then Value is mapped to target.resource.attribute.key/value |
| SessionId | network.session_id |
UserSubmissionTriage
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "UserSubmissionTriage" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SCAN_UNCATEGORIZED
security_result.category is set to MAIL_SPAM |
|
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | about.labels.key/value |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| ExtendedProperties | security_result.rule_name
security_result.rule_id security_result.category_details SubmissionSource is mapped to security_result.rule_name SubmissionId is mapped to security_result.rule_id SubmissionCategory is mapped to security_result.category_details |
| GradingResult | security_result.category_details |
| KesMailId | network.email.mail_id |
| P1Sender | principal.user.email_addresses |
| P1SenderDomain | principal.administrative_domain |
| P2Sender | network.email.from |
| Recipients | network.email.to |
| SenderIP | principal.ip |
| Subject | network.email.subject |
| SubmissionState | security_result.summary |
FileArchived
La tabella seguente elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileArchiviato" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
FileCreatedOnNetworkShare
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FileCreatedOnNetworkShare" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATION | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
FileCreatedOnRemovableMedia
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileCreatedOnRemovableMedia" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_CREATION | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
SlimFilePrinted
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "SlimFilePrinted" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
target.asset.type is PRINTER |
|
| Application | target.application |
| DeviceName | target.hostname |
| FileType | target.resource.attribute.labels.key/value |
| TargetPrinterName | target.asset.hostname |
| Version | metadata.product_version |
FilePrinted
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "FilePrinted" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
target.asset.type is PRINTER |
|
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetPrinterName | target.asset.hostname |
| Version | metadata.product_version |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| PreviousFileName | src.file.full_path |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
ArchiveCreated
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "ArchiveCreated" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
FileDownloadedFromBrowser
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "FileDownloadFromBrowser" e il carico di lavoro "Endpoint":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT | |
| Application | target.application |
| DestinationLocationType | target.labels.key/value |
| DeviceName | target.hostname |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
| TargetFilePath | target.file.full_path |
| Version | metadata.product_version |
Crea password applicazione per l'utente
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Crea password applicazione per l'utente" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
security_result.detection_fields.key/value If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
SearchNdrDetailData
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "SearchNdrDetailsData" e il carico di lavoro "SecurityComplianceCenter":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GENERIC_EVENT | |
| StartTime | target.resource.attribute.creation_time |
| ClientRequestId | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| UserServicePlan | principal.labels.key/value |
| Parameters | target.process.command_line
target.resource.product_object_id |
| ClientApplication | principal.application |
| Version | metadata.product_version |
| SecurityComplianceCenterEventType | about.labels.key/value |
| AadAppId | target.labels.key/value |
| DatabaseType | target.resource.attribute.labels.key/value |
| DataType | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
MessageUpdated
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "MessageUpdated" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT
If ResultStatus is TRUE then action is ALLOW else action is BLOCK |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
Accesso
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Accesso" e il carico di lavoro "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is set to target.file.full_path |
|
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| DataState | security_result.summary |
| Version | metadata.product_version |
Scopri
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Discover" e il carico di lavoro "Aip":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS
ObjectId is set to target.file.full_path |
|
| Common | target.resource.product_object_id
target.resource.name target.process.command_line target.hostname metadata.product_version ApplicationId is mapped to target.resource.product_object_id ApplicationName is mapped to target.resource.name ProcessName is mapped to target.process.command_line DeviceName is mapped to target.hostname ProductVersion is mapped to metadata.product_version |
| DataState | security_result.summary |
| Version | metadata.product_version |
TIUrlClickData
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "TIUrlClickData" e il carico di lavoro "ThreatIntelligence":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| AppName | target.application |
| AppVersion | metadata.product_version |
| EventDeepLink | metadata.url_back_to_product |
| SourceId | AppName is Mail then SourceId is mapped to network.email.id |
| Url | target.url |
| UserIp | principal.ip |
| Version | metadata.product_version |
Dispositivo non più gestito
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Dispositivo non più gestito" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_DELETION
target.resource.resource_type is set to DEVICE |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.asset.product_object_id
target.platform If Name is TargetId.DeviceId then NewValue is mapped to target.asset.product_object_id If Name is TargetId.DeviceOSType then NewValue is mapped to target.platform |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
AirInvestigationData
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "AirInvestigationData" e il carico di lavoro "AirInvestigation":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SYSTEM_AUDIT_LOG_UNCATEGORIZED
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| LastUpdateTimeUtc | target.resource.attribute.last_update_time |
| Status | security_result.summary |
| InvestigationId | target.resource.product_object_id |
| InvestigationType | target.resource.attribute.labels.key/value |
| Data | security_result.description
