MicrosoftCloudAppSecurity
Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.
Authentication & Identity Management · Microsoft Defender for Cloud Apps
Details
| ID | MicrosoftCloudAppSecurity |
|---|---|
| Provider | Microsoft |
| Category | Authentication & Identity Management |
| From Version | 5.0.0 |
| Docker Image | demisto/crypto:1.0.0.10120494 |
| Supported Modules | Agentix XSIAM |
README
Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.
This integration was integrated and tested with version 178 of MicrosoftCloudAppSecurity.
- Device Code Flow.
- Client Credentials Flow.
- By token (legacy method).
Device Code Flow
To use a Device Code Flow, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article.
To connect to the Microsoft Cloud App Security:
- Fill in the required parameters.
- Run the !microsoft-cas-auth-start command.
- Follow the instructions that appear.
- Run the !microsoft-cas-auth-complete command.
At the end of the process you’ll see a message that you’ve logged in successfully.
Client Credentials Flow
Follow these steps for a self-deployed configuration:
- To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article.
- In the instance configuration, select in the Authentication Mode parameter Client Credentials.
- Enter your Client/Application ID in the Application ID parameter.
- Enter your Client Secret in the Password parameter.
- Enter your Tenant ID in the Tenant ID parameter.
Required Permissions
Make sure to provide the following permissions for the app to work with Microsoft Cloud App Security:
- Discovery.manage, Investigation.read - https://learn.microsoft.com/en-us/defender-cloud-apps/api-authentication-application#supported-permission-scopes
- offline_access - when using the Device Code flow.
By token (legacy method)
To access the Microsoft Cloud App Security API, you need to grant authorization.
See the Microsoft documentation to view a detailed explanation of how to create the Server URL and User key (token).
For more information about which permissions are required for the token owner in Microsoft Cloud App Security, see Microsoft Cloud App Security - Manage admin access.
Configure MicrosoftCloudAppSecurity on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for MicrosoftCloudAppSecurity.
-
Click Add instance to create and configure a new integration instance.
Parameter Description Required Endpoint Type The endpoint for accessing Microsoft Defender for Cloud Applications (MCAS), see table below. Worldwide Server URL (e.g., https://example.net) In the Security Center, go to Settings > Clod Apps > About tab, where the API URL is displayed. True Authentication Mode False User’s key to access the API False Application ID False Tenant ID (for Client Credentials mode) False Fetch incidents False Incident type False Trust any certificate (not secure) False Use system proxy settings False Incident severity False Maximum alerts to fetch False First fetch time First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False Incident resolution status False Custom Filter A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters from the integration instance configuration. An example of a Custom Filter is: {“severity”:{“eq”:2}}. Note that for filtering by “entity.policy”, you should use the ID of the policy. For example, for retrieving the policy: {“policyType”: “ANOMALY_DETECTION”, “id”: “1234”, “label”: “Impossible travel”, “type”: “policyRule”}” please query on {“entity.policy”:{“eq”:1234}}. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters. False Advanced: Minutes to look back when fetching Use this parameter to determine how long backward to look in the search for incidents to ensure collecting all incidents. False Endpoint Type options
Endpoint Type Description Worldwide The publicly accessible Microsoft Defender for Cloud Applications US GCC Microsoft Defender for Cloud Applications for the USA Government Cloud Community (GCC) US GCC-High Microsoft Defender for Cloud Applications for the USA Government Cloud Community High (GCC-High) - Click Test to validate the URLs, token, and connection.
Look-back parameter note
In case the look-back parameter is initialized with a certain value and during a time that incidents were fetched, if changing
the look back to a number that is greater than the previous value, then in the next fetch there might be incidents duplications.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
microsoft-cas-auth-start
Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode)
Base Command
microsoft-cas-auth-start
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
Command Example
#### Human Readable Output
>###Authorization instructions
>
>1. To sign in, use a web browser to open the page {URL}
>and enter the code {code} to authenticate.
>2. Run the !microsoft-cas-auth-complete command in the War Room.
### microsoft-cas-auth-complete
***
Run this command to complete the authorization process. Should be used after running the microsoft-cas-auth-start command. (for device-code mode)
#### Base Command
`microsoft-cas-auth-complete`
#### Input
There are no input arguments for this command.
#### Context Output
There is no context output for this command.
#### Command Example
```!microsoft-cas-auth-complete```
#### Human Readable Output
>✅ Authorization completed successfully.
### microsoft-cas-auth-reset
***
Run this command if for some reason you need to rerun the authentication process.
#### Base Command
`microsoft-cas-auth-reset`
#### Input
There are no input arguments for this command.
#### Context Output
There is no context output for this command.
#### Command Example
```!microsoft-cas-auth-reset```
#### Human Readable Output
>Authorization was reset successfully.
>You can now run !microsoft-cas-auth-start and
>!microsoft-cas-auth-complete.
### microsoft-cas-auth-test
***
Tests the connectivity to the Microsoft cas.
#### Base Command
`microsoft-cas-auth-test`
#### Input
There are no input arguments for this command.
#### Context Output
There is no context output for this command.
#### Command Example
```!microsoft-cas-auth-test```
#### Human Readable Output
>✅ Success!
### microsoft-cas-alerts-list
***
Returns a list of alerts that match the specified filters.
#### Base Command
`microsoft-cas-alerts-list`
#### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| skip | Skips the specified number of records. | Optional |
| limit | The maximum number of records to return. Default is 50. Default is 50. | Optional |
| severity | The severity of the alert. Possible values are: "Low", "Medium", and "High". Possible values are: Low, Medium, High. | Optional |
| resolution_status | The alert resolution status. Possible values are: "Open", "Dismissed", and "Resolved". Possible values are: Open, Dismissed, Resolved. | Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters. | Optional |
| alert_id | The alert ID. | Optional |
#### Context Output
| **Path** | **Type** | **Description** |
| --- | --- | --- |
| MicrosoftCloudAppSecurity.Alerts._id | String | The alert ID. |
| MicrosoftCloudAppSecurity.Alerts.timestamp | Date | The time the alert was created. |
| MicrosoftCloudAppSecurity.Alerts.policyRule.id | String | The ID of the rule that triggered the alert. |
| MicrosoftCloudAppSecurity.Alerts.policyRule.label | String | The label of the rule that triggered the alert. |
| MicrosoftCloudAppSecurity.Alerts.policyRule.type | String | The type of rule that triggered the alert. |
| MicrosoftCloudAppSecurity.Alerts.policyRule.policyType | String | The policy type of the rule that triggered the alert. |
| MicrosoftCloudAppSecurity.Alerts.service.id | Number | The cloud service ID. |
| MicrosoftCloudAppSecurity.Alerts.service.label | String | The cloud service name. |
| MicrosoftCloudAppSecurity.Alerts.service.type | String | The cloud service type. |
| MicrosoftCloudAppSecurity.Alerts.file.id | String | The ID of the alert file. |
| MicrosoftCloudAppSecurity.Alerts.file.label | String | THe label of the alert file. |
| MicrosoftCloudAppSecurity.Alerts.file.type | String | The alert file type. |
| MicrosoftCloudAppSecurity.Alerts.user.id | String | The ID of the user who received the alert. |
| MicrosoftCloudAppSecurity.Alerts.user.label | String | The label of the user who received the alert. |
| MicrosoftCloudAppSecurity.Alerts.user.type | String | The type of the user who received the alert. |
| MicrosoftCloudAppSecurity.Alerts.country.id | String | The country ID where the alert originated. |
| MicrosoftCloudAppSecurity.Alerts.country.label | String | The country label where the alert originated. |
| MicrosoftCloudAppSecurity.Alerts.country.type | String | The country type where the alert originated. |
| MicrosoftCloudAppSecurity.Alerts.ip.id | String | The IP address where the alert came. |
| MicrosoftCloudAppSecurity.Alerts.ip.label | String | The IP label where the alert came. |
| MicrosoftCloudAppSecurity.Alerts.ip.type | String | The IP type where the alert came. |
| MicrosoftCloudAppSecurity.Alerts.ip.triggeredAlert | Boolean | Whether this IP address triggered the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.id | String | The ID of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.label | String | The label of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.type | String | The type of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.inst | Number | The instance of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.saas | Number | The service of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.pa | String | The email of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.account.entityType | Number | The entity type of the account that received the alert. |
| MicrosoftCloudAppSecurity.Alerts.title | String | The title of the alert. |
| MicrosoftCloudAppSecurity.Alerts.description | String | The description of the alert. |
| MicrosoftCloudAppSecurity.Alerts.policy.id | String | The ID of the reason \(policy\) that explains why the alert was triggered. |
| MicrosoftCloudAppSecurity.Alerts.policy.label | String | The label of the reason \(policy\) that explains why the alert was triggered. |
| MicrosoftCloudAppSecurity.Alerts.policy.policyType | String | The policy type of the reason \(policy\) that explains why the alert was triggered. |
| MicrosoftCloudAppSecurity.Alerts.threatScore | Number | The threat score of the alert. |
| MicrosoftCloudAppSecurity.Alerts.isSystemAlert | Boolean | Whether it is a system alert. |
| MicrosoftCloudAppSecurity.Alerts.statusValue | Number | The status value of the alert. |
| MicrosoftCloudAppSecurity.Alerts.severityValue | Number | The severity value of the alert. |
| MicrosoftCloudAppSecurity.Alerts.handledByUser | String | The user who handled the alert. |
| MicrosoftCloudAppSecurity.Alerts.comment | String | The comment relating to the alert. |
| MicrosoftCloudAppSecurity.Alerts.resolveTime | Date | The date/time that the alert was resolved. |
#### Command Example
```!microsoft-cas-alerts-list custom_filter=`{"filters": {"date": {"gte_ndays":30}}, "limit": "3"}````
#### Context Example
```json
{
"MicrosoftCloudAppSecurity": {
"Alerts": [
{
"URL": "https://example.portal.cloudappsecurity.com/#/alerts/60edead2cdbeaf0b87e13377",
"_id": "60edead2cdbeaf0b87e13377",
"account": [
{
"entityType": 2,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"inst": 0,
"label": "John Example",
"pa": "john@example.onmicrosoft.com",
"saas": 11161,
"type": "account"
}
],
"contextId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"country": [
{
"id": "IL",
"label": "IL",
"type": "country"
},
{
"id": "NL",
"label": "NL",
"type": "country"
}
],
"description": "<p>The user John Example (john@example.onmicrosoft.com) perform failed sign in activities from remote locations that are considered an impossible travel activity.<br>The user performed failed sign in activities from 1.2.3.6 in Netherlands and 1.2.3.4 in Israel within 96 minutes.<br>If these are IP addresses that are known and safe, add them in the <a href=\"#/subnet\">IP address range page</a> to improve the accuracy of the alerts.</p>",
"evidence": [
{
"title": {
"parameters": {
"app": "Office 365"
},
"template": "ANUBIS_ADMIN_USER_FEATURE"
}
},
{
"title": {
"parameters": {
"mitre": {
"alternateLink": "https://go.microsoft.com/fwlink/?linkid=2135034",
"label": "MITRE",
"type": "link"
},
"tactic": "INITIAL_ACCESS"
},
"template": "ALERTS_MITRE_TACTIC"
}
}
],
"idValue": 15859716,
"intent": [
2
],
"ip": [
{
"id": "1.2.3.4",
"label": "1.2.3.4",
"type": "ip"
},
{
"id": "1.2.3.5",
"label": "1.2.3.5",
"type": "ip"
}
],
"isPreview": false,
"isSystemAlert": false,
"is_open": true,
"policyRule": [
{
"id": "5e6fa96cb5172297ca756554",
"label": "Impossible travel",
"policyType": "ANOMALY_DETECTION",
"type": "policyRule"
}
],
"resolutionStatusValue": 0,
"service": [
{
"id": 20893,
"label": "Microsoft Exchange Online",
"type": "service"
},
{
"id": 11161,
"label": "Office 365",
"type": "service"
},
{
"id": 12260,
"label": "Microsoft Azure",
"type": "service"
}
],
"severityValue": 1,
"statusValue": 0,
"stories": [
0
],
"threatScore": 33,
"threatScoreReasoning": [
{
"parameters": {
"usage": 1,
"userPercent": 12
},
"template": "UEBA_ALERTS_TENANT_USAGE_EVIDENCE"
}
],
"timestamp": 1626193095126,
"title": "Impossible travel activity",
"user": [
{
"id": "john@example.onmicrosoft.com",
"label": "john@example.onmicrosoft.com",
"type": "user"
}
]
},
{
"URL": "https://example.portal.cloudappsecurity.com/#/alerts/60eda688cdbeaf0b87f5a41e",
"_id": "60eda688cdbeaf0b87f5a41e",
"account": [
{
"em": "john@example.onmicrosoft.com",
"entityType": 2,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"inst": 0,
"label": "John Example",
"pa": "john@example.onmicrosoft.com",
"saas": 11161,
"type": "account"
}
],
"contextId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"country": [
{
"id": "NL",
"label": "NL",
"type": "country"
}
],
"description": "John Example performed a risky sign-in.<br><br>Unfamiliar sign-in properties<br>Sign-in with properties we have not seen recently for the given user",
"evidence": [
{
"title": {
"parameters": {
"mitre": {
"alternateLink": "https://go.microsoft.com/fwlink/?linkid=2135034",
"label": "MITRE",
"type": "link"
},
"tactic": "INITIAL_ACCESS"
},
"template": "ALERTS_MITRE_TACTIC"
}
},
{
"title": {
"parameters": {
"mitre": {
"alternateLink": "https://go.microsoft.com/fwlink/?linkid=2135034",
"label": "MITRE",
"type": "link"
},
"tactic": "INITIAL_ACCESS"
},
"template": "ALERTS_MITRE_TACTIC"
}
}
],
"idValue": 15795457,
"intent": [
2
],
"ip": [
{
"id": "1.2.3.6",
"label": "1.2.3.6",
"type": "ip"
}
],
"isSystemAlert": false,
"is_open": true,
"policyRule": [
{
"id": "5e6fa96cb5172297ca75654a",
"label": "Risky sign-in",
"policyType": "ANOMALY_DETECTION",
"type": "policyRule"
}
],
"resolutionStatusValue": 0,
"severityValue": 2,
"statusValue": 0,
"stories": [
0
],
"threatScore": 0,
"timestamp": 1626187297290,
"title": "Risky sign-in: Unfamiliar sign-in properties"
},
{
"URL": "https://example.portal.cloudappsecurity.com/#/alerts/60eaf3cccdbeaf0b87d1a775",
"_id": "60eaf3cccdbeaf0b87d1a775",
"account": [
{
"entityType": 2,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"inst": 0,
"label": "John Example",
"pa": "john@example.onmicrosoft.com",
"saas": 11161,
"type": "account"
}
],
"comment": null,
"contextId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"description": "<p>The user \"John Example (john@example.onmicrosoft.com)\" performed more than 214 administrative activities in a single session.</p>",
"evidence": [
{
"title": {
"parameters": {
"app": "Office 365"
},
"template": "ANUBIS_ADMIN_USER_FEATURE"
}
},
{
"title": {
"parameters": {
"days": 124,
"resource": "1.2.3.4"
},
"template": "ANUBIS_LAST_SEEN_FEATURE_IP_ALL_TENANT"
}
}
],
"handledByUser": "john@example.onmicrosoft.com",
"idValue": 15859721,
"intent": [
4
],
"ip": [
{
"id": "1.2.3.5",
"label": "1.2.3.5",
"type": "ip"
}
],
"isPreview": false,
"isSystemAlert": false,
"is_open": false,
"policyRule": [
{
"id": "5e6fa96cb5172297ca756571",
"label": "Unusual administrative activity (by user)",
"policyType": "ANOMALY_DETECTION",
"type": "policyRule"
}
],
"resolutionStatusValue": 4,
"resolveTime": "2021-07-13T18:26:58.662Z",
"service": [
{
"id": 20595,
"label": "Microsoft Cloud App Security",
"type": "service"
}
],
"severityValue": 1,
"statusValue": 0,
"stories": [
0
],
"threatScore": 33,
"threatScoreReasoning": [
{
"parameters": {
"usage": 1,
"userPercent": 12
},
"template": "UEBA_ALERTS_TENANT_USAGE_EVIDENCE"
}
],
"timestamp": 1625995805942,
"title": "Suspicious administrative activity",
"user": [
{
"id": "john@example.onmicrosoft.com",
"label": "john@example.onmicrosoft.com",
"type": "user"
}
]
}
]
}
}
Human Readable Output
Microsoft CAS Alerts
alert_id alert_date title description status_value severity_value is_open 60edead2cdbeaf0b87e13377 2021-07-13T16:18:15.126000 Impossible travel activity <p>The user John Example (john@example.onmicrosoft.com) perform failed sign in activities from remote locations that are considered an impossible travel activity.
