What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services?

[ssanplunk]

Hi, all
I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.

While reviewing the collected logs, I saw a log that the UserId field is "notracking@example.com", but I do not know what it means.
I want to make sure that "notracking@example.com" is provided by Office 365, or information generated by add-on.

The RecordType for that log is 41.

Office 365 Management Schema documents do not provide this information.

{ [-]
AppName: Mail

AppVersion: 0.0.0000

CreationTime: 2019-01-28T22:37:20

Id: #blind#

OS: Win32

Operation: TIUrlClickData
OrganizationId: #blind#
RecordType: 41
SourceId: #blind#

SourceWorkload: Mailflow

TimeOfClick: 2019-01-28T22:34:40

Url: http://abcde.com/?61o1EX=IGCQlSQRYNiGBrD0ALmQHT3LUw

UrlClickAction: 2

UserId: notracking@example.com

UserIp: 10.10.10.10

UserKey: ThreatIntel

UserType: 4

Version: 1

Workload: ThreatIntelligence
}

Thank you.

[mayurr98 · Accepted solution]

Hi

I have used this add-on as far as I know UserId is not created by this add-on. It is created by O365 management activity schema.
and it means

The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included.
have a look at this doc for more info:
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

let me know if this helps!

[ssanplunk]

Hi,

Thank you for your help.
I checked more information in doc!