security_result.category_details network.email.to network.email.from network.email.mail_id network.email.subject network.direction principal.ip principal.administrative_domain principal.user.email_addresses Data.Description is mapped to security_result.description Data.Category is mapped to security_result.category_details Data.Entities.1.Recipient is mapped to network.email.to Data.Entities.1.Sender is mapped to network.email.from Data.Entities.1.InternetMessageId is mapped to network.email.mail_id Data.Entities.1.Subject is mapped to network.email.subject Data.Entities.1.AntispamDirection is mapped to network.direction Data.Entities.1.SenderIP is mapped to principal.ip Data.Entities.1.P1SenderDomain is mapped to principal.administrative_domain Data.Entities.1.P1Sender is mapped to principal.user.email_addresses |
| InvestigationName | target.resource.name |
| StartTimeUtc | target.resource.attribute.creation_time |
| Version | metadata.product_versionn |
| DeepLinkUrl | metadata.url_back_to_product |
Set-CasellaJunkEmailConfiguration
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Set-CasellaJunkEmailConfiguration" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| OriginatingServer | principal.hostname |
| OrganizationName | target.administrative_domain |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| Parameters | target.user.email_addresses
If Name is BlockedSendersAndDomains then Value is mapped to target.user.email_addresses (all email addresses comes as ; separated) |
| SessionId | network.session_id |
| Version | metadata.product_version |
Nuovo-DistributionGroup
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New-DistributionGroup" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_CREATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name security_result.description target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is ManagedBy then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.user_display_name If Name is Member then Value is mapped to security_result.description else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
Add-DistributionGroupMember
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Add-DistributionGroupMember" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION
ObjectId is set to target.group.group_display_name security_result.summary is set to Group Members definition If ResultStatus is True then Action is set to ALLOW else Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.group.product_object_id or target.group.email_addresses
target.user.product_object_id or target.user.email_addresses or target.user.user_display_name target.group.attribute.labels.key/value If Name is Identity then Value is mapped to target.group.product_object_id or target.group.email_addresses If Name is Member then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid else target.group.attribute.labels.key/value |
| SessionId | network.session_id |
Rimuovi-Posta in arrivo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove- InboxRule" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_DELETION
target.resource.resource_type is set to SETTING ObjectId is set to target.group.product_object_id |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | security_result.rule_labels.key/value |
| SessionId | network.session_id |
Abilita-cassetta postale
La seguente tabella elenca i campi di log e le mappature UDM corrispondenti per l'operazione "Abilita-cassetta postale" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_CREATION | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
target.resource.attribute.labels.key/value If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid if Name is Archive then Value is mapped to target.resource.attribute.labels.key/value |
| SessionId | network.session_id |
Importa
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Importa" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to FILE_UNCATEGORIZED | |
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | target.user.email_addresses
target.user.attribute.permission.name We map this field based on value of UpdateApp Operation value. recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | about.user.email_addresses
about.user.user_display_name about.user.product_object_id about.user.attribute.permissions.name RecipientEmail is mapped to about.user.email_addresses RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| SwitchState | about.labels.key/value |
| ImportSource | about.labels.key/value |
| ImportType | target.file.mime_type |
| ImportDisplayName | target.file.full_path |
Dispositivo non più conforme
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Dispositivo non più conforme" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
target.resource.resource_type is set to DEVICE |
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.platform
target.resource.product_object_id If Name is TargetId.DeviceId then NewValue is mapped to target.resource.product_object_id If Name is TargetId.DeviceOSType then NewValue is mapped to target.platform |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Abilita account
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Enable account e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS
|
|
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value
|
| ExtendedProperties | network.http.user_agent
If
if else
|
| ModifiedProperties | security_result.summary
If
If
If
If |
| Actor | security_result.detection_fields.key/value
|
| ActorContextId | principal.labels.key/value
|
| ActorIpAddress | principal.ip and principal.port
|
| InterSystemsId | target.resource.attribute.labels.key/value
|
| IntraSystemId | target.resource.attribute.labels.key/value
|
| SupportTicketId | about.labels.key/value
|
| Target | target.user.userid or target.user.email_addresses
If else
|
| version | metadata.product_version
|
| TargetContextId | target.labels.key/value
|
Aggiungi credenziali entità di servizio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi le credenziali dell'entità di servizio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Imposta-Utente-Sincronizzazione
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "Set-SyncUser" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid |
| SessionId | network.session_id |
MessageSent
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "MessageSent" e il carico di lavoro "MicrosoftTeams":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE
If ClientIP field is absent then metadata.event_type is mapped to GENERIC_EVENT. |
|
| MessageSizeInBytes | target.resource.attribute.labels.key/value |
| ChannelGuid | target.labels.key/value |
| OperationScope | about.labels.key/value |
| TeamGuid | target.user.group_identifiers
target.group.product_object_id |
| TeamName | target.group.group_display_name |
| AADGroupId | target.labels.key/value |
| CommunicationType | about.labels.key/value |
| MessageId | target.resource.product_object_id |
| Version | metadata.product_version |
| MessageVersion | target.resource.attribute.labels.key/value |
Rimuovi le credenziali dell'entità di servizio
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Rimuovi le credenziali dell'entità di servizio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | security_result.summary
target.labels.key/value If Name is Included Updated Properties then NewValue is mapped to security_result.summary else target.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Rimuovi-SpostaRequest
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Remove-MoveRequest" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | target.user.product_object_id or target.user.email_addresses or target.user.user_display_name