The user performed failed sign in activities from 1.2.3.6 in Netherlands and 1.2.3.4 in Israel within 96 minutes.
If these are IP addresses that are known and safe, add them in the IP address range page to improve the accuracy of the alerts.</p>N/A Medium true 60eda688cdbeaf0b87f5a41e 2021-07-13T14:41:37.290000 Risky sign-in: Unfamiliar sign-in properties John Example performed a risky sign-in.
Unfamiliar sign-in properties
Sign-in with properties we have not seen recently for the given userN/A High true 60eaf3cccdbeaf0b87d1a775 2021-07-11T09:30:05.942000 Suspicious administrative activity <p>The user “John Example (john@example.onmicrosoft.com)” performed more than 214 administrative activities in a single session.</p> N/A Medium false
microsoft-cas-alert-close-benign
An alert on a suspicious but not malicious activity, such as a penetration test or other authorized suspicious action
Base Command
microsoft-cas-alert-close-benign
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - “1234567890abcdefg”. Mandatory, unless you use a custom filter. |
Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
| comment | Comment describing why the alerts were dismissed. | Optional |
| reason | The reason for closing the alerts as benign. Providing a reason helps improve the accuracy of the detection over time. Possible values include: Actual severity is lower Other Confirmed with end user Triggered by test. Possible values are: Actual severity is lower, Other, Confirmed with end user, Triggered by test. |
Optional |
| sendFeedback | Whether feedback about this alert is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| feedbackText | The text of the feedback. | Optional |
| allowContact | Whether consent to contact the user is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| contactEmail | The email address of the user. | Optional |
Context Output
There is no context output for this command.
Command Example
!microsoft-cas-alert-close-benign alert_ids=60eaf3cccdbeaf0b87d1a775
Human Readable Output
1 alerts were closed as benign.
microsoft-cas-alert-close-true-positive
Cֹlose multiple alerts matching the specified filters as true positive (an alert on a confirmed malicious activity.
Base Command
microsoft-cas-alert-close-true-positive
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - “1234567890abcdefg”. Mandatory, unless you use a custom filter. |
Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
| comment | Comment describing why the alerts were dismissed. | Optional |
| sendFeedback | Whether feedback about this alert is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| feedbackText | The text of the feedback. | Optional |
| allowContact | Whether consent to contact the user is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| contactEmail | The email address of the user. | Optional |
Context Output
There is no context output for this command.
Command Example
!microsoft-cas-alert-close-true-positive alert_ids=60ced07dcdbeaf0b876fc7d3
Human Readable Output
1 alerts were closed as true-positive.
microsoft-cas-alert-close-false-positive
Close multiple alerts matching the specified filters as false positive (an alert on a non-malicious activity).
Base Command
microsoft-cas-alert-close-false-positive
Input
| Argument Name | Description | Required |
|---|---|---|
| alert_ids | A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - “1234567890abcdefg”. Mandatory, unless you use a custom filter. |
Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
| comment | Comment describing why the alerts were dismissed. Default is None. | Optional |
| reason | The reason for closing the alerts as false positive. Providing a reason helps improve the accuracy of the detection over time. Possible values include: Not of interest Too many similar alerts Alert is not accurate Other. Possible values are: Not of interest, Too many similar alerts, Alert is not accurate, Other. |
Optional |
| sendFeedback | Whether feedback about this alert is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| feedbackText | The text of the feedback. | Optional |
| allowContact | Whether consent to contact the user is provided. Possible values: “false” and “true”. Possible values are: false, true. Default is false. | Optional |
| contactEmail | The email address of the user. | Optional |
Context Output
There is no context output for this command.
Command Example
!microsoft-cas-alert-close-false-positive alert_ids=60cf6d10cdbeaf0b87acdfa9 reason="Alert is not accurate"
Human Readable Output
1 alerts were closed as false-positive.
microsoft-cas-activities-list
Returns a list of activities that match the specified filters.
Base Command
microsoft-cas-activities-list
Input
| Argument Name | Description | Required |
|---|---|---|
| skip | The number of records to skip. Default is 50. | Optional |
| limit | Maximum number of records returned to the user. Default is 50. | Optional |
| ip | The origin of the specified IP address. | Optional |
| ip_category | The subnet categories. Valid values are: “Corporate”, “Administrative”, “Risky”, “VPN”, “Cloud_provider”, and “Other”. Possible values are: Corporate, Administrative, Risky, VPN, Cloud_provider, Other. | Optional |
| taken_action | The actions taken on activities. Valid values are: “block”, “proxy”, “BypassProxy”, “encrypt”, “decrypt”, “verified”, “encryptionFailed”, “protect”, “verify”, and “null”. Possible values are: block, proxy, BypassProxy, encrypt, decrypt, verified, encryptionFailed, protect, verify. | Optional |
| source | The source type. Valid values are: “Access_control”, “Session_control”, “App_connector”, “App_connector_analysis”, “Discovery”, and “MDATP”. Possible values are: Access_control, Session_control, App_connector, App_connector_analysis, Discovery, MDATP. | Optional |
| custom_filter | A custom filter by which to filter the returned activities. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
| activity_id | The ID of the activity. | Optional |
| timeout | Timeout of the request to Microsoft CAS, in seconds. Default is 60 seconds. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| IP.Address | String | IP address. |
| IP.Geo.Location | String | The geolocation where the IP address is located, in the format: latitude:longitude. |
| MicrosoftCloudAppSecurity.Activities._id | String | The ID of the activity. |
| MicrosoftCloudAppSecurity.Activities.saasId | Number | The ID of the cloud service. |
| MicrosoftCloudAppSecurity.Activities.timestamp | Date | The time the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.instantiation | Date | The instantiation of the activity. |
| MicrosoftCloudAppSecurity.Activities.created | Date | The time the activity was created. |
| MicrosoftCloudAppSecurity.Activities.eventTypeValue | String | The event type of the activity. |
| MicrosoftCloudAppSecurity.Activities.device.clientIP | String | The device client IP address of the activity. |
| MicrosoftCloudAppSecurity.Activities.device.userAgent | String | The user agent of the activity. |
| MicrosoftCloudAppSecurity.Activities.device.countryCode | String | The country code (name) of the device. |
| MicrosoftCloudAppSecurity.Activities.location.countryCode | String | The country code (name) of the activity. |
| MicrosoftCloudAppSecurity.Activities.location.city | String | The city of the activity. |
| MicrosoftCloudAppSecurity.Activities.location.region | String | The region of the activity. |
| MicrosoftCloudAppSecurity.Activities.location.longitude | Number | The longitude of the activity. |
| MicrosoftCloudAppSecurity.Activities.location.latitude | Number | The latitude of the activity. |
| MicrosoftCloudAppSecurity.Activities.location.categoryValue | String | The category value of the activity. |
| MicrosoftCloudAppSecurity.Activities.user.userName | String | The username associated with the activity. |
| MicrosoftCloudAppSecurity.Activities.userAgent.family | String | The family of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.name | String | The name of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.operatingSystem.name | String | The name of the operating system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.operatingSystem.family | String | The family of the operating system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.type | String | The type of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.typeName | String | The name of the type of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.version | String | The version of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.deviceType | String | The device type of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.nativeBrowser | Boolean | The native browser type of the system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.os | String | The operating system in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.userAgent.browser | String | The browser in which the activity occurred. |
| MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.instanceId | Number | The ID of the instance of the event objects. |
| MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.saasId | Number | The ID of the cloud service of the event objects. |
| MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.id | String | The ID of the event objects. |
| MicrosoftCloudAppSecurity.Activities.mainInfo.activityResult.isSuccess | Boolean | Whether the activities were successful. |
| MicrosoftCloudAppSecurity.Activities.mainInfo.type | String | The type of activity. |
| MicrosoftCloudAppSecurity.Activities.confidenceLevel | Number | The confidence level of the activity. |
| MicrosoftCloudAppSecurity.Activities.resolvedActor.id | String | The user ID of the activity. |
| MicrosoftCloudAppSecurity.Activities.resolvedActor.saasId | String | The user cloud service ID of the activity. |
| MicrosoftCloudAppSecurity.Activities.resolvedActor.instanceId | String | The user instance ID of the activity. |
| MicrosoftCloudAppSecurity.Activities.resolvedActor.name | String | The username of the activity. |
| MicrosoftCloudAppSecurity.Activities.eventTypeName | String | The event that triggered the activity. |
| MicrosoftCloudAppSecurity.Activities.classifications | String | The classifications of the activity. |
| MicrosoftCloudAppSecurity.Activities.entityData.displayName | String | The display name of entity activity. |
| MicrosoftCloudAppSecurity.Activities.entityData.id.id | String | The ID of the entity activity. |
| MicrosoftCloudAppSecurity.Activities.entityData.resolved | Boolean | Whether the entity was resolved. |
| MicrosoftCloudAppSecurity.Activities.description | String | The description of the activity. |
| MicrosoftCloudAppSecurity.Activities.genericEventType | String | The generic event type of the activity. |
| MicrosoftCloudAppSecurity.Activities.severity | String | The severity of the activity. |
Command Example
!microsoft-cas-activities-list limit=4
Context Example
{
"DBotScore": [
{
"Indicator": "1.2.3.6",
"Score": 0,
"Type": "ip",
"Vendor": "MicrosoftCloudAppSecurity"
},
{
"Indicator": "1.2.3.4",
"Score": 0,
"Type": "ip",
"Vendor": "MicrosoftCloudAppSecurity"
}
],
"IP": [
{
"Address": "1.2.3.6",
"Geo": {
"Location": "52.30905:4.94019"
}
},
{
"Address": "1.2.3.4",
"Geo": {
"Location": "50.1109:8.6821"
}
}
],
"MicrosoftCloudAppSecurity": {
"Activities": [
{
"_id": "710e5ae7f65ad8e997e3154db373ad08c2304f63e8b49cb98347fded4652131a",
"aadTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"appId": 11161,
"appName": "Office 365",
"classifications": [
"access"
],
"collected": {
"aadLogins": {
"MCAS_Router": false,
"correlationId": "a54f8379-730d-420c-a475-088d8478d894",
"enqueueTime": 1626197391062,
"routingTime": 1626197391127
}
},
"confidenceLevel": 30,
"created": 1626197535294,
"createdRaw": 1626197535294,
"description": "Failed log on (Failure message: General failure)",
"description_id": "EVENT_DESCRIPTION_FAILED_LOGIN",
"description_metadata": {
