Splunk Search

How can I get Membership information?

risingflight143
Explorer

Hi All

i have an unified group(i.e office365 unified group) created from Office365.  i want to know membership details i.e who has added/removed users to this group. This group will also be visible in Azure AD. i can check audit logs in Azure AD and it shows only for a month. i am trying below splunk query to fetch membership information from both Azure AD and office365 but i am not getting output. ug@contoso.com is my group  name

 

 

sourcetype=azure*:management:activity (Operation="*Change user*" OR Operation="*Update user*") ObjectId="*ug@contoso.com*" (UserId!="Certificate" AND UserId!="ServicePrincipal*" AND UserId!="Sync*") (ModifiedProperties{}.NewValue!=" " AND ModifiedProperties{}.OldValue!=" ")
| rename ModifiedProperties{}.NewValue AS ModAdd
| rename ModifiedProperties{}.OldValue AS ModRem
| rename UserId AS "Actioned By" 
| rename Operation AS "Action" 
| rename ObjectId AS "Member"
| sort -_time 
| table _time, ModAdd, ModRem, "Action", Member, "Actioned By"

 

 

 

 

 

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

To obtain help from volunteers, you will first need to post sample data (anonymize as needed) that can support your belief that the search should return output.  If the logic is not obvious, you also need to explain your logic between raw data and your expected output.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...