target.resource.attribute.labels.key/value If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid If Name is ExecutingIdentity then Value is mapped to target.resource.attribute.labels.key/value |
StreamInvokeGetTranscript
Nella tabella seguente sono elencati i campi di log e i mapping UDM corrispondenti per l'operazione "StreamInvokeGetTranscript" e il carico di lavoro "MicrosoftStream":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_COMMUNICATION | |
| ClientApplicationId | principal.labels.key/value |
| EntityPath | metadata.url.back_to_product |
| OperationDetails | metadata.description |
| ResourceTitle | target.resource.name |
| ResourceUrl | target.url |
| Version | metadata.product_version |
Rimuovi proprietario dal gruppo
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Rimuovi proprietario dal gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_MODIFICATION | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.group.product_object_id
target.group.group_display_nameIf Name is Group.ObjectID then NewValue is mapped to target.group.product_object_id If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Aggiungi assegnazione ruolo app al gruppo
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Aggiungi assegnazione del ruolo app al gruppo" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | network.http.user_agent
target.resource.attribute.labels.key/value about.labels.key/value If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | target.resource.product_object_id
target.resource.name target.group.group_display_name If Name is AppRole.Id then NewValue is mapped to target.resource.product_object_id If Name is AppRole.DisplayName then NewValue is mapped to target.resource.name If Name is Group.DisplayName then NewValue is mapped to target.group.group_display_name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
Disabilita-Utente-mail
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "Disable-MailUser" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_UNCATEGORIZED
ResultStatus is True Action is set to BLOCK |
|
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | If Name is Identity then Value is mapped to target.user.product_object_id or target.user.email_addresses or target.user.userid |
Nuova richiesta di spostamento cartella
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "New-CartellaMoveRequest" e il carico di lavoro "Exchange":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to STATUS_UPDATE | |
| Version | metadata.product_version |
| AppId | target.labels.key/value |
| ClientAppId | target.labels.key/value |
| OrganizationName | target.administrative_domain |
| OriginatingServer | principal.hostname |
| Parameters | If Name is Name then Value is mapped to target.resource.name
If Name is DomainController then Value is mapped to target.administrative_domain If Name is Folders then Value is mapped to target.resource.attribute.labels.key/value |
Aggiungi proprietario alle norme
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "Aggiungi proprietario al criterio" e il carico di lavoro "AzureActiveDirectory":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS | |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| ExtendedProperties | If Name is additionalDetails then extract User-Agent is mapped to network.http.user_agent
if Name is extendedAuditEventCategory then target.resource.attribute.labels.key/value else about.labels.key/value |
| ModifiedProperties | If Name is Policy.ObjectID then NewValue is mapped to target.resource.product_object_id
If Name is Policy.DisplayName then NewValue is mapped to target.resource.name |
| Actor | security_result.detection_fields.key/value |
| ActorContextId | principal.labels.key/value |
| ActorIpAddress | principal.ip and principal.port |
| InterSystemsId | target.resource.attribute.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| SupportTicketId | about.labels.key/value |
| Target | target.user.userid or target.user.email_addresses
If Type is 5 then ID is mapped to target.user.userid or target.user.email_addresses else security_result.detection_fields.key/value |
| version | metadata.product_version |
| TargetContextId | target.labels.key/value |
EditContentProviderProperties
Nella tabella seguente sono elencati i campi del log e le mappature UDM corrispondenti per l'operazione "EditContentProviderProperty" e il carico di lavoro "PowerBI":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to SETTING_MODIFICATION
target.resource.resource_type is set to SETTING |
|
| AppName | target.labels.key/value |
| DashboardName | target.resource.attribute.labels.key/value |
| DataClassification | target.labels.key/value |
| DatasetName | target.resource.attribute.labels.key/value |
| OrgAppPermission | We map this field based on value of UpdateApp Operation value.
recipients is mapped to target.user.email_addresses permissions is mapped to target.user.attribute.permissions.name |
| ReportName | target.resource.attribute.labels.key/value |
| SharingInformation | RecipientEmail is mapped to about.user.email_addresses
RecipientName is mapped to about.user.user_display_name ObjectId is set to about.user.product_object_id ResharePermission is mapped to about.user.attribute.permissions.name |
| WorkSpaceName | target.resource.name |
| WorkspaceId | target.resource.product_object_id |
| SwitchState | about.labels.key/value |
| ContentProviderCertificationStage | security_result.summary |
| AppId | target.labels.key/value |
| RequestId | about.labels.key/value |
ReportingAccessed
Nella tabella seguente sono elencati i campi di log e le mappature UDM corrispondenti per l'operazione "ReportingAccessed" e il carico di lavoro "Project":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to USER_RESOURCE_ACCESS | |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| Version | metadata.product_version |
| Action | security_result.description |
| OnBehalfOfResId | about.labels.key/value |
GroupAccessFailure
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione "GroupAccessFailure" e il carico di lavoro "Yammer":
| Log field | UDM mapping |
|---|---|
| metadata.event_type is mapped to GROUP_UNCATEGORIZED | |
| ActorUserId | principal.user.email_addresses
principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| DataExportType | target.resource.attribute.labels.key/value |
| FileId | target.resource.product_object_id |
| FileName | target.file.full_path |
| GroupName | target.group.group_display_name |
| IsSoftDelete | security_result.description is set to IsSoftDelete - {IsSoftDelete} |
| MessageId | target.resource.product_object_id |
| YammerNetworkId | principal.labels.key/value |
| TargetUserId | target.user.email_addresses |
| TargetYammerUserId | target.labels.key/value |
| VersionId | about.labels.key/value |
| Version | metadata.product_version |
FileSensitivityLabelChanged
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione FileSensitivityLabelChanged e il carico di lavoro SharePoint/OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_UNCATEGORIZED
|
|
| AppAccessContext.CorrelationId | security_result.detection_fields.key/value |
| CorrelationId | security_result.detection_fields.key/value |
| DestinationFileExtension | target.file.mime_type |