"activity_result_message": "(Failure message: General failure)",
"colon": "",
"dash": "",
"event_category": "Failed log on"
},
"device": {
"clientIP": "1.2.3.6",
"countryCode": "NL",
"userAgent": ";Windows 10;Chrome 91.0;"
},
"entityData": [
{
"displayName": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"id": {
"id": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"inst": 0,
"saas": 11161
},
"resolved": false
}
],
"eventRouting": {
"auditing": true,
"dispersed": true,
"lograbber": true,
"scubaUnpacker": false
},
"eventType": 2293761,
"eventTypeName": "EVENT_CATEGORY_FAILED_LOGIN",
"eventTypeValue": "EVENT_AAD_LOGIN_FAILED",
"failedUserData": {
"userName": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com"
},
"genericEventType": "ENUM_ACTIVITY_GENERIC_TYPE_FAILED_LOGIN",
"instantiation": 1626197490954,
"instantiationRaw": 1626197490954,
"internals": {
"otherIPs": [
"1.2.3.6"
]
},
"location": {
"anonymousProxy": false,
"carrier": "eunetworks gmbh",
"category": 0,
"categoryValue": "NONE",
"city": "amsterdam",
"countryCode": "NL",
"isSatelliteProvider": false,
"latitude": 52.30905,
"longitude": 4.94019,
"organizationSearchable": "eunetworks",
"postalCode": "1101",
"region": "noord-holland"
},
"lograbberService": {
"scubaUnpacker": true
},
"mainInfo": {
"activityResult": {
"isSuccess": false,
"message": "General failure"
},
"eventObjects": [
{
"id": "c61faf03-1cbc-4409-94a9-ae1497de0883",
"name": "EWS O365",
"objType": 6,
"role": 1,
"tags": []
},
{
"id": "a25feb7c-f23c-4152-9f46-d87e2e10d800",
"name": "Request ID",
"objType": 7,
"role": 3,
"tags": []
},
{
"name": "Pass-through authentication",
"objType": 7,
"role": 3,
"tags": [],
"value": "false"
},
{
"id": "58518ac4-40e0-4dc3-a56b-565dcfe4e9d3",
"name": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"objType": 2,
"resolved": false,
"role": 2,
"tags": [
"000000200000000000000000"
]
},
{
"governable": false,
"id": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"instanceId": 0,
"link": 1874981740,
"name": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"objType": 22,
"resolved": false,
"role": 5,
"saasId": 11161,
"tags": [
"000000200000000000000000"
]
}
],
"prettyOperationName": "OAuth2:Authorize",
"rawOperationName": "OAuth2:Authorize",
"type": "failedLogin"
},
"rawDataJson": {
"ApplicationId": "c61faf03-1cbc-4409-94a9-ae1497de0883",
"ApplicationName": "EWS O365",
"BrowserId": "14dc3979-59da-4b8e-b9d3-a49b716b1fe9",
"Call": "OAuth2:Authorize",
"CorrelationId": "a54f8379-730d-420c-a475-088d8478d894",
"DataSource": null,
"DeviceInfo": ";Windows 10;Chrome 91.0;",
"DeviceTrustType": "",
"EventType": "MCASLoginEvent",
"HomeTenantUserObjectId": "58518ac4-40e0-4dc3-a56b-565dcfe4e9d3",
"IpAddress": "1.2.3.6",
"IsDeviceCompliantAndManaged": false,
"IsInteractive": null,
"IsInteractiveComputed": true,
"LoginErrorCode": 16000,
"LoginStatus": "Failure",
"MfaAuthMethod": null,
"MfaMaskedDeviceId": null,
"MfaRequired": false,
"MfaResult": null,
"MfaStatusRaw": null,
"MsodsTenantRegionScope": "EU",
"RequestId": "a25feb7c-f23c-4152-9f46-d87e2e10d800",
"SasStatus": null,
"TenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"TimeStamp": "2021-07-13T17:26:35.1425646Z",
"Upn": "arunvnnk_gmail.com#EXT#@arunvnnkgmail.onmicrosoft.com",
"UserIsPassthru": false,
"UserName": "",
"UserPrincipalObjectID": "58518ac4-40e0-4dc3-a56b-565dcfe4e9d3",
"UserTenantId": null,
"UserTenantMsodsRegionScope": null
},
"resolvedActor": {
"governable": false,
"id": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"instanceId": "0",
"name": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"objType": "22",
"resolved": false,
"role": "2",
"saasId": "11161",
"tags": [
"000000200000000000000000"
]
},
"resolvedActorAccount": {
"governable": false,
"id": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"instanceId": "0",
"name": "arunvnnk_gmail.com#ext#@arunvnnkgmail.onmicrosoft.com",
"resolved": false,
"role": "2",
"saasId": "11161",
"tags": [
"000000200000000000000000"
]
},
"saasId": 11161,
"severity": "INFO",
"source": 2,
"srcAppId": 11161,
"tenantId": 97134000,
"timestamp": 1626197195142,
"timestampRaw": 1626197195142,
"uid": "710e5ae7f65ad8e997e3154db373ad08c2304f63e8b49cb98347fded4652131a",
"user": {
"userTags": [
"000000200000000000000000"
]
},
"userAgent": {
"browser": "CHROME",
"deviceType": "DESKTOP",
"family": "CHROME",
"major": "91",
"minor": "0",
"name": "Chrome",
"nativeBrowser": false,
"operatingSystem": {
"family": "Windows",
"name": "Windows 10",
"version": "10"
},
"os": "windows",
"type": "Browser",
"typeName": "Browser",
"version": "91.0"
}
},
{
"_id": "d1b3c191a5563edfbce3f11cad83155cf31552f6f0b40184b423f38e0c39f536",
"aadTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"appId": 20893,
"appName": "Microsoft Exchange Online",
"classifications": [
"access"
],
"collected": {
"aadLogins": {
"MCAS_Router": false,
"correlationId": "e04722ca-92b5-4b3f-b3db-e42941c3baba",
"enqueueTime": 1626197400711,
"routingTime": 1626197400782
}
},
"confidenceLevel": 30,
"created": 1626197422850,
"createdRaw": 1626197422850,
"description": "Failed log on (Failure message: Error validating credentials due to invalid username or password.)",
"description_id": "EVENT_DESCRIPTION_FAILED_LOGIN",
"description_metadata": {
"activity_result_message": "(Failure message: Error validating credentials due to invalid username or password.)",
"colon": "",
"dash": "",
"event_category": "Failed log on"
},
"device": {
"clientIP": "1.2.3.4",
"countryCode": "DE",
"userAgent": ";;Python Requests 2.25;"
},
"entityData": [
{
"displayName": "John Example",
"id": {
"id": "john@example.onmicrosoft.com",
"inst": 0,
"saas": 11161
},
"resolved": true
},
{
"displayName": "John Example",
"id": {
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"inst": 0,
"saas": 11161
},
"resolved": true
}
],
"eventRouting": {
"auditing": true,
"dispersed": true,
"lograbber": true,
"scubaUnpacker": false
},
"eventType": 2293761,
"eventTypeName": "EVENT_CATEGORY_FAILED_LOGIN",
"eventTypeValue": "EVENT_AAD_LOGIN_FAILED",
"failedUserData": {
"userName": "john@example.onmicrosoft.com"
},
"genericEventType": "ENUM_ACTIVITY_GENERIC_TYPE_FAILED_LOGIN",
"instantiation": 1626197422679,
"instantiationRaw": 1626197422679,
"internals": {
"otherIPs": [
"1.2.3.4"
]
},
"location": {
"anonymousProxy": false,
"carrier": "amazon.com%2C inc",
"category": 5,
"categoryValue": "CLOUD_PROXY_NETWORK_IP",
"city": "frankfurt am main",
"countryCode": "DE",
"ipTags": [
"000000290000000000000000"
],
"isSatelliteProvider": false,
"latitude": 50.1109,
"longitude": 8.6821,
"organizationSearchable": "Amazon Web Services",
"postalCode": "60311",
"region": "hessen"
},
"lograbberService": {
"scubaUnpacker": true
},
"mainInfo": {
"activityResult": {
"isSuccess": false,
"message": "Error validating credentials due to invalid username or password."
},
"eventObjects": [
{
"id": "00000002-0000-0ff1-ce00-000000000000",
"name": "Office 365 Exchange Online",
"objType": 6,
"role": 1,
"tags": []
},
{
"id": "81f8ad85-b492-47a5-9138-a06543a0db00",
"name": "Request ID",
"objType": 7,
"role": 3,
"tags": []
},
{
"name": "Pass-through authentication",
"objType": 7,
"role": 3,
"tags": [],
"value": "false"
},
{
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"name": "john@example.onmicrosoft.com",
"objType": 2,
"resolved": true,
"role": 2,
"tags": []
},
{
"governable": false,
"id": "john@example.onmicrosoft.com",
"instanceId": 0,
"link": -162371653,
"name": "John Example",
"objType": 21,
"resolved": true,
"role": 5,
"saasId": 11161,
"tags": []
},
{
"governable": true,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"instanceId": 0,
"link": -162371653,
"name": "John Example",
"objType": 23,
"resolved": true,
"role": 5,
"saasId": 11161,
"tags": [
"5f01dbbc68df27c17aa6ca81"
]
}
],
"prettyOperationName": "OAuth2:Token",
"rawOperationName": "OAuth2:Token",
"type": "failedLogin"
},
"rawDataJson": {
"ApplicationId": "00000002-0000-0ff1-ce00-000000000000",
"ApplicationName": "Office 365 Exchange Online",
"BrowserId": null,
"Call": "OAuth2:Token",
"CorrelationId": "e04722ca-92b5-4b3f-b3db-e42941c3baba",
"DataSource": null,
"DeviceInfo": ";;Python Requests 2.25;",
"DeviceTrustType": "",
"EventType": "MCASLoginEvent",
"HomeTenantUserObjectId": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"IpAddress": "1.2.3.4",
"IsDeviceCompliantAndManaged": false,
"IsInteractive": null,
"IsInteractiveComputed": true,
"LoginErrorCode": 50126,
"LoginStatus": "Failure",
"MfaAuthMethod": null,
"MfaMaskedDeviceId": null,
"MfaRequired": false,
"MfaResult": null,
"MfaStatusRaw": null,
"MsodsTenantRegionScope": "EU",
"RequestId": "81f8ad85-b492-47a5-9138-a06543a0db00",
"SasStatus": null,
"TenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"TimeStamp": "2021-07-13T17:26:24.4185255Z",
"Upn": "john@example.onmicrosoft.com",
"UserIsPassthru": false,
"UserName": "",
"UserPrincipalObjectID": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"UserTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"UserTenantMsodsRegionScope": "EU"
},
"resolvedActor": {
"governable": true,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"instanceId": "0",
"name": "John Example",
"objType": "23",
"resolved": true,
"role": "2",
"saasId": "11161",
"tags": [
"5f01dbbc68df27c17aa6ca81"
]
},
"saasId": 20893,
"severity": "INFO",
"source": 2,
"srcAppId": 11161,
"tenantId": 97134000,
"timestamp": 1626197184418,
"timestampRaw": 1626197184418,
"uid": "d1b3c191a5563edfbce3f11cad83155cf31552f6f0b40184b423f38e0c39f536",
"user": {
"userTags": [
"5f01dbbc68df27c17aa6ca81"
]
},
"userAgent": {
"browser": "UNKNOWN",
"deviceType": "OTHER",
"family": "UNKNOWN",
"name": "Unknown",
"nativeBrowser": false,
"operatingSystem": {
"family": "Unknown",
"name": "Unknown"
},
"os": "OTHER",
"type": "Unknown",
"typeName": "Unknown"
}
},
{
"_id": "88b16c7195bd0bda2b9f4fff1f8eb22c34edc164dd16baf3d608ad4dba413fc0",
"aadTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"appId": 20893,
"appName": "Microsoft Exchange Online",
"classifications": [
"access"
],
"collected": {
"aadLogins": {
"MCAS_Router": false,
"correlationId": "e2e0afa3-e52b-46d8-9550-10a78a8fbaba",
"enqueueTime": 1626197400711,
"routingTime": 1626197400782
}
},
"confidenceLevel": 30,
"created": 1626197423060,
"createdRaw": 1626197423060,
"description": "Failed log on (Failure message: Error validating credentials due to invalid username or password.)",
"description_id": "EVENT_DESCRIPTION_FAILED_LOGIN",
"description_metadata": {
"activity_result_message": "(Failure message: Error validating credentials due to invalid username or password.)",
"colon": "",
"dash": "",
"event_category": "Failed log on"
},
"device": {
"clientIP": "1.2.3.4",
"countryCode": "DE",
"userAgent": ";;Python Requests 2.25;"
},
"entityData": [
{
"displayName": "John Example",
"id": {
"id": "john@example.onmicrosoft.com",
"inst": 0,
"saas": 11161
},
"resolved": true
},
{
"displayName": "John Example",
"id": {
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"inst": 0,
"saas": 11161
},
"resolved": true
}
],
"eventRouting": {
"auditing": true,
"dispersed": true,
"lograbber": true,
"scubaUnpacker": false
},
"eventType": 2293761,
"eventTypeName": "EVENT_CATEGORY_FAILED_LOGIN",
"eventTypeValue": "EVENT_AAD_LOGIN_FAILED",
"failedUserData": {
"userName": "john@example.onmicrosoft.com"
},
"genericEventType": "ENUM_ACTIVITY_GENERIC_TYPE_FAILED_LOGIN",
"instantiation": 1626197422564,
"instantiationRaw": 1626197422564,
"internals": {
"otherIPs": [
"1.2.3.4"
]
},
"location": {
"anonymousProxy": false,
"carrier": "amazon.com%2C inc",
"category": 5,
"categoryValue": "CLOUD_PROXY_NETWORK_IP",
"city": "frankfurt am main",
"countryCode": "DE",
"ipTags": [
"000000290000000000000000"
],
"isSatelliteProvider": false,
"latitude": 50.1109,
"longitude": 8.6821,
"organizationSearchable": "Amazon Web Services",
"postalCode": "60311",
"region": "hessen"
},
"lograbberService": {
"scubaUnpacker": true
},
"mainInfo": {
"activityResult": {
"isSuccess": false,
"message": "Error validating credentials due to invalid username or password."
