category: Data Enrichment & Threat Intelligence
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Management Activity API (O365 Azure Events)
  version: -1
configuration:
- defaultvalue: https://manage.office.com/api/v1.0/
  display: Base URL
  name: base_url
  type: 0
  section: Connect
  required: false
- display: Application ID or Client ID
  additionalinfo: See the Help tab.
  name: auth_id
  type: 4
  section: Connect
  hidden: true
  required: false
- displaypassword: Application ID or Client ID
  additionalinfo: See the Help tab.
  name: credentials_auth_id
  hiddenusername: true
  section: Connect
  type: 9
  required: false
- display: Token or Tenant ID
  additionalinfo: See the Help tab.
  name: refresh_token
  type: 4
  section: Connect
  hidden: true
  required: false
- displaypassword: Token or Tenant ID
  additionalinfo: See the Help tab.
  name: credentials_refresh_token
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- display: Key or Client Secret
  additionalinfo: See the Help tab.
  name: enc_key
  type: 4
  section: Connect
  hidden: true
  required: false
- displaypassword: Key or Client Secret
  additionalinfo: See the Help tab.
  name: credentials_enc_key
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- additionalinfo: Used for certificate authentication as it appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  hidden: true
  section: Connect
  required: false
- displaypassword: Certificate Thumbprint
  additionalinfo: Used for certificate authentication as it appears in the "Certificates & secrets" page of the app.
  name: credentials_certificate_thumbprint
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  section: Connect
  required: false
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self-deployed Azure application
  name: self_deployed
  type: 8
  section: Connect
  advanced: false
  required: false
- display: Application redirect URI (for self-deployed mode)
  name: redirect_uri
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Authorization code (for self-deployed mode)
  additionalinfo: Run the !ms-management-activity-generate-login-url command to generate the Authorization code.
  name: auth_code
  type: 4
  section: Connect
  hidden: true
  required: false
- displaypassword: Authorization code (for self-deployed mode)
  additionalinfo: Run the !ms-management-activity-generate-login-url command to generate the Authorization code.
  name: credentials_auth_code
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  section: Connect
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 10 minutes
  display: First fetch time range
  additionalinfo: <number> <time unit>, for example 1 hour, 30 minutes
  name: first_fetch_delta
  type: 0
  section: Collect
  required: false
- additionalinfo: The default timeout (in seconds) for API calls. Default is 15 seconds.
  defaultvalue: 15
  display: Timeout
  name: timeout
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Content types to fetch
  name: content_types_to_fetch
  options:
  - Audit.AzureActiveDirectory
  - Audit.Exchange
  - Audit.SharePoint
  - Audit.General
  - DLP.All
  section: Collect
  type: 16
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Record types to fetch
  additionalinfo: A comma-separated list of the record types you want to fetch. Content records with a record type that is not specified will not be fetched. If this field is left empty, all record types will be fetched.
  name: record_types_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Workloads to fetch
  additionalinfo: A comma-separated list of the workloads you want to fetch. Content records with a workload that is not specified will not be fetched. If this field is left empty, all workloads will be fetched.
  name: workloads_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Operations to fetch
  additionalinfo: "A comma-separated list of the operations you want to fetch. Content records with an operation that is not specified will not be fetched. If this field is left empty, all operations will be fetched. Important: This field is case-sensitive."
  name: operations_filter
  type: 0
  section: Collect
  advanced: true
  required: false
description: The Microsoft Management Activity API integration enables you to subscribe or unsubscribe to different audits, receive their content, and fetch new content as incidents.
display: Microsoft Management Activity API (O365 Azure Events)
name: Microsoft Management Activity API (O365 Azure Events)
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: The content type to subscribe to.
      name: content_type
      predefined:
      - Audit.AzureActiveDirectory
      - Audit.Exchange
      - Audit.SharePoint
      - Audit.General
      - DLP.All
      required: true
    description: Starts a subscription to a given content type.
    name: ms-management-activity-start-subscription
  - arguments:
    - auto: PREDEFINED
      description: The content type to unsubscribe from.
      name: content_type
      predefined:
      - Audit.AzureActiveDirectory
      - Audit.Exchange
      - Audit.SharePoint
      - Audit.General
      - DLP.All
      required: true
    description: Stops a subscription to a given content type.
    name: ms-management-activity-stop-subscription
  - description: List the content types you are currently subscribed to.
    name: ms-management-activity-list-subscriptions
    outputs:
    - contextPath: MicrosoftManagement.Subscription
      description: List of current subscriptions.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The content type for which to receive content.
      name: content_type
      predefined:
      - Audit.AzureActiveDirectory
      - Audit.Exchange
      - Audit.SharePoint
      - Audit.General
      - DLP.All
      required: true
    - description: 'The earliest time to get content from. If start_time is specified, end_time must also be specified. The start_time must be before the end_time, can be at most 7 days ago, and has to be within 24 hours from end_time. Required format: YYYY-MM-DDTHH:MM:SS. If not specified, start time will be 24 hours ago.'
      name: start_time
    - description: 'The latest time to get content from. If end_time is specified, start_time must be also specified. The start_time must be before the end_time and has to be within 24 hours from start_time. Required format: YYYY-MM-DDTHH:MM:SS. If not specified, end_time will be now.'
      name: end_time
    - description: A comma-separated list of the record types to fetch. Content records with a record type that isn't specified will not be fetched. If this field is left empty, all record types will be fetched.
      name: record_types_filter
    - description: A comma-separated list of the workloads to fetch. Content records with a workload that isn't specified will not be fetched. If this field is left empty, all workloads will be fetched.
      name: workloads_filter
    - description: "A comma-separated list of the operations to fetch. Content records with an operation that isn't specified will not be fetched. If this field is left empty, all operations will be fetched. Important: This field is case-sensitive."
      name: operations_filter
    - description: The timeout (in seconds) for the content requesting HTTP call. Default is the value provided as an integration parameter.
      name: timeout
    description: Returns all content of a specific content type.
    name: ms-management-activity-list-content
    outputs:
    - contextPath: MicrosoftManagement.ContentRecord.ID
      description: The ID of the record.
      type: number
    - contextPath: MicrosoftManagement.ContentRecord.CreationTime
      description: The creation time of the record.
      type: date
    - contextPath: MicrosoftManagement.ContentRecord.RecordType
      description: The type of the record.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.Operation
      description: The operation described in the record.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.UserType
      description: The type of the related user.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.OrganizationID
      description: The ID of the organization relevant to the record.
      type: number
    - contextPath: MicrosoftManagement.ContentRecord.UserKey
      description: The key of the related user.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.ClientIP
      description: The IP of the record's client.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.Scope
      description: The scope of the record.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.Workload
      description: The workload of the record.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.ResultsStatus
      description: The results status of the record.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.ObjectID
      description: The ID of the record's object.
      type: string
    - contextPath: MicrosoftManagement.ContentRecord.UserID
      description: The ID of the record's user.
      type: string
  - description: Generate the login url used for Authorization code flow.
    name: ms-management-activity-generate-login-url
    arguments: []
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: ms-management-activity-auth-reset
    arguments: []
  dockerimage: demisto/auth-utils:1.0.0.10133006
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test
fromversion: 5.0.0