| DestinationFileName | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationRelativeUrl | target.file.full_path is set to {DestinationRelativeUrl}/{DestinationFileName} |
| DestinationLabel | target.labels |
| EventSource | principal.application |
| HighPriorityMediaProcessing | about.labels |
| IsManagedDevice | about.labels |
| ItemType | target.resource.attribute.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ListServerTemplate | security_result.detection_fields.key/value |
| SensitivityLabelEventData.ActionSource | principal.labels.key/value |
| SensitivityLabelEventData.LabelEventType | target.labels.key/value |
| SensitivityLabelEventData.OldSensitivityLabelId | target.resource.product_object_id |
| SensitivityLabelEventData.OldSensitivityLabelOwnerEmail | security_result.detection_fields.key/value |
| SensitivityLabelEventData.SensitivityLabelId | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | src.file.mime_type |
| SourceFileName | src.file.full_path = %{SourceRelativeUrl}/%{SourceFileName} |
| SourceRelativeUrl | src.file.full_path = %{SourceRelativeUrl}/%{SourceFileName} |
| SourceLabel | src.labels.key/value |
| UserAgent | network.http.user_agent |
| UserKey | target.labels |
| Version | metadata.product_version |
| WebId | about.labels.key/value |
FileRead
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione FileRead e il carico di lavoro Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_READ
|
|
| Application | principal.application |
| DeviceName | target.hostname |
| DlpAuditEventMetadata.DlpPolicyMatchId | security_result.detection_fields.key/value |
| DlpAuditEventMetadata.EvaluationTime | security_result.detection_fields.key/value |
| EnforcementMode | target.labels |
| FileExtension | target.file.mime_type |
| FileSize | target.file.size |
| FileType | target.resource.attribute.labels.key/value |
| Hidden | security_result.detection_fields.key/value |
| JitTriggered | security_result.detection_fields.key/value |
| MDATPDeviceId | security_result.detection_fields.key/value |
| PolicyMatchInfo | target.resource.product_object_id
|
| RMSEncrypted | security_result.detection_fields.key/value |
| SensitiveInfoTypeData | security_result.detection_fields.key/value
|
| SensitivityLabelEventData.SensitivityLabelId | security_result.detection_fields.key/value |
| Sha1 | target.file.sha1 |
| Sha256 | target.file.sha256 |
| SourceLocationType | principal.labels.key/value |
MessageReadReceiptReceived
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione MessageReadReceiptReceived e il carico di lavoro MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE |
|
| ChatThreadId | target.user.group_identifiers
|
| CommunicationType | about.labels.key/value |
| MessageId | target.resource.product_object_id |
| MessageVersion | target.resource.attribute.labels.key/value |
| MessageVisibilityTime | target.resource.attribute.labels.key/value |
| ParticipantInfo.HasForeignTenantUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasGuestUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasOtherGuestUsers | security_result.detection_fields.key/value |
| ParticipantInfo.HasUnauthenticatedUsers | security_result.detection_fields.key/value |
| ParticipantInfo.ParticipatingTenantIds | security_result.detection_fields.key/value |
Ricerca
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Search e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UNCATEGORIZED |
|
| AadAppId | target.labels.key/value |
| RelativeUrl | target.url |
| ResultCount | target.labels.key/value |
| Version | metadata.product_version |
| DataType | security_result.description |
TaskDeleted
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskDeleted e il carico di lavoro MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_DELETION
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
TaskUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskUpdated e il carico di lavoro MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_WRITTEN
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
TaskCreation
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskCreation e il carico di lavoro MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_CREATION
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
SecurityGroupModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione SecurityGroupModified e il carico di lavoro Project:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GROUP_MODIFICATION |
|
| CorrelationId | security_result.detection_fields.key/value |
| Entity | metadata.product_name |
| EventSource | principal.application |
| ItemType | target.resource.attribute.labels.key/value |
| UserAgent | network.http.user_agent |
| UserKey | target.labels |
| Version | metadata.product_version |
| AppAccessContext.UniqueTokenId | target.labels |
| AppAccessContext.CorrelationId | security_result.detection_fields.key/value |
LaunchPowerApp
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione LaunchPowerApp e il carico di lavoro PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GENERIC_EVENT |
|
| AppName | target.labels.key/value
|
| Version | metadata.product_version |
DeleteDatasetRows
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione DeleteDatasetRows e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_DELETION.
If
else |
|
| UserAgent | network.http.user_agent
|
| WorkSpaceName | target.resource.attribute.labels.key/value
|
| DatasetName | target.resource.attribute.labels.key/value
|
| WorkspaceId | target.resource.attribute.labels.key/value
|
| DatasetId | target.resource.product_object_id
|
| DataConnectivityMode | target.resource.attribute.labels.key/value
|
| ArtifactId | target.resource.attribute.labels.key/value
|
| RequestId | about.labels.key/value
|
| ActivityId | principal.labels.key/value
|
| TableName | target.resource.attribute.labels.key/value
|
| LastRefreshTime | about.labels.key/value
|
| ArtifactKind | target.resource.attribute.labels.key/value
|
Nuovo-DlpCompliancePolicy
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione New-DlpCompliancePolicy e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
Nuova regola-DlpCompliance
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione New-DlpComplianceRule e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
Norme sul rischio dell'insider
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Get-InsiderRiskPolicy e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| ClientApplication | principal.labels.key/value
|
| CmdletVersion | metadata.product_version
|
| EffectiveOrganization | target.administrative_domain
|
| ObjectId | target.resource.product_object_id
|
| Parameters | target.process.command_line
|
| SecurityComplianceCenterEventType | about.labels.key/value
|
| StartTime | target.resource.attribute.creation_time
|
| UserKey | target.labels
|
| UserServicePlan | principal.labels.key/value
|
| Version | metadata.product_version
|
Imposta-HostedContentFilterPolicy
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Set-HostedContentFilterPolicy e il carico di lavoro Exchange:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
If
else |
|
| ExternalAccess | about.labels.key/value
|
| ObjectId | target.resource.product_object_id
|
| Version | metadata.product_version
|
| Parameters | target.resource.attribute.labels.key/value
|
| UserKey | target.labels.key/value
|
Attiva autenticazione avanzata.