},
"eventObjects": [
{
"id": "00000002-0000-0ff1-ce00-000000000000",
"name": "Office 365 Exchange Online",
"objType": 6,
"role": 1,
"tags": []
},
{
"id": "81f8ad85-b492-47a5-9138-a065b49fdb00",
"name": "Request ID",
"objType": 7,
"role": 3,
"tags": []
},
{
"name": "Pass-through authentication",
"objType": 7,
"role": 3,
"tags": [],
"value": "false"
},
{
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"name": "john@example.onmicrosoft.com",
"objType": 2,
"resolved": true,
"role": 2,
"tags": []
},
{
"governable": false,
"id": "john@example.onmicrosoft.com",
"instanceId": 0,
"link": -162371653,
"name": "John Example",
"objType": 21,
"resolved": true,
"role": 5,
"saasId": 11161,
"tags": []
},
{
"governable": true,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"instanceId": 0,
"link": -162371653,
"name": "John Example",
"objType": 23,
"resolved": true,
"role": 5,
"saasId": 11161,
"tags": [
"5f01dbbc68df27c17aa6ca81"
]
}
],
"prettyOperationName": "OAuth2:Token",
"rawOperationName": "OAuth2:Token",
"type": "failedLogin"
},
"rawDataJson": {
"ApplicationId": "00000002-0000-0ff1-ce00-000000000000",
"ApplicationName": "Office 365 Exchange Online",
"BrowserId": null,
"Call": "OAuth2:Token",
"CorrelationId": "e2e0afa3-e52b-46d8-9550-10a78a8fbaba",
"DataSource": null,
"DeviceInfo": ";;Python Requests 2.25;",
"DeviceTrustType": "",
"EventType": "MCASLoginEvent",
"HomeTenantUserObjectId": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"IpAddress": "1.2.3.4",
"IsDeviceCompliantAndManaged": false,
"IsInteractive": null,
"IsInteractiveComputed": true,
"LoginErrorCode": 50126,
"LoginStatus": "Failure",
"MfaAuthMethod": null,
"MfaMaskedDeviceId": null,
"MfaRequired": false,
"MfaResult": null,
"MfaStatusRaw": null,
"MsodsTenantRegionScope": "EU",
"RequestId": "81f8ad85-b492-47a5-9138-a065b49fdb00",
"SasStatus": null,
"TenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"TimeStamp": "2021-07-13T17:26:18.8088432Z",
"Upn": "john@example.onmicrosoft.com",
"UserIsPassthru": false,
"UserName": "",
"UserPrincipalObjectID": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"UserTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"UserTenantMsodsRegionScope": "EU"
},
"resolvedActor": {
"governable": true,
"id": "3fa9f28b-eb0e-463a-ba7b-8089fe9991e2",
"instanceId": "0",
"name": "John Example",
"objType": "23",
"resolved": true,
"role": "2",
"saasId": "11161",
"tags": [
"5f01dbbc68df27c17aa6ca81"
]
},
"saasId": 20893,
"severity": "INFO",
"source": 2,
"srcAppId": 11161,
"tenantId": 97134000,
"timestamp": 1626197178808,
"timestampRaw": 1626197178808,
"uid": "88b16c7195bd0bda2b9f4fff1f8eb22c34edc164dd16baf3d608ad4dba413fc0",
"user": {
"userTags": [
"5f01dbbc68df27c17aa6ca81"
]
},
"userAgent": {
"browser": "UNKNOWN",
"deviceType": "OTHER",
"family": "UNKNOWN",
"name": "Unknown",
"nativeBrowser": false,
"operatingSystem": {
"family": "Unknown",
"name": "Unknown"
},
"os": "OTHER",
"type": "Unknown",
"typeName": "Unknown"
}
},
{
"_id": "4b23b9daccf2604cec7fc8654bd98480707b0114450dac11c4a9feab98ca2499",
"aadTenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"appId": 11161,
"appName": "Office 365",
"classifications": [
"access"
],
"collected": {
"aadLogins": {
"MCAS_Router": false,
"correlationId": "923cb4be-cba8-4102-b9fc-1e71f3135680",
"enqueueTime": 1626197312908,
"routingTime": 1626197312965
}
},
"confidenceLevel": 30,
"created": 1626197344376,
"createdRaw": 1626197344376,
"description": "Failed log on (Failure message: Session information is not sufficient for single-sign-on.)",
"description_id": "EVENT_DESCRIPTION_FAILED_LOGIN",
"description_metadata": {
"activity_result_message": "(Failure message: Session information is not sufficient for single-sign-on.)",
"colon": "",
"dash": "",
"event_category": "Failed log on"
},
"device": {
"clientIP": "1.2.3.6",
"countryCode": "NL",
"userAgent": ";Windows 10;Chrome 91.0;"
},
"entityData": [
{
"displayName": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"id": {
"id": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"inst": 0,
"saas": 11161
},
"resolved": false
}
],
"eventRouting": {
"auditing": true,
"dispersed": true,
"lograbber": true,
"scubaUnpacker": false
},
"eventType": 2293761,
"eventTypeName": "EVENT_CATEGORY_FAILED_LOGIN",
"eventTypeValue": "EVENT_AAD_LOGIN_FAILED",
"failedUserData": {
"userName": "spamphishing@arunvnnkgmail.onmicrosoft.com"
},
"genericEventType": "ENUM_ACTIVITY_GENERIC_TYPE_FAILED_LOGIN",
"instantiation": 1626197343779,
"instantiationRaw": 1626197343779,
"internals": {
"otherIPs": [
"1.2.3.6"
]
},
"location": {
"anonymousProxy": false,
"carrier": "eunetworks gmbh",
"category": 0,
"categoryValue": "NONE",
"city": "amsterdam",
"countryCode": "NL",
"isSatelliteProvider": false,
"latitude": 52.30905,
"longitude": 4.94019,
"organizationSearchable": "eunetworks",
"postalCode": "1101",
"region": "noord-holland"
},
"lograbberService": {
"scubaUnpacker": true
},
"mainInfo": {
"activityResult": {
"isSuccess": false,
"message": "Session information is not sufficient for single-sign-on."
},
"eventObjects": [
{
"id": "c61faf03-1cbc-4409-94a9-ae1497de0883",
"name": "EWS O365",
"objType": 6,
"role": 1,
"tags": []
},
{
"id": "0d0db62a-043e-447c-8ab3-1f2a184ec700",
"name": "Request ID",
"objType": 7,
"role": 3,
"tags": []
},
{
"name": "Pass-through authentication",
"objType": 7,
"role": 3,
"tags": [],
"value": "false"
},
{
"id": "76603c3a-c483-4111-8893-c69b172503ab",
"name": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"objType": 2,
"resolved": false,
"role": 2,
"tags": [
"000000200000000000000000"
]
},
{
"governable": false,
"id": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"instanceId": 0,
"link": 279741149,
"name": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"objType": 22,
"resolved": false,
"role": 5,
"saasId": 11161,
"tags": [
"000000200000000000000000"
]
}
],
"prettyOperationName": "Login:reprocess",
"rawOperationName": "Login:reprocess",
"type": "failedLogin"
},
"rawDataJson": {
"ApplicationId": "c61faf03-1cbc-4409-94a9-ae1497de0883",
"ApplicationName": "EWS O365",
"BrowserId": "14dc3979-59da-4b8e-b9d3-a49b716b1fe9",
"Call": "Login:reprocess",
"CorrelationId": "923cb4be-cba8-4102-b9fc-1e71f3135680",
"DataSource": null,
"DeviceInfo": ";Windows 10;Chrome 91.0;",
"DeviceTrustType": "",
"EventType": "MCASLoginEvent",
"HomeTenantUserObjectId": "76603c3a-c483-4111-8893-c69b172503ab",
"IpAddress": "1.2.3.6",
"IsDeviceCompliantAndManaged": false,
"IsInteractive": null,
"IsInteractiveComputed": true,
"LoginErrorCode": 50058,
"LoginStatus": "Failure",
"MfaAuthMethod": null,
"MfaMaskedDeviceId": null,
"MfaRequired": false,
"MfaResult": null,
"MfaStatusRaw": null,
"MsodsTenantRegionScope": "EU",
"RequestId": "0d0db62a-043e-447c-8ab3-1f2a184ec700",
"SasStatus": null,
"TenantId": "cafe1a16-cafe-dead-beef-1337c3c1d999",
"TimeStamp": "2021-07-13T17:26:14.6101710Z",
"Upn": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"UserIsPassthru": false,
"UserName": "",
"UserPrincipalObjectID": "76603c3a-c483-4111-8893-c69b172503ab",
"UserTenantId": null,
"UserTenantMsodsRegionScope": null
},
"resolvedActor": {
"governable": false,
"id": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"instanceId": "0",
"name": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"objType": "22",
"resolved": false,
"role": "2",
"saasId": "11161",
"tags": [
"000000200000000000000000"
]
},
"resolvedActorAccount": {
"governable": false,
"id": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"instanceId": "0",
"name": "spamphishing@arunvnnkgmail.onmicrosoft.com",
"resolved": false,
"role": "2",
"saasId": "11161",
"tags": [
"000000200000000000000000"
]
},
"saasId": 11161,
"severity": "INFO",
"source": 2,
"srcAppId": 11161,
"tenantId": 97134000,
"timestamp": 1626197174610,
"timestampRaw": 1626197174610,
"uid": "4b23b9daccf2604cec7fc8654bd98480707b0114450dac11c4a9feab98ca2499",
"user": {
"userTags": [
"000000200000000000000000"
]
},
"userAgent": {
"browser": "CHROME",
"deviceType": "DESKTOP",
"family": "CHROME",
"major": "91",
"minor": "0",
"name": "Chrome",
"nativeBrowser": false,
"operatingSystem": {
"family": "Windows",
"name": "Windows 10",
"version": "10"
},
"os": "windows",
"type": "Browser",
"typeName": "Browser",
"version": "91.0"
}
}
]
}
}
Human Readable Output
Microsoft CAS Activity
activity_id activity_date app_name description severity 4b23b9daccf2604cec7fc8654bd98480707b0114450dac11c4a9feab98ca2499 2021-07-13T17:26:14.610000 Office 365 Failed log on (Failure message: Session information is not sufficient for single-sign-on.) INFO
microsoft-cas-files-list
Returns a list of files that match the specified filters. Filters include file type, file share value, file extension, file quarantine status, and a custom filter. If you pass the custom_filter argument it will override the other filters in this command.
Note: This command is supported only when using the legacy authentication.
