GitHub Repo

Microsoft 365 Data Sources

Name Platform Sourcetype Source Supported TA Date
O365 UserLoggedIn Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Add app role assignment grant to user. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Update application. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Set-Mailbox Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Add owner to application. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Update user. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Add service principal. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 ModifyFolderPermissions Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Add member to role. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
Office 365 Universal Audit Log Microsoft 365 o365:management:activity o365 Splunk Microsoft Office 365 Add-on
O365 Change user license. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 MailItemsAccessed Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Add app role assignment to service principal. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Set Company Information. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 UserLoginFailed Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Disable Strong Authentication. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
M365 Copilot Graph API Microsoft 365 o365:graph:api AuditLogs.SignIns Splunk Add-on for Microsoft Office 365
O365 Update authorization policy. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
O365 Consent to application. Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365
Office 365 Reporting Message Trace Microsoft 365 o365:reporting:messagetrace o365 Splunk Microsoft Office 365 Add-on
O365 Add-MailboxPermission Microsoft 365 o365:management:activity o365 Splunk Add-on for Microsoft Office 365