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Enable Strong Authentication. e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS.
|
|
| ExtendedProperties | If Name is equal to additionalDetails then User-Agent is mapped with network.http.user_agent
else if else |
| ModifiedProperties | If Name is equal to Included Updated Properties then NewValue is mapped with security_result.summary
else |
ReactedToMessage
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ReactedToMessage e il carico di lavoro MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.IssuedAtTime | target.labels.key/value
|
| AppAccessContext.UniqueTokenId | target.labels.key/value
|
| ChatThreadId | target.user.group_identifiers
|
| ChatThreadId | target.group.product_object_id
|
| MessageReactionType | target.resource.attribute.labels.key/value
|
| ChatName | target.group.group_display_name
|
| MessageId | target.resource.product_object_id
|
| ParticipantInfo.HasForeignTenantUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasGuestUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasOtherGuestUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.HasUnauthenticatedUsers | security_result.detection_fields.key/value
|
| ParticipantInfo.ParticipatingTenantIds | security_result.detection_fields.key/value
|
RemovableMediaUnmount
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione RemovableMediaUnmount e il carico di lavoro Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| MDATPDeviceId | target.asset.asset_id
|
| Platform | target.labels.key/value
|
| Scope | target.labels.key/value
|
| RemovableMediaDeviceAttributes.Manufacturer | target.asset.hardware.manufacturer
|
| RemovableMediaDeviceAttributes.Model | target.asset.hardware.model
|
| RemovableMediaDeviceAttributes.SerialNumber | target.asset.hardware.serial_number
|
FileUploadedToCloud
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione FileUploadedToCloud e il carico di lavoro Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_SYNC.
|
|
| DlpAuditEventMetadata.DlpPolicyMatchId | security_result.detection_fields.key/value
|
| DlpAuditEventMetadata.EvaluationTime | security_result.detection_fields.key/value
|
| EnforcementMode | target.labels.key/value
|
| EvidenceFile.FullUrl | target.file.full_path
|
| EvidenceFile.StorageName | target.file.names
|
| Hidden | security_result.detection_fields.key/value
|
| JitTriggered | security_result.detection_fields.key/value
|
| MDATPDeviceId | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.Count | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.Confidence | security_result.detection_fields.key/value
|
| SensitiveInfoTypeData.SensitiveInfoTypeName | security_result.detection_fields.key/value
|
| TargetPrinterName | target.asset.hostname
|
target.asset.type is set to PRINTER | |
| TargetDomain | target.labels.key/value
|
GenerateDataflowSasToken
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione GenerateDataflowSasToken e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_CHANGE_PERMISSIONS.
|
|
| DataflowAccessTokenRequestParameters.entityName | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.partitionUri | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.permissions | principal.labels.key/value
|
| DataflowAccessTokenRequestParameters.tokenLifetimeInMinutes | principal.labels.key/value
|
| DataflowId | target.resource.product_object_id
|
| DataflowName | target.resource.name
|
| IsSuccess |
If
else |
| ItemName | target.labels.key/value |
GenerateScreenshot
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione GenerateScreenshot e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
MDCAssessments
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione MDCAssessments e il carico di lavoro CompliancePostureManagement:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to SCAN_UNCATEGORIZED.
|
|
| PropertyBag.AssessmentStatusPerInitiative.ArnEventId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.CloudProvider | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.CustomerResourceId | about.resource.product_object_id
|
| PropertyBag.AssessmentStatusPerInitiative.EventType | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.PolicyInitiativeId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.PolicyInitiativeName | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.ResourceName | about.resource.name
|
| PropertyBag.AssessmentStatusPerInitiative.ResourceType | about.resource.resource_subtype
|
| PropertyBag.AssessmentStatusPerInitiative.SecurityAssessmentId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusChangeDate | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusCode | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.StatusFirstEvaluationDate | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.SubscriptionId | about.labels.key/value
|
| PropertyBag.AssessmentStatusPerInitiative.SubscriptionName | about.labels.key/value
|
| PropertyBag.DataType | about.labels.key/value |
RemovableMediaMount
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione RemovableMediaMount e il carico di lavoro Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| MDATPDeviceId | target.asset.asset_id
|
| Platform | target.labels.key/value
|
| Scope | target.labels.key/value
|
| RemovableMediaDeviceAttributes.Manufacturer | target.asset.hardware.manufacturer
|
| RemovableMediaDeviceAttributes.Model | target.asset.hardware.model
|
| RemovableMediaDeviceAttributes.SerialNumber | target.asset.hardware.serial_number
|
SignInEvent
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione SignInEvent e il carico di lavoro SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_UNCATEGORIZED.
|
|
| AuthenticationType | principal.labels.key/value
|
| BrowserName | principal.labels.key/value
|
| BrowserVersion | principal.labels.key/value
|
| DeviceDisplayName | principal.labels.key/value
|
| IsManagedDevice | principal.labels.key/value
|
ApprovedRequest
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ApprovedRequest e il carico di lavoro MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_PERMISSIONS.