Base Command
microsoft-cas-files-list
Input
| Argument Name | Description | Required |
|---|---|---|
| skip | Skips the specified number of records. Default is 50. | Optional |
| limit | Maximum number of records to return. Default is 50. | Optional |
| file_type | The file type. Valid value are: Other, Document, Spreadsheet, Presentation, Text, Image, and Folder. Possible values are: Other, Document, Spreadsheet, Presentation, Text, Image, Folder. | Optional |
| sharing | Filter files with the specified sharing levels. Valid values are: Private, Internal, External, Public, Public_Internet. Possible values are: Private, Internal, External, Public, Public_Internet. | Optional |
| extension | Filter files by the specified file extension. | Optional |
| quarantined | Filter by whether the file is quarantined. Valid values are: “True” or “False”. Possible values are: True, False. | Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
| file_id | Filter by the file ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MicrosoftCloudAppSecurity.Files._id | String | The ID of the file. |
| MicrosoftCloudAppSecurity.Files.saasId | Number | The cloud service ID of the file. |
| MicrosoftCloudAppSecurity.Files.instId | Number | The instance ID of the file. |
| MicrosoftCloudAppSecurity.Files.fileSize | Number | The size of the file. |
| MicrosoftCloudAppSecurity.Files.createdDate | Date | The date the file was created. |
| MicrosoftCloudAppSecurity.Files.modifiedDate | Date | The date the file was last modified. |
| MicrosoftCloudAppSecurity.Files.parentId | String | The parent ID of the file. |
| MicrosoftCloudAppSecurity.Files.ownerName | String | The name of the file owner. |
| MicrosoftCloudAppSecurity.Files.isFolder | Boolean | Whether the file is a folder. |
| MicrosoftCloudAppSecurity.Files.fileType | String | The file type. |
| MicrosoftCloudAppSecurity.Files.name | String | The name of the file. |
| MicrosoftCloudAppSecurity.Files.isForeign | Boolean | Whether the file is foreign. |
| MicrosoftCloudAppSecurity.Files.noGovernance | Boolean | Whether the file is no governance. |
| MicrosoftCloudAppSecurity.Files.fileAccessLevel | String | The access level of the file. |
| MicrosoftCloudAppSecurity.Files.ownerAddress | String | The email address of the file owner. |
| MicrosoftCloudAppSecurity.Files.externalShares | String | The external shares of the file. |
| MicrosoftCloudAppSecurity.Files.domains | String | The domains of the file. |
| MicrosoftCloudAppSecurity.Files.mimeType | String | The mime type of the file. |
| MicrosoftCloudAppSecurity.Files.ownerExternal | Boolean | Whether the owner of this file is external. |
| MicrosoftCloudAppSecurity.Files.fileExtension | String | The file extension. |
| MicrosoftCloudAppSecurity.Files.groupIds | String | The group IDs of the file. |
| MicrosoftCloudAppSecurity.Files.groups | String | The group the file belongs to. |
| MicrosoftCloudAppSecurity.Files.collaborators | String | The collaborators of the file. |
| MicrosoftCloudAppSecurity.Files.fileStatus | String | The status of the file. |
| MicrosoftCloudAppSecurity.Files.appName | String | The name of the app. |
| MicrosoftCloudAppSecurity.Files.actions.task_name | String | The name of the task. |
| MicrosoftCloudAppSecurity.Files.actions.type | String | The type of actions taken on the file. |
Command Example
!microsoft-cas-files-list file_type=Text skip=4 limit=5
Context Example
{
"MicrosoftCloudAppSecurity": {
"Files": [
{
"_id": "5f60838dc3b664209dab9a97",
"_tid": 97134000,
"actions": [
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20200525154133.JPG.txt"
},
"template": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "QuarantineTask",
"type": "file",
"uiGovernanceCategory": 1
},
{
"alert_display_title": null,
"bulk_display_description": null,
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": null,
"display_alert_text": null,
"display_description": null,
"display_title": "TASKS_ADALIBPY_RESCAN_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "RescanFileTask",
"type": "file",
"uiGovernanceCategory": 0
},
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_TRASH_FILE_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_TRASH_FILE_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20200525154133.JPG.txt"
},
"template": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "TrashFileTask",
"type": "file",
"uiGovernanceCategory": 1
}
],
"alternateLink": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20200525154133.JPG.txt",
"appId": 15600,
"appName": "Microsoft OneDrive for Business",
"collaborators": [],
"createdDate": 1600160394000,
"display_collaborators": [],
"dlpScanResults": [],
"domains": [
"example.onmicrosoft.com"
],
"driveId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"effectiveParents": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"emails": [
"john@example.onmicrosoft.com"
],
"enriched": true,
"externalShares": [],
"fTags": [],
"facl": 0,
"fileAccessLevel": "PRIVATE",
"fileExtension": "txt",
"filePath": "/personal/avishai_example_onmicrosoft_com/Documents/20200525154133.JPG.txt",
"fileSize": 149,
"fileStatus": "EXISTS",
"fileType": "TEXT",
"fstat": 0,
"ftype": 4,
"groupIds": [],
"groups": [],
"id": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|2cdab441-4e3a-4b39-9d89-144292043e3b",
"instId": 0,
"isFolder": false,
"isForeign": false,
"lastNrtTimestamp": 1600223135932,
"mimeType": "text/plain",
"modifiedDate": 1600160411000,
"name": "20200525154133.JPG.txt",
"name_l": "20200525154133.jpg.txt",
"noGovernance": false,
"originalId": "5f60838dc3b664209dab9a97",
"ownerAddress": "john@example.onmicrosoft.com",
"ownerExternal": false,
"ownerName": "John Example",
"parentId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b",
"parentIds": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"saasId": 15600,
"scanVersion": 4,
"sharepointItem": {
"Author": {
"Email": "john@example.onmicrosoft.com",
"LoginName": "i:0#.f|membership|john@example.onmicrosoft.com",
"Title": "John Example",
"externalUser": false,
"idInSiteCollection": "4",
"name": "John Example",
"oneDriveEmail": "john@example.onmicrosoft.com",
"sipAddress": "john@example.onmicrosoft.com",
"sourceBitmask": 0,
"trueEmail": "john@example.onmicrosoft.com"
},
"Length": 149,
"LinkingUrl": "",
"ModifiedBy": {
"Email": "",
"LoginName": "i:0#.f|membership|tmcassp_fa02d7a6fe55edb22020060112572594@example.onmicrosoft.com",
"Title": "Cloud App Security Service Account for SharePoint"
},
"Name": "20200525154133.JPG.txt",
"ServerRelativeUrl": "/personal/avishai_example_onmicrosoft_com/Documents/20200525154133.JPG.txt",
"TimeCreated": "2020-09-15T08:59:54Z",
"TimeLastModified": "2020-09-15T09:00:11Z",
"UniqueId": "2cdab441-4e3a-4b39-9d89-144292043e3b",
"encodedAbsUrl": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20200525154133.JPG.txt",
"hasUniqueRoleAssignments": false,
"isFolder": false,
"parentUniqueId": "8f83a489-34b7-4bb6-a331-260d1291ef6b",
"roleAssignments": [],
"scopeId": "D853886D-DDEE-4A5D-BCB9-B6F072BC1413",
"urlFromMetadata": null
},
"siteCollection": "/personal/avishai_example_onmicrosoft_com",
"siteCollectionId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac",
"sitePath": "/personal/avishai_example_onmicrosoft_com",
"snapshotLastModifiedDate": "2020-09-16T02:25:36.178Z",
"spDomain": "https://example-my.sharepoint.com",
"unseenScans": 0
},
{
"_id": "5f39f079c3b664209de9c64c",
"_tid": 97134000,
"actions": [
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt"
},
"template": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "QuarantineTask",
"type": "file",
"uiGovernanceCategory": 1
},
{
"alert_display_title": null,
"bulk_display_description": null,
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": null,
"display_alert_text": null,
"display_description": null,
"display_title": "TASKS_ADALIBPY_RESCAN_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "RescanFileTask",
"type": "file",
"uiGovernanceCategory": 0
},
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_TRASH_FILE_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_TRASH_FILE_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt"
},
"template": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "TrashFileTask",
"type": "file",
"uiGovernanceCategory": 1
}
],
"alternateLink": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/WhatsApp%20Image%202020-08-02%20at%2011.04.46.jpeg.txt",
"appId": 15600,
"appName": "Microsoft OneDrive for Business",
"collaborators": [],
"createdDate": 1597632377000,
"display_collaborators": [],
"dlpScanResults": [],
"domains": [
"example.onmicrosoft.com"
],
"driveId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"effectiveParents": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"emails": [
"john@example.onmicrosoft.com"
],
"enriched": true,
"externalShares": [],
"fTags": [],
"facl": 0,
"fileAccessLevel": "PRIVATE",
"fileExtension": "txt",
"filePath": "/personal/avishai_example_onmicrosoft_com/Documents/WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt",
"fileSize": 149,
"fileStatus": "EXISTS",
"fileType": "TEXT",
"fstat": 0,
"ftype": 4,
"groupIds": [],
"groups": [],
"id": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|812d72fe-b578-4541-9767-16a546c64222",
"instId": 0,
"isFolder": false,
"isForeign": false,
"lastNrtTimestamp": 1597632633789,
"mimeType": "text/plain",
"modifiedDate": 1597632393000,
"name": "WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt",
"name_l": "whatsapp image 2020-08-02 at 11.04.46.jpeg.txt",
"noGovernance": false,
"originalId": "5f39f079c3b664209de9c64c",
"ownerAddress": "john@example.onmicrosoft.com",
"ownerExternal": false,
"ownerName": "John Example",
"parentId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b",
"parentIds": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"saasId": 15600,
"scanVersion": 4,
"sharepointItem": {
"Author": {
"Email": "john@example.onmicrosoft.com",
"LoginName": "i:0#.f|membership|john@example.onmicrosoft.com",
"Title": "John Example",
"externalUser": false,
"idInSiteCollection": "4",
"name": "John Example",
"oneDriveEmail": "john@example.onmicrosoft.com",
"sipAddress": "john@example.onmicrosoft.com",
"sourceBitmask": 0,
"trueEmail": "john@example.onmicrosoft.com"
},
"Length": 149,
"LinkingUrl": "",
"ModifiedBy": {
"Email": "",
"LoginName": "i:0#.f|membership|tmcassp_fa02d7a6fe55edb22020060112572594@example.onmicrosoft.com",
"Title": "Cloud App Security Service Account for SharePoint"
},
"Name": "WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt",
"ServerRelativeUrl": "/personal/avishai_example_onmicrosoft_com/Documents/WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt",
"TimeCreated": "2020-08-17T02:46:17Z",
"TimeLastModified": "2020-08-17T02:46:33Z",
"UniqueId": "812d72fe-b578-4541-9767-16a546c64222",
"encodedAbsUrl": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/WhatsApp%20Image%202020-08-02%20at%2011.04.46.jpeg.txt",
"hasUniqueRoleAssignments": false,
"isFolder": false,
"parentUniqueId": "8f83a489-34b7-4bb6-a331-260d1291ef6b",
"roleAssignments": [],
"scopeId": "D853886D-DDEE-4A5D-BCB9-B6F072BC1413",
"urlFromMetadata": null
},
"siteCollection": "/personal/avishai_example_onmicrosoft_com",
"siteCollectionId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac",
"sitePath": "/personal/avishai_example_onmicrosoft_com",
"snapshotLastModifiedDate": "2020-08-17T03:17:49.940Z",
"spDomain": "https://example-my.sharepoint.com",
"unseenScans": 0
},
{
"_id": "5f306f37c3b664209d444bf2",
"_tid": 97134000,
"actions": [
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20180726150700.JPG.txt"
},
"template": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "QuarantineTask",
"type": "file",
"uiGovernanceCategory": 1
},
{
"alert_display_title": null,
"bulk_display_description": null,
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": null,
"display_alert_text": null,
"display_description": null,
"display_title": "TASKS_ADALIBPY_RESCAN_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "RescanFileTask",
"type": "file",
"uiGovernanceCategory": 0
},
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_TRASH_FILE_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_TRASH_FILE_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20180726150700.JPG.txt"
},
"template": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "TrashFileTask",
"type": "file",
"uiGovernanceCategory": 1
}
],
