How to set up a search to Retrieve Office 365 audit event property retrieval?

JohnMoeVita — Fri, 08 Apr 2022 14:27:01 GMT

I'm trying to set up a search to return Office 365 role change events for specific roles, such as the Global Administrator (aka Company Administrator). The event data seems to be structured like this (simplified for clarity):

{ Id: <someGuid> ModifiedProperties: [ { Name: Role.ObjectID NewValue: OldValue: <someGuid> }, { Name: Role.DisplayName NewValue: OldValue: Company Administrator }, { Name: Role.TemplateId NewValue: OldValue: <someGuid> }, { Name: Role.WellKnownObjectName NewValue: OldValue: TenantAdmins } ] ObjectId: <UPN of object modified> Operation: <what was done> UserId: <UPN of user that made change }

I want to extract the value OldValue of ModifiedProperties object where Name = Role.DisplayName into a field. I've had a look, and had thought either spath or eval would help, but I couldn't see any extra fields being created when I used either, much less being able to then extract data from it.

Am I on the right track? Or looking at it all wrong? My base search is this:

sourcetype="o365:management:activity" AND RecordType=8 AND (ModifiedProperties{}.NewValue="TenantAdmins" OR ModifiedProperties{}.OldValue="TenantAdmins")

I then tried to push it through eval like this:

| eval 'ModifiedProperties{}.Name'='ModifiedProperties{}.OldValue'

I thought I understood that should have added 4 extra fields (to match the four ModifiedProperties objects) to the returned event, but the events didn't change.

Can anyone lend a hand?

Re: Retrieve Office 365 audit event property retrieval

chgota — Fri, 08 Apr 2022 08:52:33 GMT

I came across this post while trying to figure out how to solve the same issue, and I think I've worked it out:

| eval old_role_name = mvindex('modifiedProperties{}.oldValue', mvfind('modifiedProperties{}.displayName', "Role\.DisplayName"))

modifiedProperties{}.oldValue and modifiedProperties{}.displayName are both multivalue fields. I found the mv index number of modifiedProperties{}.displayName where the value is Role.DisplayName using mvfind, then used that index number to extract the correct value from modifiedProperties{}.oldValue into a new field with mvindex.

(The backslash in the second argument of mvfind is because it's actually a regex, not a vanilla string).

topic Re: Retrieve Office 365 audit event property retrieval in Splunk Search

How to set up a search to Retrieve Office 365 audit event property retrieval?

Re: Retrieve Office 365 audit event property retrieval