topic What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? in All Apps and Add-ons

What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services?

ssanplunk — Wed, 30 Jan 2019 06:11:58 GMT

Hi, all
I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.

While reviewing the collected logs, I saw a log that the UserId field is "notracking@example.com", but I do not know what it means.
I want to make sure that "notracking@example.com" is provided by Office 365, or information generated by add-on.

The RecordType for that log is 41.

Office 365 Management Schema documents do not provide this information.

{ [-]
AppName: Mail

AppVersion: 0.0.0000

CreationTime: 2019-01-28T22:37:20

Id: #blind#

OS: Win32

Operation: TIUrlClickData
OrganizationId: #blind#
RecordType: 41
SourceId: #blind#

SourceWorkload: Mailflow

TimeOfClick: 2019-01-28T22:34:40

Url: http://abcde.com/?61o1EX=IGCQlSQRYNiGBrD0ALmQHT3LUw

UrlClickAction: 2

UserId: notracking@example.com

UserIp: 10.10.10.10

UserKey: ThreatIntel

UserType: 4

Version: 1

Workload: ThreatIntelligence
}

Thank you.

Re: What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services?

mayurr98 — Tue, 29 Sep 2020 23:00:46 GMT

I have used this add-on as far as I know UserId is not created by this add-on. It is created by O365 management activity schema.
and it means

The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included.
have a look at this doc for more info:
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema

let me know if this helps!

Re: What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services?

ssanplunk — Fri, 01 Feb 2019 01:41:19 GMT

Hi,

Thank you for your help.
I checked more information in doc!