How can I get Membership information?

risingflight143 — Thu, 22 Jun 2023 05:45:37 GMT

Hi All

i have an unified group(i.e office365 unified group) created from Office365. i want to know membership details i.e who has added/removed users to this group. This group will also be visible in Azure AD. i can check audit logs in Azure AD and it shows only for a month. i am trying below splunk query to fetch membership information from both Azure AD and office365 but i am not getting output. ug@contoso.com is my group name

sourcetype=azure*:management:activity (Operation="*Change user*" OR Operation="*Update user*") ObjectId="*ug@contoso.com*" (UserId!="Certificate" AND UserId!="ServicePrincipal*" AND UserId!="Sync*") (ModifiedProperties{}.NewValue!=" " AND ModifiedProperties{}.OldValue!=" ") | rename ModifiedProperties{}.NewValue AS ModAdd | rename ModifiedProperties{}.OldValue AS ModRem | rename UserId AS "Actioned By" | rename Operation AS "Action" | rename ObjectId AS "Member" | sort -_time | table _time, ModAdd, ModRem, "Action", Member, "Actioned By"

Re: Membership information

yuanliu — Wed, 21 Jun 2023 07:26:03 GMT

To obtain help from volunteers, you will first need to post sample data (anonymize as needed) that can support your belief that the search should return output. If the logic is not obvious, you also need to explain your logic between raw data and your expected output.

topic How can I get Membership information? in Splunk Search

How can I get Membership information?

Re: Membership information