I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.
While reviewing the collected logs, I saw a log that the UserId field is "email@example.com", but I do not know what it means.
I want to make sure that "firstname.lastname@example.org" is provided by Office 365, or information generated by add-on.
The RecordType for that log is 41.
Office 365 Management Schema documents do not provide this information.
I have used this add-on as far as I know
UserId is not created by this add-on. It is created by O365 management activity schema.
and it means
The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, myname@mydomain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included.
have a look at this doc for more info:
let me know if this helps!