Splunk Search

Retrieve Office 365 audit event property retrieval

JohnMoeVita
New Member

I'm trying to set up a search to return Office 365 role change events for specific roles, such as the Global Administrator (aka Company Administrator).  The event data seems to be structured like this (simplified for clarity):

 

{ Id: <someGuid>
  ModifiedProperties: [
    {
      Name: Role.ObjectID
      NewValue: 
      OldValue: <someGuid>
    },
    {
      Name: Role.DisplayName
      NewValue: 
      OldValue: Company Administrator
    },
    {
      Name: Role.TemplateId
      NewValue: 
      OldValue: <someGuid>
    },
    {
      Name: Role.WellKnownObjectName
      NewValue: 
      OldValue: TenantAdmins
    }
  ]
  ObjectId: <UPN of object modified>
  Operation: <what was done>
  UserId: <UPN of user that made change
}

 

I want to extract the value OldValue of ModifiedProperties object where Name = Role.DisplayName into a field.  I've had a look, and had thought either spath or eval would help, but I couldn't see any extra fields being created when I used either, much less being able to then extract data from it.

Am I on the right track? Or looking at it all wrong?  My base search is this:

 

sourcetype="o365:management:activity" AND RecordType=8 AND (ModifiedProperties{}.NewValue="TenantAdmins" OR ModifiedProperties{}.OldValue="TenantAdmins")

 

I then tried to push it through eval like this:

 

| eval 'ModifiedProperties{}.Name'='ModifiedProperties{}.OldValue'

 

I thought I understood that should have added 4 extra fields (to match the four ModifiedProperties objects) to the returned event, but the events didn't change.

Can anyone lend a hand?

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!