Microsoft Management Activity API (O365 Azure Events)

The Microsoft Management Activity API integration enables you to subscribe or unsubscribe to different audits, receive their content, and fetch new content as incidents.

Category

Data Enrichment & Threat Intelligence

Pack

MicrosoftManagementActivity

Configuration parameters

• base_url — Base URL
• auth_id — Application ID or Client ID
• credentials_auth_id —
• refresh_token — Token or Tenant ID
• credentials_refresh_token —
• enc_key — Key or Client Secret
• credentials_enc_key —
• certificate_thumbprint — Certificate Thumbprint
• credentials_certificate_thumbprint —
• private_key — Private Key
• self_deployed — Use a self-deployed Azure application
• redirect_uri — Application redirect URI (for self-deployed mode)
• auth_code — Authorization code (for self-deployed mode)
• credentials_auth_code —
• use_managed_identities — Use Azure Managed Identities
• managed_identities_client_id —
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• first_fetch_delta — First fetch time range
• timeout — Timeout
• content_types_to_fetch — Content types to fetch
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• record_types_filter — Record types to fetch
• workloads_filter — Workloads to fetch
• operations_filter — Operations to fetch

Commands (6)

• ms-management-activity-auth-reset — Run this command if for some reason you need to rerun the authentication process.
• ms-management-activity-generate-login-url — Generate the login url used for Authorization code flow.
• ms-management-activity-list-content — Returns all content of a specific content type.
• ms-management-activity-list-subscriptions — List the content types you are currently subscribed to.
• ms-management-activity-start-subscription — Starts a subscription to a given content type.
• ms-management-activity-stop-subscription — Stops a subscription to a given content type.