Collect Microsoft Graph activity logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

Overview

This parser extracts fields from Microsoft Graph activity logs, transforming them into the Unified Data Model (UDM). It initializes UDM fields, parses the payload, extracts timestamps, maps various properties to UDM fields, handles IP addresses and ports, and categorizes the event type based on the presence of principal and network information.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to Microsoft Entra ID and Azure storage accounts.

Configure Azure storage account

1. In the Azure console, search for storage accounts.
2. Click Create.
3. Specify values for the following input parameters:
   • Subscription: select the subscription.
   • Resource Group: select the resource group.
   • Region: select the region.
   • Performance: select the performance level that you want (standard is recommended).
   • Redundancy: select the redundancy level that you want (GRS or LRS is recommended).
   • Storage account name: enter a name for the new storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the Storage Account Overview page, select submenu Access keys in Security + networking.
7. Click Show next to key1 or key2
8. Click Copy to clipboard to copy the key.
9. Save the key in a secure location for future reference.
10. From the Storage Account Overview page, select submenu Endpoints in Settings.
11. Click Copy to clipboard to copy the Blob service endpoint URL (for example, https://.blob.core.windows.net).
12. Save the endpoint URL in a secure location for future reference.

Configure Microsoft Graph activity logs export to storage account

1. In the Azure console, search for Entra ID.
2. Select Monitoring > Diagnostic settings.
3. Click + Add diagnostic setting.
4. Give the setting a unique name (for example, ms-graph-activity).
5. Select the MicrosoftGraphActivityLog category you want to export to Google SecOps.
6. Under Destination details, select Archive to a storage account.
7. Select your subscription and the storage account you created in the previous step.
8. Click Save.

Note: It may take up to 72 hours for the blob storage to appear in your storage account.

Configure a feed in Google SecOps to ingest the Microsoft Graph activity logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, Microsoft Graph activity logs).
4. Select Microsoft Azure Blob Storage as the Source type.
5. Select Microsoft Graph Activity Logs as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • Azure uri: the blob endpoint URL.

     ENDPOINT_URL/BLOB_NAME

     Replace the following:

     • ENDPOINT_URL: the blob endpoint URL (https://<storageaccountname>.blob.core.windows.net)
     • BLOB_NAME: the name of the blob (for example, insights-logs-)

   • URI is a: select the URI type according to log stream configuration (Single fileS | Directory | Directory which includes subdirectories).

   • Source deletion options: select deletion option according to your preference.

   Note: If you select the Delete transferred files or Delete transferred files and empty directories option, make sure that you granted appropriate permissions to the service account.
   • Shared key: the access key to the Azure Blob Storage.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Log Field	UDM Mapping	Logic
callerIpAddress	principal.asset.ip	The raw log field callerIpAddress is copied to the UDM field.
callerIpAddress	principal.ip	The raw log field callerIpAddress is copied to the UDM field.
category	security_result.category_details	The raw log field category is copied to the UDM field.
correlationId	security_result.detection_fields.value	The raw log field correlationId is copied to the UDM field, where key is correlationId.
Level	security_result.detection_fields.value	The raw log field Level is converted to string and copied to the UDM field, where key is Level.
operationName	metadata.product_event_type	The raw log field operationName is copied to the UDM field.
operationVersion	additional.fields.value.string_value	The raw log field operationVersion is copied to the UDM field, where key is operationVersion.
properties.apiVersion	metadata.product_version	The raw log field properties.apiVersion is copied to the UDM field.
properties.appId	target.resource.product_object_id	The raw log field properties.appId is copied to the UDM field.
properties.atContent	additional.fields.value.string_value	The raw log field properties.atContent is copied to the UDM field, where key is atContent.
properties.clientAuthMethod	extensions.auth.auth_details	Based on the value of properties.clientAuthMethod, the UDM field is set to "Public Client" (0), "Client ID/Client Secret" (1), or "Client Certificate" (2).
properties.clientRequestId	additional.fields.value.string_value	The raw log field properties.clientRequestId is copied to the UDM field, where key is clientRequestId.
properties.durationMs	network.session_duration.seconds	The raw log field properties.durationMs is converted from milliseconds to seconds and copied to the UDM field.
properties.identityProvider	security_result.detection_fields.value	The raw log field properties.identityProvider is copied to the UDM field, where key is identityProvider.
properties.ipAddress	principal.asset.ip	The IP address from the raw log field properties.ipAddress is extracted and copied to the UDM field.
properties.ipAddress	principal.ip	The IP address from the raw log field properties.ipAddress is extracted and copied to the UDM field.
properties.location	principal.location.name	The raw log field properties.location is copied to the UDM field.
properties.operationId	security_result.detection_fields.value	The raw log field properties.operationId is copied to the UDM field, where key is operationId.
properties.requestMethod	network.http.method	The raw log field properties.requestMethod is copied to the UDM field.
properties.requestId	metadata.product_log_id	The raw log field properties.requestId is copied to the UDM field.
properties.responseSizeBytes	network.received_bytes	The raw log field properties.responseSizeBytes is converted to an unsigned integer and copied to the UDM field.
properties.responseStatusCode	network.http.response_code	The raw log field properties.responseStatusCode is converted to an integer and copied to the UDM field.
properties.roles	additional.fields.value.string_value	The raw log field properties.roles is copied to the UDM field, where key is roles.
properties.scopes	additional.fields.value.string_value	The raw log field properties.scopes is copied to the UDM field, where key is Scopes.
properties.servicePrincipalId	principal.user.userid	The raw log field properties.servicePrincipalId is copied to the UDM field if properties.userId is empty.
properties.signInActivityId	network.session_id	The raw log field properties.signInActivityId is copied to the UDM field.
properties.tenantId	metadata.product_deployment_id	The raw log field properties.tenantId is copied to the UDM field.
properties.tokenIssuedAt	additional.fields.value.string_value	The raw log field properties.tokenIssuedAt is copied to the UDM field, where key is tokenIssuedAt.
properties.userAgent	network.http.user_agent	The raw log field properties.userAgent is copied to the UDM field.
properties.userId	principal.user.userid	The raw log field properties.userId is copied to the UDM field.
properties.wids	security_result.detection_fields.value	The raw log field properties.wids is copied to the UDM field, where key is wids.
resourceId	target.resource.attribute.labels.value	The raw log field resourceId is copied to the UDM field, where key is Resource ID.
resultSignature	additional.fields.value.string_value	The raw log field resultSignature is copied to the UDM field, where key is resultSignature.
time	metadata.event_timestamp	The raw log field time is parsed and converted to a timestamp and copied to the UDM field. The UDM field event.idm.read_only_udm.metadata.event_type is set to "NETWORK_HTTP" if has_principal is true and network.http is not empty, "STATUS_UPDATE" if has_principal is true and network.http is empty, or "GENERIC_EVENT" otherwise. The UDM field is set to "Microsoft Graph". The UDM field is set to "Microsoft".

Changes

2024-05-27

• Set "metadata.vendor_name" as "Microsoft" and "metadata.product_name" as "Microsoft Graph".

2024-03-01

• Newly created parser.