MicrosoftPolicyAndComplianceAuditLog

Use the integration to get logs from the O365 service.

Data Enrichment & Threat Intelligence · Office 365 and Azure (Audit Log)

Configuration parameters

  • certificate — Certificate (required)
  • organization — The organization used in app-only authentication. (required)
  • app_id — The application ID from the Azure portal (required)
  • insecure — Trust any certificate (not secure)

Commands (1)

  • o365-auditlog-search

    Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.