|
|
| ItemName | target.labels.key/value
|
CreateForm
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione CreateForm e il carico di lavoro MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_CREATION.
|
|
| FormsUserType | target.labels.key/value
|
| SourceApp | principal.application
|
ListForms
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ListForms e il carico di lavoro MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
MDCRegulatoryComplianceAssessments
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione MDCRegulatoryComplianceAssessments e il carico di lavoro CompliancePostureManagement:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to SCAN_UNCATEGORIZED.
|
|
| PropertyBag.DataType | about.labels.key/value
|
| PropertyBag.Policy.ArnEventId | about.labels.key/value
|
| PropertyBag.Policy.Description | about.labels.key/value
|
| PropertyBag.Policy.DetailsLink | about.labels.key/value
|
| PropertyBag.Policy.EventTime | about.labels.key/value
|
| PropertyBag.Policy.EventType | about.labels.key/value
|
| PropertyBag.Policy.PolicyInitiativeId | about.labels.key/value
|
| PropertyBag.Policy.PolicyInitiativeName | about.labels.key/value
|
PreviewForm
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione PreviewForm e il carico di lavoro MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_ACCESS.
|
ViewedApprovalRequest
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ViewedApprovalRequest e il carico di lavoro MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_ACCESS.
|
|
| ItemName | target.labels.key/value
|
ListCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ListCreated e il carico di lavoro SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.UniqueTokenId | target.labels.key/value
|
| ListColor | target.labels.key/value
|
| ListIcon | target.labels.key/value
|
SiteColumnCreated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione SiteColumnCreated e il carico di lavoro OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| ObjectId | target.resource.product_object_id
|
ListViewUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ListViewUpdated e il carico di lavoro SharePoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| AppAccessContext.UniqueTokenId | target.labels.key/value |
| AuthenticationType | principal.labels.key/value |
| BrowserName | principal.labels.key/value |
| BrowserVersion | principal.labels.key/value |
| CustomizedDoclib | principal.labels.key/value |
| DeviceDisplayName | principal.labels.key/value |
| FromApp | principal.labels.key/value |
| IsManagedDevice | principal.labels.key/value |
| ItemCount | target.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| ListBaseTemplateType | target.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListColor | target.labels.key/value |
| ListIcon | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListTitle | about.labels.key/value |
| ObjectId | target.url |
| Platform | target.labels.key/value |
| RecordType | security_result.detection_fields.key/value |
| Site | target.labels.key/value |
| Source | security_result.description |
| TemplateTypeId | about.labels.key/value |
| WebId | about.labels.key/value |
TeamsUserSignedOut
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TeamsUserSignedOut e il carico di lavoro MicrosoftTeams:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_LOGOUT.
|
|
extension.auth.auth_type is mapped to SSO.
|
|
| ChannelGuid | target.labels.key/value |
| ChannelName | target.labels.key/value |
| ChatName | target.group.group_display_name |
| ChatThreadId | target.user.group_identifiers |
| DeviceInformation | principal.labels.key/value |
| ItemName | target.labels.key/value |
| MessageId | target.labels.key/value |
| MessageVersion | target.labels.key/value |
| ObjectId | target.labels.key/value |
| TeamGuid | target.group.product_object_id |
| TeamName | target.group.group_display_name |
| UserKey | target.labels.key/value |
| UserType | target.user.attribute.roles |
| Version | metadata.product_version |
GetWorkspaces
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione GetWorkspaces e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| Activity | about.labels.key/value |
| ActivityId | about.labels.key/value |
| AggregatedWorkspaceInformation.WorkspaceCount | target.labels.key/value |
| AggregatedWorkspaceInformation.WorkspacesByCapacitySku | target.labels.key/value |
| AggregatedWorkspaceInformation.WorkspacesByType | target.labels.key/value |
| IsSuccess | security_result.action |
| UserAgent | network.http.user_agent |
ConnectFromExternalApplication
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ConnectFromExternalApplication e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| Activity | about.labels.key/labels |
| CustomData | about.labels.key/value |
TaskListRead
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskListRead e il carico di lavoro Planner:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| UserKey | principal.labels.key/labels |
| ObjectId | target.labels.key/labels |
| TaskList | target.labels.key/value |
PutConnection
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione PutConnection e il carico di lavoro PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE. |
|
| ObjectId | target.labels.key/value |
| Version | metadata.product_version |
| AdditionalInfo.actionName | security_result.detection_fields.key/value |
| ResourceId | target.labels.key/value |
| UserKey | target.label.key/value |
| AdditionalInfo.environmentName | target.labels.key/value |
AdminSubmissionTablAllow
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione AdminSubmissionTablAllow e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to GENERIC_EVENT. |
|
| SubmissionContent | security_result.detection_fields.key/value |
| SubmissionContentType | security_result.detection_fields.key/value |
| ObjectId | target.labels.key/value |
| Recipients | network.email.to |
| SubmissionState | security_result.summary |
| SubmissionId | security_result.detection_fields.key/value |
| ExtendedProperties | principal.labels.key/value
If Else |
| SubmissionConfidenceLevel | security_result.detection_fields.key/value |
| SubmissionType | security_result.detection_fields.key/value |
| MessageDate | about.labels.key/value |
| P1SenderDomain | principal.administrative_domain |
| UserKey | target.label.key/value |
| P2SenderDomain | about.administrative_domain |
| Subject | network.email.subject |
| Version | metadata.product_version |
Aggiungi contatto.