"alternateLink": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20180726150700.JPG.txt",
"appId": 15600,
"appName": "Microsoft OneDrive for Business",
"collaborators": [],
"createdDate": 1597009526000,
"display_collaborators": [],
"dlpScanResults": [],
"domains": [
"example.onmicrosoft.com"
],
"driveId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"effectiveParents": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"emails": [
"john@example.onmicrosoft.com"
],
"enriched": true,
"externalShares": [],
"fTags": [],
"facl": 0,
"fileAccessLevel": "PRIVATE",
"fileExtension": "txt",
"filePath": "/personal/avishai_example_onmicrosoft_com/Documents/20180726150700.JPG.txt",
"fileSize": 149,
"fileStatus": "EXISTS",
"fileType": "TEXT",
"fstat": 0,
"ftype": 4,
"groupIds": [],
"groups": [],
"id": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|05dc1be3-d09f-401c-b2f2-1bb8ef4461cb",
"instId": 0,
"isFolder": false,
"isForeign": false,
"lastNrtTimestamp": 1597009774796,
"mimeType": "text/plain",
"modifiedDate": 1597009553000,
"name": "20180726150700.JPG.txt",
"name_l": "20180726150700.jpg.txt",
"noGovernance": false,
"originalId": "5f306f37c3b664209d444bf2",
"ownerAddress": "john@example.onmicrosoft.com",
"ownerExternal": false,
"ownerName": "John Example",
"parentId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b",
"parentIds": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"saasId": 15600,
"scanVersion": 4,
"sharepointItem": {
"Author": {
"Email": "john@example.onmicrosoft.com",
"LoginName": "i:0#.f|membership|john@example.onmicrosoft.com",
"Title": "John Example",
"externalUser": false,
"idInSiteCollection": "4",
"name": "John Example",
"oneDriveEmail": "john@example.onmicrosoft.com",
"sipAddress": "john@example.onmicrosoft.com",
"sourceBitmask": 0,
"trueEmail": "john@example.onmicrosoft.com"
},
"Length": 149,
"LinkingUrl": "",
"ModifiedBy": {
"Email": "",
"LoginName": "i:0#.f|membership|tmcassp_fa02d7a6fe55edb22020060112572594@example.onmicrosoft.com",
"Title": "Cloud App Security Service Account for SharePoint"
},
"Name": "20180726150700.JPG.txt",
"ServerRelativeUrl": "/personal/avishai_example_onmicrosoft_com/Documents/20180726150700.JPG.txt",
"TimeCreated": "2020-08-09T21:45:26Z",
"TimeLastModified": "2020-08-09T21:45:53Z",
"UniqueId": "05dc1be3-d09f-401c-b2f2-1bb8ef4461cb",
"encodedAbsUrl": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20180726150700.JPG.txt",
"hasUniqueRoleAssignments": false,
"isFolder": false,
"parentUniqueId": "8f83a489-34b7-4bb6-a331-260d1291ef6b",
"roleAssignments": [],
"scopeId": "D853886D-DDEE-4A5D-BCB9-B6F072BC1413",
"urlFromMetadata": null
},
"siteCollection": "/personal/avishai_example_onmicrosoft_com",
"siteCollectionId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac",
"sitePath": "/personal/avishai_example_onmicrosoft_com",
"snapshotLastModifiedDate": "2020-08-09T22:01:59.075Z",
"spDomain": "https://example-my.sharepoint.com",
"unseenScans": 0
},
{
"_id": "5f306f6ec3b664209d5013d3",
"_tid": 97134000,
"actions": [
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20180802_144154.jpg.txt"
},
"template": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "QuarantineTask",
"type": "file",
"uiGovernanceCategory": 1
},
{
"alert_display_title": null,
"bulk_display_description": null,
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": null,
"display_alert_text": null,
"display_description": null,
"display_title": "TASKS_ADALIBPY_RESCAN_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "RescanFileTask",
"type": "file",
"uiGovernanceCategory": 0
},
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_TRASH_FILE_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_TRASH_FILE_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20180802_144154.jpg.txt"
},
"template": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "TrashFileTask",
"type": "file",
"uiGovernanceCategory": 1
}
],
"alternateLink": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20180802_144154.jpg.txt",
"appId": 15600,
"appName": "Microsoft OneDrive for Business",
"collaborators": [],
"createdDate": 1597009520000,
"display_collaborators": [],
"dlpScanResults": [],
"domains": [
"example.onmicrosoft.com"
],
"driveId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"effectiveParents": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"emails": [
"john@example.onmicrosoft.com"
],
"enriched": true,
"externalShares": [],
"fTags": [],
"facl": 0,
"fileAccessLevel": "PRIVATE",
"fileExtension": "txt",
"filePath": "/personal/avishai_example_onmicrosoft_com/Documents/20180802_144154.jpg.txt",
"fileSize": 149,
"fileStatus": "EXISTS",
"fileType": "TEXT",
"fstat": 0,
"ftype": 4,
"groupIds": [],
"groups": [],
"id": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|2c34faf7-25c9-4fce-ba60-b1e62e706072",
"instId": 0,
"isFolder": false,
"isForeign": false,
"lastNrtTimestamp": 1597025421748,
"mimeType": "text/plain",
"modifiedDate": 1597009541000,
"name": "20180802_144154.jpg.txt",
"name_l": "20180802_144154.jpg.txt",
"noGovernance": false,
"originalId": "5f306f6ec3b664209d5013d3",
"ownerAddress": "john@example.onmicrosoft.com",
"ownerExternal": false,
"ownerName": "John Example",
"parentId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b",
"parentIds": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"saasId": 15600,
"scanVersion": 4,
"sharepointItem": {
"Author": {
"Email": "john@example.onmicrosoft.com",
"LoginName": "i:0#.f|membership|john@example.onmicrosoft.com",
"Title": "John Example",
"externalUser": false,
"idInSiteCollection": "4",
"name": "John Example",
"oneDriveEmail": "john@example.onmicrosoft.com",
"sipAddress": "john@example.onmicrosoft.com",
"sourceBitmask": 0,
"trueEmail": "john@example.onmicrosoft.com"
},
"Length": 149,
"LinkingUrl": "",
"ModifiedBy": {
"Email": "",
"LoginName": "i:0#.f|membership|tmcassp_fa02d7a6fe55edb22020060112572594@example.onmicrosoft.com",
"Title": "Cloud App Security Service Account for SharePoint"
},
"Name": "20180802_144154.jpg.txt",
"ServerRelativeUrl": "/personal/avishai_example_onmicrosoft_com/Documents/20180802_144154.jpg.txt",
"TimeCreated": "2020-08-09T21:45:20Z",
"TimeLastModified": "2020-08-09T21:45:41Z",
"UniqueId": "2c34faf7-25c9-4fce-ba60-b1e62e706072",
"encodedAbsUrl": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20180802_144154.jpg.txt",
"hasUniqueRoleAssignments": false,
"isFolder": false,
"parentUniqueId": "8f83a489-34b7-4bb6-a331-260d1291ef6b",
"roleAssignments": [],
"scopeId": "D853886D-DDEE-4A5D-BCB9-B6F072BC1413",
"urlFromMetadata": null
},
"siteCollection": "/personal/avishai_example_onmicrosoft_com",
"siteCollectionId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac",
"sitePath": "/personal/avishai_example_onmicrosoft_com",
"snapshotLastModifiedDate": "2020-08-10T02:10:24.305Z",
"spDomain": "https://example-my.sharepoint.com",
"unseenScans": 0
},
{
"_id": "5f306ef5c3b664209d36d024",
"_tid": 97134000,
"actions": [
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20170813_125133.jpg.txt"
},
"template": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_QUARANTINE_FILE_SHARING_PERMISSION_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "QuarantineTask",
"type": "file",
"uiGovernanceCategory": 1
},
{
"alert_display_title": null,
"bulk_display_description": null,
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": null,
"display_alert_text": null,
"display_description": null,
"display_title": "TASKS_ADALIBPY_RESCAN_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "RescanFileTask",
"type": "file",
"uiGovernanceCategory": 0
},
{
"alert_display_title": null,
"bulk_display_description": "TASKS_ADALIBPY_TRASH_FILE_BULK_DISPLAY_DESCRIPTION",
"bulk_support": true,
"confirm_button_style": "red",
"confirmation_button_text": null,
"confirmation_link": null,
"display_alert_success_text": "TASKS_ADALIBPY_TRASH_FILE_ALERT_SUCCESS_TEXT",
"display_alert_text": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_ALERT_TEXT",
"display_description": {
"parameters": {
"fileName": "20170813_125133.jpg.txt"
},
"template": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_DESCRIPTION"
},
"display_title": "TASKS_ADALIBPY_TRASH_FILE_DISPLAY_TITLE",
"governance_type": null,
"has_icon": true,
"is_blocking": null,
"optional_notify": null,
"preview_only": false,
"task_name": "TrashFileTask",
"type": "file",
"uiGovernanceCategory": 1
}
],
"alternateLink": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20170813_125133.jpg.txt",
"appId": 15600,
"appName": "Microsoft OneDrive for Business",
"collaborators": [],
"createdDate": 1597009499000,
"display_collaborators": [],
"dlpScanResults": [],
"domains": [
"example.onmicrosoft.com"
],
"driveId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"effectiveParents": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|ac8c3025-8b97-4758-ac74-c4b7c5c04ea0",
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"emails": [
"john@example.onmicrosoft.com"
],
"enriched": true,
"externalShares": [],
"fTags": [],
"facl": 0,
"fileAccessLevel": "PRIVATE",
"fileExtension": "txt",
"filePath": "/personal/avishai_example_onmicrosoft_com/Documents/20170813_125133.jpg.txt",
"fileSize": 149,
"fileStatus": "EXISTS",
"fileType": "TEXT",
"fstat": 0,
"ftype": 4,
"groupIds": [],
"groups": [],
"id": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|518d4da4-ffd7-43bc-beaf-c9fdc078b281",
"instId": 0,
"isFolder": false,
"isForeign": false,
"lastNrtTimestamp": 1597025421725,
"mimeType": "text/plain",
"modifiedDate": 1597009519000,
"name": "20170813_125133.jpg.txt",
"name_l": "20170813_125133.jpg.txt",
"noGovernance": false,
"originalId": "5f306ef5c3b664209d36d024",
"ownerAddress": "john@example.onmicrosoft.com",
"ownerExternal": false,
"ownerName": "John Example",
"parentId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b",
"parentIds": [
"cac4b654-5fcf-44f0-818e-479cf8ae42ac|8f83a489-34b7-4bb6-a331-260d1291ef6b"
],
"saasId": 15600,
"scanVersion": 4,
"sharepointItem": {
"Author": {
"Email": "john@example.onmicrosoft.com",
"LoginName": "i:0#.f|membership|john@example.onmicrosoft.com",
"Title": "John Example",
"externalUser": false,
"idInSiteCollection": "4",
"name": "John Example",
"oneDriveEmail": "john@example.onmicrosoft.com",
"sipAddress": "john@example.onmicrosoft.com",
"sourceBitmask": 0,
"trueEmail": "john@example.onmicrosoft.com"
},
"Length": 149,
"LinkingUrl": "",
"ModifiedBy": {
"Email": "",
"LoginName": "i:0#.f|membership|tmcassp_fa02d7a6fe55edb22020060112572594@example.onmicrosoft.com",
"Title": "Cloud App Security Service Account for SharePoint"
},
"Name": "20170813_125133.jpg.txt",
"ServerRelativeUrl": "/personal/avishai_example_onmicrosoft_com/Documents/20170813_125133.jpg.txt",
"TimeCreated": "2020-08-09T21:44:59Z",
"TimeLastModified": "2020-08-09T21:45:19Z",
"UniqueId": "518d4da4-ffd7-43bc-beaf-c9fdc078b281",
"encodedAbsUrl": "https://example-my.sharepoint.com/personal/avishai_example_onmicrosoft_com/Documents/20170813_125133.jpg.txt",
"hasUniqueRoleAssignments": false,
"isFolder": false,
"parentUniqueId": "8f83a489-34b7-4bb6-a331-260d1291ef6b",
"roleAssignments": [],
"scopeId": "D853886D-DDEE-4A5D-BCB9-B6F072BC1413",
"urlFromMetadata": null
},
"siteCollection": "/personal/avishai_example_onmicrosoft_com",
"siteCollectionId": "cac4b654-5fcf-44f0-818e-479cf8ae42ac",
"sitePath": "/personal/avishai_example_onmicrosoft_com",
"snapshotLastModifiedDate": "2020-08-10T02:10:24.782Z",
"spDomain": "https://example-my.sharepoint.com",
"unseenScans": 0
}
]
}
}
Human Readable Output
Microsoft CAS Files
owner_name file_id file_type file_name file_access_level file_status app_name John Example 5f60838dc3b664209dab9a97 TEXT 20200525154133.JPG.txt PRIVATE EXISTS Microsoft OneDrive for Business John Example 5f39f079c3b664209de9c64c TEXT WhatsApp Image 2020-08-02 at 11.04.46.jpeg.txt PRIVATE EXISTS Microsoft OneDrive for Business John Example 5f306f37c3b664209d444bf2 TEXT 20180726150700.JPG.txt PRIVATE EXISTS Microsoft OneDrive for Business John Example 5f306f6ec3b664209d5013d3 TEXT 20180802_144154.jpg.txt PRIVATE EXISTS Microsoft OneDrive for Business John Example 5f306ef5c3b664209d36d024 TEXT 20170813_125133.jpg.txt PRIVATE EXISTS Microsoft OneDrive for Business
microsoft-cas-users-accounts-list
Returns a list of user accounts that match the specified filters. Filters include user account type, group ID, external/internal, user account status, and custom filter. The accounts object schema includes information about how users and accounts use your organization’s cloud apps.
