Data Source: M365 Copilot Graph API

Created: 2025-10-13

Last Updated: 2026-10-14

ID: 30dd2202-869c-47fb-ad37-4f4d4c93c6b7

Author: Rod Soto, Splunk

Description

Access Logs from M365 Copilot access via Graph API

Details

Property	Value
Source	`AuditLogs.SignIns`
Sourcetype	`o365:graph:api`

Name ▲▼	Technique ▲▼	Type ▲▼
M365 Copilot Application Usage Pattern Anomalies	Valid Accounts	Anomaly
M365 Copilot Failed Authentication Patterns	Brute Force	Anomaly
M365 Copilot Non Compliant Devices Accessing M365 Copilot	Disable or Modify Tools	Anomaly
M365 Copilot Session Origin Anomalies	Valid Accounts	Anomaly

Supported Apps

Splunk Add-on for Microsoft Office 365 (version 6.1.1)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">appDisplayName</span>
  
  <span class="pill kill-chain">appId</span>
  
  <span class="pill kill-chain">clientAppUsed</span>
  
  <span class="pill kill-chain">conditionalAccessStatus</span>
  
  <span class="pill kill-chain">correlationId</span>
  
  <span class="pill kill-chain">createdDateTime</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">deviceDetail.browser</span>
  
  <span class="pill kill-chain">deviceDetail.deviceId</span>
  
  <span class="pill kill-chain">deviceDetail.displayName</span>
  
  <span class="pill kill-chain">deviceDetail.isCompliant</span>
  
  <span class="pill kill-chain">deviceDetail.isManaged</span>
  
  <span class="pill kill-chain">deviceDetail.operatingSystem</span>
  
  <span class="pill kill-chain">deviceDetail.trustType</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Exchange Mailbox Storage Used (Byte)</span>
  
  <span class="pill kill-chain">Exchange Mailbox Total Item Count</span>
  
  <span class="pill kill-chain">Exchange Received Email Count</span>
  
  <span class="pill kill-chain">External Member Count</span>
  
  <span class="pill kill-chain">Group Display Name</span>
  
  <span class="pill kill-chain">Group Id</span>
  
  <span class="pill kill-chain">Group Type</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">ipAddress</span>
  
  <span class="pill kill-chain">Is Deleted</span>
  
  <span class="pill kill-chain">isInteractive</span>
  
  <span class="pill kill-chain">Last Activity Date</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">location.city</span>
  
  <span class="pill kill-chain">location.countryOrRegion</span>
  
  <span class="pill kill-chain">location.geoCoordinates.altitude</span>
  
  <span class="pill kill-chain">location.geoCoordinates.latitude</span>
  
  <span class="pill kill-chain">location.geoCoordinates.longitude</span>
  
  <span class="pill kill-chain">location.state</span>
  
  <span class="pill kill-chain">Member Count</span>
  
  <span class="pill kill-chain">Owner Principal Name</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">Report Period</span>
  
  <span class="pill kill-chain">Report Refresh Date</span>
  
  <span class="pill kill-chain">resourceDisplayName</span>
  
  <span class="pill kill-chain">resourceId</span>
  
  <span class="pill kill-chain">riskDetail</span>
  
  <span class="pill kill-chain">riskLevelAggregated</span>
  
  <span class="pill kill-chain">riskLevelDuringSignIn</span>
  
  <span class="pill kill-chain">riskState</span>
  
  <span class="pill kill-chain">SharePoint Active File Count</span>
  
  <span class="pill kill-chain">SharePoint Site Storage Used (Byte)</span>
  
  <span class="pill kill-chain">SharePoint Total File Count</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">status.additionalDetails</span>
  
  <span class="pill kill-chain">status.errorCode</span>
  
  <span class="pill kill-chain">status.failureReason</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">userDisplayName</span>
  
  <span class="pill kill-chain">userId</span>
  
  <span class="pill kill-chain">userPrincipalName</span>
  
  <span class="pill kill-chain">Yammer Liked Message Count</span>
  
  <span class="pill kill-chain">Yammer Posted Message Count</span>
  
  <span class="pill kill-chain">Yammer Read Message Count</span>
  
</div>

Example Log

1{"Report Refresh Date": "2025-08-18", "Group Display Name": "7D3654B07E126BBD0D18174368FC243F", "Is Deleted": "False", "Owner Principal Name": "", "Last Activity Date": "", "Group Type": "Public", "Member Count": "0", "External Member Count": "0", "Exchange Received Email Count": "", "SharePoint Active File Count": "", "Yammer Posted Message Count": "", "Yammer Read Message Count": "", "Yammer Liked Message Count": "", "Exchange Mailbox Total Item Count": "7", "Exchange Mailbox Storage Used (Byte)": "259147", "SharePoint Total File Count": "0", "SharePoint Site Storage Used (Byte)": "0", "Group Id": "00000000-0000-0000-0000-000000000000", "Report Period": "1", "timestamp": "2025-08-20T11:30:37Z"}

Source: GitHub | Version: 3

Data Source: M365 Copilot Graph API

Description

Details

Related Detections

Supported Apps

Event Fields

Example Log