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Add contact. e il carico di lavoro AzureActiveDirectory:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_CREATION.
|
|
| ObjectId | target.labels.key/value |
| IntraSystemId | target.resource.attribute.labels.key/value |
| ActorContextId | principal.labels.key/value |
| SupportTicketId | about.labels.key/value |
| InterSystemsId | target.resource.attribute.labels.key/value |
| TargetContextId | target.labels.key/value |
| UserKey | target.label.key/value |
| Target | security_result.detection_fields.key/value |
| AzureActiveDirectoryEventType | target.resource.attribute.labels.key/value |
| Actor | security_result.detection_fields.key/value |
| Version | metadata.product_version |
| ExtendedProperties | target.resource.attribute.labels.key/value
If Else |
| ModifiedProperties | target.resource.name
If Else if Else |
WorkspacePortalUrlReceived
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione WorkspacePortalUrlReceived e il carico di lavoro MicrosoftDefenderForIdentity:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE. |
|
| ResultDescription | security_result.detection_fields.key.value |
| UserKey | target.labels.key/value |
PutConnectionPermission
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione PutConnectionPermission e il carico di lavoro PowerApps:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_PERMISSIONS_CHANGE.
|
|
| ObjectId | target.labels.key/value |
| Version | metadata.product_version |
| AdditionalInfo.actionName | security_result.detection_fields.key/value |
| ResourceId | target.resource.attribute.labels.key/value |
| UserKey | target.label.key/value |
| AdditionalInfo.environmentName | target.resource.attribute.labels.key/value |
| AdditionalInfo.targetObjectId | target.resource.product_object_id |
SensitivityLabeledFileOpened
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione SensitivityLabeledFileOpened e il carico di lavoro PublicEndpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_OPEN.
|
|
| PreviousProtectionType.protectionType | security_result.detection_fields.key/value |
| CurrentProtectionType.protectionType | security_result.detection_fields.key/value |
| DeviceName | target.hostname |
| CurrentProtectionType.documentEncrypted | security_result.detection_fields.key/value |
| CurrentProtectionType.owner | security_result.about.email_addresses |
| TargetLocation | target.labels.key/value |
| UserKey | target.labels.key/value |
| LabelId | target.labels.key/value |
| CurrentProtectionType.templateId | security_result.detection_fields.key/value |
| ProtectionEventType | security_result.detection_fields.key/value |
| ContentType | target.labels.key/value |
| Platform | target.platform |
| UserSku | principal.labels.key/value |
| PreviousProtectionType.documentEncrypted | security_result.detection_fields.key/value |
| ObjectId | target.url |
| PreviousProtectionType.owner | security_result.about.email_addresses |
| Application | principal.application |
| PreviousProtectionType.templateId | security_result.detection_fields.key/value |
Convalida
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Validate e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| ResultCount | target.labels.key/value |
| DataType | security_result.description |
| UserKey | target.labels.key/value |
| AadAppId | target.labels.key/value |
| RelativeUrl | target.url |
SensitivityLabeledFileRenamed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione SensitivityLabeledFileRenamed e il carico di lavoro PublicEndpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_MOVE.
|
|
| PreviousProtectionType.protectionType | security_result.detection_fields.key/value |
| CurrentProtectionType.protectionType | security_result.detection_fields.key/value |
| DeviceName | target.hostname |
| CurrentProtectionType.documentEncrypted | security_result.detection_fields.key/value |
| CurrentProtectionType.owner | security_result.about.email_addresses |
| TargetLocation | target.labels.key/value |
| UserKey | target.labels.key/value |
| LabelId | target.labels.key/value |
| CurrentProtectionType.templateId | security_result.detection_fields.key/value |
| ProtectionEventType | security_result.detection_fields.key/value |
| ContentType | target.labels.key/value |
| Platform | target.platform |
| UserSku | principal.labels.key/value |
| PreviousProtectionType.documentEncrypted | security_result.detection_fields.key/value |
| ObjectId | target.url |
| PreviousProtectionType.owner | security_result.about.email_addresses |
| Application | principal.application |
| PreviousProtectionType.templateId | security_result.detection_fields.key/value |
| PreviousTarget | src.url |
TaskModified
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskModified e il carico di lavoro Planner:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_WRITTEN.
|
|
| PlanId | target.resource.attribute.labels.key/value |
| UserKey | target.labels.key/value |
| ObjectId | target.resource.product_object_id |
DeleteTile
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione TaskModified e il carico di lavoro PowerBI:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_DELETION.
|
|
| WorkspaceId | target.resource.product_object_id |
| WorkSpaceName | target.resource.name |
| UserKey | target.labels.key/value |
| ActivityId | principal.labels.key/value |
| RefreshEnforcementPolicy | security_result.detection_fields.key/value |
| RequestId | about.labels.key/value |
| IsSuccess | security_result.action |
| UserAgent | network.http.user_agent |
| ObjectId | target.resource.attribute.labels.key/value |
QuarantineReleaseMessage
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione QuarantineReleaseMessage e il carico di lavoro Quarantine:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| NetworkMessageId | security_result.detection_fields.key/value |
| ReleaseTo | security_result.detection_fields.key/value |
| RequestType | security_result.detection_fields.key/value |
| RequestSource | security_result.detection_fields.key/value |
WorkspaceStatusReceived
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione WorkspaceStatusReceived e il carico di lavoro MicrosoftDefenderForIdentity:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE.
