Office 365 and Azure (Audit Log) (v2.0.10)
Search the unified audit log to view user and administrator activity in your organization.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Cloud Service Provider
Integrations (1)
- Microsoft Policy And Compliance (Audit Log)
Playbooks (2)
- Office 365 and Azure Configuration Analysis
- Office 365 and Azure Hunting
README
Need to find if a user viewed a specific document or purged an item from their mailbox? If so, use the Microsoft Policy And Compliance (Audit Log) integration to search the unified audit log to view user and administrator activity in your organization.
The unified audit log contains events from
- Exchange Online
- SharePoint Online
- OneDrive for Business
- Entra ID
- Microsoft Teams
- Power BI
- and other Microsoft 365 services
You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
What does this pack do?
You can search for the following types of user and admin activity in Microsoft 365:
- User activity in SharePoint Online and OneDrive for Business
- User activity in Exchange Online (Exchange mailbox audit logging)
- Admin activity in SharePoint Online
- Admin activity in Entra ID (the directory service for Microsoft 365)
- Admin activity in Exchange Online (Exchange admin audit logging)
- eDiscovery activities in the security and compliance center
- User and admin activity in Power BI
- User and admin activity in Microsoft Teams
- User and admin activity in Dynamics 365
- User and admin activity in Yammer
- User and admin activity in Microsoft Power Automate
- User and admin activity in Microsoft Stream
- Analyst and admin activity in Microsoft Workplace Analytics
- User and admin activity in Microsoft Power Apps
- User and admin activity in Microsoft Forms
- User and admin activity for sensitivity labels for sites that use SharePoint Online or Microsoft Teams
This pack includes the Microsoft Policy And Compliance (Audit Log) integration.