Base Command
microsoft-cas-users-accounts-list
Input
| Argument Name | Description | Required |
|---|---|---|
| skip | The number of records to skip. | Optional |
| limit | The maximum number of records to return. Default is 50. Possible values are: . Default is 50. | Optional |
| type | The type by which to filter the information about the user accounts. | Optional |
| group_id | The group ID by which to filter the information about the user accounts. | Optional |
| is_admin | Filter the user accounts that are defined as admins. | Optional |
| is_external | The affiliation of the user accounts. Valid values are: “External”, “Internal”, and “No_value”. Possible values are: External, Internal, No_value. | Optional |
| status | The status by which to filter the information about the user accounts. Valid values are: “N/A”, “Staged”, “Active”, “Suspended”, and “Deleted”. Possible values are: N/A, Staged, Active, Suspended, Deleted. | Optional |
| custom_filter | A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MicrosoftCloudAppSecurity.UsersAccounts.displayName | String | The display name of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.id | String | The ID of the user account in the product. |
| MicrosoftCloudAppSecurity.UsersAccounts._id | String | The ID of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.isAdmin | Boolean | Whether the user account has admin privileges. |
| MicrosoftCloudAppSecurity.UsersAccounts.isExternal | Boolean | Whether the user account is external. |
| MicrosoftCloudAppSecurity.UsersAccounts.email | String | The email address of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.role | String | The role of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.organization | String | The organization to which the user account belongs. |
| MicrosoftCloudAppSecurity.UsersAccounts.lastSeen | Unknown | The date the user account was last active. |
| MicrosoftCloudAppSecurity.UsersAccounts.domain | String | The domain of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.threatScore | Unknown | The threat score of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.idType | Number | The ID type (number) of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.isFake | Boolean | Whether the user account is marked as fake. |
| MicrosoftCloudAppSecurity.UsersAccounts.username | String | The username of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.actions.task_name | String | The task name of the action of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.actions.type | String | The type of action of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts._id | String | The account ID of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.inst | Number | The number of instances of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.saas | Number | The cloud services of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.dn | String | The domain name of the cloud services of the user accounts. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.aliases | String | The user account aliases. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.isFake | Boolean | Whether the user account is marked as fake. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.em | Unknown | The email address of the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.actions.task_name | String | The task name of the action. |
| MicrosoftCloudAppSecurity.UsersAccounts.accounts.actions.type | String | The type of the action. |
| MicrosoftCloudAppSecurity.UsersAccounts.userGroups._id | String | The ID of the user group for the user account. |
| MicrosoftCloudAppSecurity.UsersAccounts.userGroups.id | String | The ID of the user group in the product. |
| MicrosoftCloudAppSecurity.UsersAccounts.userGroups.name | String | The name of the user group. |
| MicrosoftCloudAppSecurity.UsersAccounts.userGroups.usersCount | Number | The number of users in the user group. |
Command Example
!microsoft-cas-users-accounts-list status=Active limit=3
Context Example
{
"MicrosoftCloudAppSecurity": {
"UsersAccounts": [
{
"_id": "604771d8478257f44b3082bc",
"actions": [],
"appData": {
"appId": 11161,
"instance": 0,
"name": "Office 365",
"saas": 11161
},
"displayName": "365 Defender Dev",
"domain": null,
"email": null,
"id": "bf44d272-ec7d-40c6-bef2-79200b3f2d55",
"idType": 17,
"identifiers": [],
"ii": "11161|0|bf44d272-ec7d-40c6-bef2-79200b3f2d55",
"isAdmin": false,
"isExternal": true,
"isFake": false,
"organization": null,
"role": null,
"scoreTrends": null,
"sctime": null,
"sid": null,
"status": 2,
"subApps": [],
"threatScore": null,
"type": 1,
"userGroups": [
{
"_id": "5e6fa9ade2367fc6340f487e",
"description": "App-initiated",
"id": "0000003b0000000000000000",
"name": "Application (Cloud App Security)",
"usersCount": 719
},
{
"_id": "5e6fa9ace2367fc6340f4864",
"description": "Either a user who is not a member of any of the managed domains you configured in General settings or a third-party app",
"id": "000000200000000000000000",
"name": "External users",
"usersCount": 171
}
],
"username": "{\"id\": \"bf44d272-ec7d-40c6-bef2-79200b3f2d55\", \"saas\": 11161, \"inst\": 0}"
},
{
"_id": "5f01dbe4229037823e32951b",
"actions": [],
"appData": {
"appId": 11161,
"instance": 0,
"name": "Office 365",
"saas": 11161
},
"displayName": "AAD App Management",
"domain": null,
"email": null,
"id": "f0ae4899-d877-4d3c-ae25-679e38eea492",
"idType": 17,
"identifiers": [],
"ii": "11161|0|f0ae4899-d877-4d3c-ae25-679e38eea492",
"isAdmin": false,
"isExternal": false,
"isFake": false,
"organization": null,
"role": null,
"scoreTrends": null,
"sctime": null,
"sid": null,
"status": 2,
"subApps": [],
"threatScore": null,
"type": 1,
"userGroups": [
{
"_id": "5e6fa9ade2367fc6340f487e",
"description": "App-initiated",
"id": "0000003b0000000000000000",
"name": "Application (Cloud App Security)",
"usersCount": 719
}
],
"username": "{\"id\": \"f0ae4899-d877-4d3c-ae25-679e38eea492\", \"saas\": 11161, \"inst\": 0}"
},
{
"_id": "5f01db9c229037823e2bf15c",
"actions": [],
"appData": {
"appId": 11161,
"instance": 0,
"name": "Office 365",
"saas": 11161
},
"displayName": "AAD Request Verification Service - PROD",
"domain": null,
"email": null,
"id": "c728155f-7b2a-4502-a08b-b8af9b269319",
"idType": 17,
"identifiers": [],
"ii": "11161|0|c728155f-7b2a-4502-a08b-b8af9b269319",
"isAdmin": false,
"isExternal": false,
"isFake": false,
"organization": null,
"role": null,
"scoreTrends": null,
"sctime": null,
"sid": null,
"status": 2,
"subApps": [],
"threatScore": null,
"type": 1,
"userGroups": [
{
"_id": "5e6fa9ade2367fc6340f487e",
"description": "App-initiated",
"id": "0000003b0000000000000000",
"name": "Application (Cloud App Security)",
"usersCount": 719
}
],
"username": "{\"id\": \"c728155f-7b2a-4502-a08b-b8af9b269319\", \"saas\": 11161, \"inst\": 0}"
}
]
}
}
Human Readable Output
Microsoft CAS Users And Accounts
display_name is_admin is_external 365 Defender Dev false true AAD App Management false false AAD Request Verification Service - PROD false false
Configuration parameters
auth_mode— Authentication Modeendpoint_type— Endpoint Typeurl— Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)creds_token—token— User's key to access the API (for legacy method)app_id— Application IDtenant_id— Tenant ID (for Client Credentials mode)client_id—isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsseverity— Incident severitymax_fetch— Maximum alerts to fetchfirst_fetch— First fetch timeresolution_status— Incident resolution statuscustom_filter— Custom Filterlook_back— Advanced: Minutes to look back when fetching
Commands (13)
-
microsoft-cas-activities-listReturns a list of activities that match the specified filters. In case of timeout errors, please consider increasing the timeout argument.
-
microsoft-cas-alert-close-benignAn alert on a suspicious but not malicious activity, such as a penetration test or other authorized suspicious action.
-
microsoft-cas-alert-close-false-positiveClose multiple alerts matching the specified filters as false positive (an alert on a non-malicious activity).
-
microsoft-cas-alert-close-true-positiveClose multiple alerts matching the specified filters as true positive (an alert on a confirmed malicious activity.
-
microsoft-cas-alert-dismiss-bulkDeprecatedDeprecated. Use one of the alert-close commands instead. Dismisses multiple alerts (bulk dismiss) that match the specified filters.
-
microsoft-cas-alert-resolve-bulkDeprecatedDeprecated. Use one of the alert-close commands instead. Resolves multiple alerts (bulk resolve) that match the specified filters. Filters include origin IP address, IP subnet category, action taken on the activity, source type, or a custom filter.
-
microsoft-cas-alerts-listReturns a list of alerts that match the specified filters.
-
microsoft-cas-auth-completeRun this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode).
-
microsoft-cas-auth-resetRun this command if for some reason you need to rerun the authentication process.
-
microsoft-cas-auth-startRun this command to start the authorization process and follow the instructions in the command results. (for device-code mode).
-
microsoft-cas-auth-testTests the connectivity to the Microsoft 365 Defender.
-
microsoft-cas-files-listReturns a list of files that match the specified filters. Filters include file type, file share value, file extension, file quarantine status, and a custom filter. If you pass the custom_filter argument it will override the other filters in this command. This command is supported only when using the legacy authentication.
-
microsoft-cas-users-accounts-listReturns a list of user accounts that match the specified filters. Filters include user account type, group ID, external/internal, user account status, and custom filter. The accounts object schema includes information about how users and accounts use your organization's cloud apps.
category: Authentication & Identity Management provider: Microsoft sectionorder: - Connect - Collect commonfields: id: MicrosoftCloudAppSecurity version: -1 configuration: - defaultvalue: legacy display: Authentication Mode name: auth_mode options: - client credentials - legacy - device code flow type: 15 section: Connect advanced: true required: false - display: Endpoint Type name: endpoint_type required: false type: 15 section: Connect additionalinfo: |- More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-cloud-app-security defaultvalue: Worldwide options: - Worldwide - US GCC - US GCC-High - name: url type: 0 section: Connect required: true display: Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) additionalinfo: In the Security Center, go to Settings > Clod Apps > About tab, where the API URL is displayed. - name: creds_token type: 9 section: Connect required: false displaypassword: User's key to access the API (for legacy method) hiddenusername: true - display: User's key to access the API (for legacy method) name: token type: 4 section: Connect required: false hidden: true advanced: true - display: 'Application ID' name: app_id type: 0 section: Connect required: false additionalinfo: The API key to use to connect (for Client Credentials & device code flow mode). - display: 'Tenant ID (for Client Credentials mode)' name: tenant_id type: 0 section: Connect required: false - display: '' name: client_id type: 9 section: Connect required: false displaypassword: Client Secret (for Client Credentials mode) hiddenusername: true - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Incident type name: incidentType type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - display: Incident severity name: severity type: 16 section: Collect required: false options: - Low - Medium - High - All - display: Maximum alerts to fetch name: max_fetch section: Collect type: 0 required: false defaultvalue: '50' - display: First fetch time name: first_fetch type: 0 section: Collect required: false additionalinfo: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) - display: 'Incident resolution status' name: resolution_status type: 16 section: Collect advanced: true required: false options: - Open - Dismissed - Resolved - All - additionalinfo: 'A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters from the integration instance configuration. An example of a Custom Filter is: {"severity":{"eq":2}}. Note that for filtering by "entity.policy", you should use the ID of the policy. For example, for retrieving the policy: {"policyType": "ANOMALY_DETECTION", "id": "1234", "label": "Impossible travel", "type": "policyRule"}" please query on {"entity.policy":{"eq":1234}}. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters.' display: 'Custom Filter' name: custom_filter type: 0 section: Collect advanced: true required: false - additionalinfo: Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created. defaultvalue: '0' display: 'Advanced: Minutes to look back when fetching' name: look_back type: 0 section: Collect advanced: true required: false description: Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts. display: Microsoft Defender for Cloud Apps name: MicrosoftCloudAppSecurity script: commands: - description: Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode). name: microsoft-cas-auth-start - description: Run this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode). name: microsoft-cas-auth-complete - description: Run this command if for some reason you need to rerun the authentication process. name: microsoft-cas-auth-reset - description: Tests the connectivity to the Microsoft 365 Defender. name: microsoft-cas-auth-test - arguments: - description: |- A comma-separated list of alerts matching the specified filters. The alert_id should appear similar to "55af7415f8a0a7a29eef2e1f". Mandatory, unless you use a custom filter. isArray: true name: alert_ids - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters. name: custom_filter - description: A comment explaining why the alerts are being dismissed. name: comment deprecated: true description: Deprecated. Use one of the alert-close commands instead. Dismisses multiple alerts (bulk dismiss) that match the specified filters. name: microsoft-cas-alert-dismiss-bulk - arguments: - description: Skips the specified number of records. name: skip - defaultValue: '50' description: The maximum number of records to return. Default is 50. name: limit - auto: PREDEFINED description: 'The severity of the alert. Possible values are: "Low", "Medium", and "High".' name: severity predefined: - Low - Medium - High - auto: PREDEFINED description: 'The alert resolution status. Possible values are: "Open", "Dismissed", and "Resolved".' name: resolution_status predefined: - Open - Dismissed - Resolved - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters. name: custom_filter - description: The alert ID. name: alert_id description: Returns a list of alerts that match the specified filters. name: microsoft-cas-alerts-list outputs: - contextPath: MicrosoftCloudAppSecurity.Alerts._id description: The alert ID. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.timestamp description: The time the alert was created. type: Date - contextPath: MicrosoftCloudAppSecurity.Alerts.policyRule.id description: The ID of the rule that triggered the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policyRule.label description: The label of the rule that triggered the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policyRule.type description: The type of rule that triggered the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policyRule.policyType description: The policy type of the rule that triggered the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.service.id description: The cloud service ID. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.service.label description: The cloud service name. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.service.type description: The cloud service type. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.file.id description: The ID of the alert file. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.file.label description: THe label of the alert file. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.file.type description: The alert file type. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.user.id description: The ID of the user who received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.user.label description: The label of the user who received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.user.type description: The type of the user who received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.country.id description: The country ID where the alert originated. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.country.label description: The country label where the alert originated. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.country.type description: The country type where the alert originated. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.ip.id description: The IP address where the alert came. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.ip.label description: The IP label where the alert came. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.ip.type description: The IP type where the alert came. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.ip.triggeredAlert description: Whether this IP address triggered the alert. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Alerts.account.id description: The ID of the account that received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.account.label description: The label of the account that received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.account.type description: The type of the account that received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.account.inst description: The instance of the account that received the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.account.saas description: The service of the account that received the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.account.pa description: The email of the account that received the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.account.entityType description: The entity type of the account that received the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.title description: The title of the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.description description: The description of the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policy.id description: The ID of the reason (policy) that explains why the alert was triggered. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policy.label description: The label of the reason (policy) that explains why the alert was triggered. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.policy.policyType description: The policy type of the reason (policy) that explains why the alert was triggered. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.threatScore description: The threat score of the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.isSystemAlert description: Whether it is a system alert. