<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">action</span>
<span class="pill kill-chain">app</span>
<span class="pill kill-chain">AppId</span>
<span class="pill kill-chain">authentication_service</span>
<span class="pill kill-chain">change_type</span>
<span class="pill kill-chain">client_info_str</span>
<span class="pill kill-chain">ClientInfoString</span>
<span class="pill kill-chain">ClientIP</span>
<span class="pill kill-chain">ClientIPAddress</span>
<span class="pill kill-chain">ClientProcessName</span>
<span class="pill kill-chain">ClientRequestId</span>
<span class="pill kill-chain">ClientVersion</span>
<span class="pill kill-chain">command</span>
<span class="pill kill-chain">CreationTime</span>
<span class="pill kill-chain">dataset_name</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">dest_name</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">ExternalAccess</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">Id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">InternalLogonType</span>
<span class="pill kill-chain">Item.Id</span>
<span class="pill kill-chain">Item.ParentFolder.Id</span>
<span class="pill kill-chain">Item.ParentFolder.MemberRights</span>
<span class="pill kill-chain">Item.ParentFolder.MemberSid</span>
<span class="pill kill-chain">Item.ParentFolder.MemberUpn</span>
<span class="pill kill-chain">Item.ParentFolder.Name</span>
<span class="pill kill-chain">Item.ParentFolder.Path</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">LogonType</span>
<span class="pill kill-chain">LogonUserSid</span>
<span class="pill kill-chain">MailboxGuid</span>
<span class="pill kill-chain">MailboxOwnerSid</span>
<span class="pill kill-chain">MailboxOwnerUPN</span>
<span class="pill kill-chain">object</span>
<span class="pill kill-chain">object_attrs</span>
<span class="pill kill-chain">object_category</span>
<span class="pill kill-chain">object_id</span>
<span class="pill kill-chain">Operation</span>
<span class="pill kill-chain">OrganizationId</span>
<span class="pill kill-chain">OrganizationName</span>
<span class="pill kill-chain">OriginatingServer</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">record_type</span>
<span class="pill kill-chain">RecordType</span>
<span class="pill kill-chain">result</span>
<span class="pill kill-chain">ResultStatus</span>
<span class="pill kill-chain">SessionId</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">src</span>
<span class="pill kill-chain">src_ip</span>
<span class="pill kill-chain">status</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">tenant_id</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">user</span>
<span class="pill kill-chain">user_agent</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">user_type</span>
<span class="pill kill-chain">UserId</span>
<span class="pill kill-chain">UserKey</span>
<span class="pill kill-chain">UserType</span>
<span class="pill kill-chain">vendor_account</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
<span class="pill kill-chain">Workload</span>
</div>
Data Source: O365 ModifyFolderPermissions
Description
Logs modifications to folder permissions in Microsoft 365, including updates to access levels, user assignments, and sharing settings.
Details
| Property | Value |
|---|---|
| Source | o365 |
| Sourcetype | o365:management:activity |
| Separator | Operation |
Related Detections
Supported Apps
- Splunk Add-on for Microsoft Office 365 (version 6.1.1)
Event Fields
Fields
Example Log
1{"CreationTime": "2024-03-29T17:57:58", "Id": "ddf699c8-3af5-40b6-ec3c-08dc5019c477", "Operation": "ModifyFolderPermissions", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "120.1.121.43", "UserId": "user15@splunkresearch.com", "AppId": "00b41c95-dab0-4487-9791-b9d2c32c80f2", "ClientIPAddress": "120.1.121.43", "ClientInfoString": "Client=WebServices;python-requests/2.25.1;", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.com", "OrganizationName": "splunkresearch.com", "OriginatingServer": "MN2PR18MB3053 (15.20.4200.000)\r\n", "SessionId": "8cdbf96a-3133-4d0d-a68e-7d7a883b8f8f", "Item": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}
Required Output Fields
-
dest
-
user
-
src
-
vendor_account
-
vendor_product
Source: GitHub | Version: 4