Hi, all
I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.
While reviewing the collected logs, I saw a log that the UserId field is "notracking@example.com", but I do not know what it means.
I want to make sure that "notracking@example.com" is provided by Office 365, or information generated by add-on.
The RecordType for that log is 41.
Office 365 Management Schema documents do not provide this information.
{ [-]
AppName: Mail
AppVersion: 0.0.0000
CreationTime: 2019-01-28T22:37:20
Id: #blind#
OS: Win32
Operation: TIUrlClickData
OrganizationId: #blind#
RecordType: 41
SourceId: #blind#
SourceWorkload: Mailflow
TimeOfClick: 2019-01-28T22:34:40
Url: http://abcde.com/?61o1EX=IGCQlSQRYNiGBrD0ALmQHT3LUw
UrlClickAction: 2
UserId: notracking@example.com
UserIp: 10.10.10.10
UserKey: ThreatIntel
UserType: 4
Version: 1
Workload: ThreatIntelligence
}
Thank you.
Hi
I have used this add-on as far as I know UserId
is not created by this add-on. It is created by O365 management activity schema.
and it means
The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included.
have a look at this doc for more info:
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...
let me know if this helps!
Hi
I have used this add-on as far as I know UserId
is not created by this add-on. It is created by O365 management activity schema.
and it means
The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included.
have a look at this doc for more info:
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...
let me know if this helps!
Hi,
Thank you for your help.
I checked more information in doc!