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Alerts.statusValue description: The status value of the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.severityValue description: The severity value of the alert. type: Number - contextPath: MicrosoftCloudAppSecurity.Alerts.handledByUser description: The user who handled the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.comment description: The comment relating to the alert. type: String - contextPath: MicrosoftCloudAppSecurity.Alerts.resolveTime description: The date/time that the alert was resolved. type: Date - arguments: - description: |- A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - "1234567890abcdefg". Mandatory, unless you use a custom filter. isArray: true name: alert_ids - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-alerts#filters. name: custom_filter - description: Comment describing why the alerts were dismissed. name: comment deprecated: true description: Deprecated. Use one of the alert-close commands instead. Resolves multiple alerts (bulk resolve) that match the specified filters. Filters include origin IP address, IP subnet category, action taken on the activity, source type, or a custom filter. name: microsoft-cas-alert-resolve-bulk - arguments: - description: |- A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - "1234567890abcdefg". Mandatory, unless you use a custom filter. isArray: true name: alert_ids - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter - description: Comment describing why the alerts were dismissed. name: comment - auto: PREDEFINED description: |- The reason for closing the alerts as benign. Providing a reason helps improve the accuracy of the detection over time. Possible values include: * Actual severity is lower * Other * Confirmed with end user * Triggered by test. name: reason predefined: - Actual severity is lower - Other - Confirmed with end user - Triggered by test - auto: PREDEFINED defaultValue: 'false' description: 'Whether feedback about this alert is provided. Possible values: "false" and "true".' name: sendFeedback predefined: - 'false' - 'true' - description: The text of the feedback. name: feedbackText - auto: PREDEFINED defaultValue: 'false' description: 'Whether consent to contact the user is provided. Possible values: "false" and "true".' name: allowContact predefined: - 'false' - 'true' - description: The email address of the user. name: contactEmail description: An alert on a suspicious but not malicious activity, such as a penetration test or other authorized suspicious action. name: microsoft-cas-alert-close-benign - arguments: - description: |- A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - "1234567890abcdefg". Mandatory, unless you use a custom filter. isArray: true name: alert_ids - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter - description: Comment describing why the alerts were dismissed. name: comment - auto: PREDEFINED defaultValue: 'false' description: 'Whether feedback about this alert is provided. Possible values: "false" and "true".' name: sendFeedback predefined: - 'false' - 'true' - description: The text of the feedback. name: feedbackText - auto: PREDEFINED defaultValue: 'false' description: 'Whether consent to contact the user is provided. Possible values: "false" and "true".' name: allowContact predefined: - 'false' - 'true' - description: The email address of the user. name: contactEmail description: Close multiple alerts matching the specified filters as true positive (an alert on a confirmed malicious activity. name: microsoft-cas-alert-close-true-positive - arguments: - description: |- A comma-separated list of alerts matching the specified filters. Alert_id should appear similar to - "1234567890abcdefg". Mandatory, unless you use a custom filter. isArray: true name: alert_ids - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter - defaultValue: None description: Comment describing why the alerts were dismissed. name: comment - auto: PREDEFINED description: |- The reason for closing the alerts as false positive. Providing a reason helps improve the accuracy of the detection over time. Possible values include: * Not of interest * Too many similar alerts * Alert is not accurate * Other. name: reason predefined: - Not of interest - Too many similar alerts - Alert is not accurate - Other - auto: PREDEFINED defaultValue: 'false' description: 'Whether feedback about this alert is provided. Possible values: "false" and "true".' name: sendFeedback predefined: - 'false' - 'true' - description: The text of the feedback. name: feedbackText - auto: PREDEFINED defaultValue: 'false' description: 'Whether consent to contact the user is provided. Possible values: "false" and "true".' name: allowContact predefined: - 'false' - 'true' - description: The email address of the user. name: contactEmail description: Close multiple alerts matching the specified filters as false positive (an alert on a non-malicious activity). name: microsoft-cas-alert-close-false-positive - arguments: - defaultValue: '50' description: The number of records to skip. name: skip - auto: PREDEFINED defaultValue: 'false' description: 'Whether this command should return more than 100 results. Possible values: "false" and "true".' name: is_scan predefined: - 'false' - 'true' - defaultValue: '50' description: Maximum number of records returned to the user. name: limit - description: The origin of the specified IP address. name: ip - auto: PREDEFINED description: 'The subnet categories. Valid values are: "Corporate", "Administrative", "Risky", "VPN", "Cloud_provider", and "Other".' name: ip_category predefined: - Corporate - Administrative - Risky - VPN - Cloud_provider - Other - auto: PREDEFINED description: 'The actions taken on activities. Valid values are: "block", "proxy", "BypassProxy", "encrypt", "decrypt", "verified", "encryptionFailed", "protect", "verify", and "null".' name: taken_action predefined: - block - proxy - BypassProxy - encrypt - decrypt - verified - encryptionFailed - protect - verify - auto: PREDEFINED description: 'The source type. Valid values are: "Access_control", "Session_control", "App_connector", "App_connector_analysis", "Discovery", and "MDATP".' name: source predefined: - Access_control - Session_control - App_connector - App_connector_analysis - Discovery - MDATP - description: A custom filter by which to filter the returned activities. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter - description: The ID of the activity. name: activity_id - description: Timeout of the request to Microsoft CAS, in seconds. Default is 60 seconds. name: timeout description: Returns a list of activities that match the specified filters. In case of timeout errors, please consider increasing the timeout argument. name: microsoft-cas-activities-list outputs: - contextPath: IP.Address description: IP address. type: String - contextPath: IP.Geo.Location description: 'The geolocation where the IP address is located, in the format: latitude:longitude.' type: String - contextPath: MicrosoftCloudAppSecurity.Activities._id description: The ID of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.saasId description: The ID of the cloud service. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.timestamp description: The time the activity occurred. type: Date - contextPath: MicrosoftCloudAppSecurity.Activities.instantiation description: The instantiation of the activity. type: Date - contextPath: MicrosoftCloudAppSecurity.Activities.created description: The time the activity was created. type: Date - contextPath: MicrosoftCloudAppSecurity.Activities.eventTypeValue description: The event type of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.device.clientIP description: The device client IP address of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.device.userAgent description: The user agent of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.device.countryCode description: The country code (name) of the device. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.location.countryCode description: The country code (name) of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.location.city description: The city of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.location.region description: The region of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.location.longitude description: The longitude of the activity. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.location.latitude description: The latitude of the activity. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.location.categoryValue description: The category value of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.user.userName description: The username associated with the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.family description: The family of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.name description: The name of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.operatingSystem.name description: The name of the operating system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.operatingSystem.family description: The family of the operating system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.type description: The type of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.typeName description: The name of the type of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.version description: The version of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.deviceType description: The device type of the system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.nativeBrowser description: The native browser type of the system in which the activity occurred. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.os description: The operating system in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.userAgent.browser description: The browser in which the activity occurred. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.instanceId description: The ID of the instance of the event objects. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.saasId description: The ID of the cloud service of the event objects. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.mainInfo.eventObjects.id description: The ID of the event objects. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.mainInfo.activityResult.isSuccess description: Whether the activities were successful. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Activities.mainInfo.type description: The type of activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.confidenceLevel description: The confidence level of the activity. type: Number - contextPath: MicrosoftCloudAppSecurity.Activities.resolvedActor.id description: The user ID of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.resolvedActor.saasId description: The user cloud service ID of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.resolvedActor.instanceId description: The user instance ID of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.resolvedActor.name description: The username of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.eventTypeName description: The event that triggered the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.classifications description: The classifications of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.entityData.displayName description: The display name of entity activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.entityData.id.id description: The ID of the entity activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.entityData.resolved description: Whether the entity was resolved. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Activities.description description: The description of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.genericEventType description: The generic event type of the activity. type: String - contextPath: MicrosoftCloudAppSecurity.Activities.severity description: The severity of the activity. type: String - arguments: - defaultValue: '50' description: Skips the specified number of records. name: skip - description: Maximum number of records to return. Default is 50. name: limit - auto: PREDEFINED description: 'The file type. Valid value are: Other, Document, Spreadsheet, Presentation, Text, Image, and Folder.' name: file_type predefined: - Other - Document - Spreadsheet - Presentation - Text - Image - Folder - auto: PREDEFINED description: 'Filter files with the specified sharing levels. Valid values are: Private, Internal, External, Public, Public_Internet.' name: sharing predefined: - Private - Internal - External - Public - Public_Internet - description: Filter files by the specified file extension. name: extension - auto: PREDEFINED description: 'Filter by whether the file is quarantined. Valid values are: "True" or "False".' name: quarantined predefined: - 'True' - 'False' - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter - description: Filter by the file ID. name: file_id description: Returns a list of files that match the specified filters. Filters include file type, file share value, file extension, file quarantine status, and a custom filter. If you pass the custom_filter argument it will override the other filters in this command. This command is supported only when using the legacy authentication. name: microsoft-cas-files-list outputs: - contextPath: MicrosoftCloudAppSecurity.Files._id description: The ID of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.saasId description: The cloud service ID of the file. type: Number - contextPath: MicrosoftCloudAppSecurity.Files.instId description: The instance ID of the file. type: Number - contextPath: MicrosoftCloudAppSecurity.Files.fileSize description: The size of the file. type: Number - contextPath: MicrosoftCloudAppSecurity.Files.createdDate description: The date the file was created. type: Date - contextPath: MicrosoftCloudAppSecurity.Files.modifiedDate description: The date the file was last modified. type: Date - contextPath: MicrosoftCloudAppSecurity.Files.parentId description: The parent ID of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.ownerName description: The name of the file owner. type: String - contextPath: MicrosoftCloudAppSecurity.Files.isFolder description: Whether the file is a folder. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Files.fileType description: The file type. type: String - contextPath: MicrosoftCloudAppSecurity.Files.name description: The name of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.isForeign description: Whether the file is foreign. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Files.noGovernance description: Whether the file is no governance. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Files.fileAccessLevel description: The access level of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.ownerAddress description: The email address of the file owner. type: String - contextPath: MicrosoftCloudAppSecurity.Files.externalShares description: The external shares of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.domains description: The domains of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.mimeType description: The mime type of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.ownerExternal description: Whether the owner of this file is external. type: Boolean - contextPath: MicrosoftCloudAppSecurity.Files.fileExtension description: The file extension. type: String - contextPath: MicrosoftCloudAppSecurity.Files.groupIds description: The group IDs of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.groups description: The group the file belongs to. type: String - contextPath: MicrosoftCloudAppSecurity.Files.collaborators description: The collaborators of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.fileStatus description: The status of the file. type: String - contextPath: MicrosoftCloudAppSecurity.Files.appName description: The name of the app. type: String - contextPath: MicrosoftCloudAppSecurity.Files.actions.task_name description: The name of the task. type: String - contextPath: MicrosoftCloudAppSecurity.Files.actions.type description: The type of actions taken on the file. type: String - arguments: - description: The number of records to skip. name: skip - defaultValue: '50' description: The maximum number of records to return. Default is 50. name: limit predefined: - '' - description: The type by which to filter the information about the user accounts. name: type - description: The group ID by which to filter the information about the user accounts. name: group_id - description: Filter the user accounts that are defined as admins. name: is_admin - auto: PREDEFINED description: 'The affiliation of the user accounts. Valid values are: "External", "Internal", and "No_value".' name: is_external predefined: - External - Internal - No_value - auto: PREDEFINED description: 'The status by which to filter the information about the user accounts. Valid values are: "N/A", "Staged", "Active", "Suspended", and "Deleted".' name: status predefined: - N/A - Staged - Active - Suspended - Deleted - description: A custom filter by which to filter the returned files. If you pass the custom_filter argument it will override the other filters in this command. For more information about filter syntax, refer to https://docs.microsoft.com/en-us/cloud-app-security/api-activities#filters. name: custom_filter description: Returns a list of user accounts that match the specified filters. Filters include user account type, group ID, external/internal, user account status, and custom filter. The accounts object schema includes information about how users and accounts use your organization's cloud apps. name: microsoft-cas-users-accounts-list outputs: - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.displayName description: The display name of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.id description: The ID of the user account in the product. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts._id description: The ID of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.isAdmin description: Whether the user account has admin privileges. type: Boolean - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.isExternal description: Whether the user account is external. type: Boolean - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.email description: The email address of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.role description: The role of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.organization description: The organization to which the user account belongs. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.lastSeen description: The date the user account was last active. type: Unknown - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.domain description: The domain of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.threatScore description: The threat score of the user account. type: Unknown - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.idType description: The ID type (number) of the user account. type: Number - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.isFake description: Whether the user account is marked as fake. type: Boolean - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.username description: The username of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.actions.task_name description: The task name of the action of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.actions.type description: The type of action of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts._id description: The account ID of the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.inst description: The number of instances of the user account. type: Number - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.saas description: The cloud services of the user account. type: Number - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.dn description: The domain name of the cloud services of the user accounts. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.aliases description: The user account aliases. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.isFake description: Whether the user account is marked as fake. type: Boolean - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.em description: The email address of the user account. type: Unknown - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.actions.task_name description: The task name of the action. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.accounts.actions.type description: The type of the action. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.userGroups._id description: The ID of the user group for the user account. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.userGroups.id description: The ID of the user group in the product. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.userGroups.name description: The name of the user group. type: String - contextPath: MicrosoftCloudAppSecurity.UsersAccounts.userGroups.usersCount description: The number of users in the user group. type: Number dockerimage: demisto/crypto:1.0.0.10120494 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - MicrosoftCloudAppSecurity-Test fromversion: 5.0.0