|
|
| ResultDescription | security_result.detection_fields.key/value |
LinkedEntityUpdated
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione LinkedEntityUpdated e il carico di lavoro MicrosoftTodo:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_WRITTEN.
|
|
| ActorAppId | target.labels.key/value |
| ItemId | security_result.detection_fields.key/value and target.resource.product_object_id |
| ItemType | target.resource.attribute.labels.key/value |
| TargetActorId | target.labels.key/value |
| TargetActorTenantId | target.labels.key/value |
ViewResponse
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione ViewResponse e il carico di lavoro MicrosoftForms:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT. |
|
| FormsUserTypes | principal.labels.key/value |
| SourceApp | principal.application |
| FormName | target.resource.name |
| FormId | target.resource.product_object_id |
PlanListRead
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione PlanListRead e il carico di lavoro Planner:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to RESOURCE_READ.
|
|
| PlanList | target.resource.product_object_id |
| ObjectId | target.resource.attribute.labels.key/value |
O365SyncAdminUserPromotion
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione O365SyncAdminUserPromotion e il carico di lavoro Yammer:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to STATUS_UPDATE. |
|
| ActorUserId | principal.user.email_addresses or principal.user.userid |
| ActorYammerUserId | principal.labels.key/value |
| ObjectId | target.labels.key/value |
| YammerNetworkId | principal.labels.key/value |
FileCopiedToClipboard
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione FileCopiedToClipboard e il carico di lavoro Endpoint:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_UNCATEGORIZED. |
|
| Application | principal.application |
| DeviceName | target.hostname |
| DlpAuditEventMetadata.DlpPolicyMatchId | security_result.detection_fields.key/value |
| DlpAuditEventMetadata.EvaluationTime | security_result.detection_fields.key/value |
| EnforcementMode | target.labels.key/value |
| EvidenceFile.FullUrl | target.labels.key/value |
| EvidenceFile.StorageName | target.labels.key/value |
| FileExtension | target.file.mime_type |
| FileType | target.resource.attribute.labels.key/value |
| Hidden | security_result.detection_fields.key/value |
| JitTriggered | security_result.detection_fields.key/value |
| MDATPDeviceId | security_result.detection_fields.key/value |
| ObjectId | target.file.full_path |
| Platform | target.labels.key/value |
| PolicyMatchInfo | target.resource.product_object_id
|
| SensitiveInfoTypeData | security_result.detection_fields.key/value
|
| Scope | target.labels.key/value |
| RMSEncrypted | security_result.detection_fields.key/value |
| SensitivityLabelEventData.SensitivityLabelId | security_result.detection_fields.key/value |
| SourceLocationType | principal.labels.key/value |
| TargetDomain | target.domain.name |
| TargetFilePath | target.labels.key/value |
| OriginatingDomain | principal.domain.name |
FileTranscriptContentAccessed
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione FileTranscriptContentAccessed e il carico di lavoro OneDrive:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to FILE_READ. |
|
| AlternateStreamId | security_result.detection_fields.key/value |
| ApplicationDisplayName | target.application and target.resource.name |
| ApplicationId | target.resource.product_object_id |
| AuthenticationType | principal.labels.key/value |
| AppAccessContext.UniqueTokenId | target.labels.key/value |
| BrowserName | principal.labels.key/value |
| BrowserVersion | principal.labels.key/value |
| DeviceDisplayName | principal.labels.key/value |
| IsManagedDevice | principal.labels.key/value |
| EventSource | principal.application |
| HighPriorityMediaProcessing | about.labels.key/value |
| ItemType | target.resource.attribute.labels.key/value |
| ListBaseType | target.labels.key/value |
| ListId | security_result.detection_fields.key/value |
| ListItemUniqueId | principal.asset_id |
| ListServerTemplate | security_result.detection_fields.key/value |
| ObjectId | target.url |
| Platform | target.labels.key/value |
| Site | target.labels.key/value |
| SiteUrl | network.http.referral_url |
| SourceFileExtension | target.file.mime_type |
| SourceFileName | target.file.full_path is mapped to SourceRelativeUrl/SourceFileName. |
| SourceRelativeUrl | target.file.full_path is mapped to SourceRelativeUrl/SourceFileName. |
| UserAgent | network.http.user_agent |
| WebId | about.labels.key/value |
Criterio di conformità impostato-DlpCompliancePolicy
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Set-DlpCompliancePolicy e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_UPDATE_CONTENT.
|
|
| ClientApplication | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| ObjectId | target.resource.product_object_id |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
| UserKey | target.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |
Rimuovi-DlpCompliancePolicy
La seguente tabella elenca i campi del log e le mappature UDM corrispondenti per l'operazione Remove-DlpCompliancePolicy e il carico di lavoro SecurityComplianceCenter:
| Log field | UDM mapping |
|---|---|
metadata.event_type is mapped to USER_RESOURCE_DELETION.
|
|
| ClientApplication | principal.labels.key/value |
| CmdletVersion | metadata.product_version |
| EffectiveOrganization | target.administrative_domain |
| ObjectId | target.resource.product_object_id |
| Parameters | target.process.command_line |
| SecurityComplianceCenterEventType | about.labels.key/value |
| StartTime | target.resource.attribute.creation_time |
| UserKey | target.labels.key/value |
| UserServicePlan | principal.labels.key/value |
| Version | metadata.product_version |