Repository navigation
Office 365 integration is missing awareness of additional Office 365 Audit API audit log record types #3380
Description
Current map from o365audit.RecordType only maps up to 66 -> "MicrosoftForms"
Microsoft now defines audit log record types up to 148 as per: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32
A secondary issue is that the ingest pipeline for the integration only supports ECS mapping for a sub-set of record types, e.g.
- ExchangeAdmin ( 1 )
- ExchangeItem ( 2 )
- AzureActiveDirectory ( 8 )
- AzureActiveDirectoryStsLogon ( 15 )
- SharePointFileOperation ( 56 )
- SecurityComplianceAlerts ( 42 )
- ComplianceDLPSharePoint ( 11 )
- ComplianceDLPExchange ( 13 )
- Yammer ( 22 )
- MicrosoftTeams ( 25 )
There will be great value in also ensuring the following record types are mapped appropriately, particularly to trigger alerts in Elastic Security via the normal External Alerts rule when event.kind: alert is set.
This is primarily to support "Microsoft Defender for Office 365" , which IS NOT the same as Microsoft 365 Defender. Refer to: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/overview?view=o365-worldwide
| Value | Member name | Description | Do we have a sample yet? |
|---|---|---|---|
| 28 | ThreatIntelligence | Phishing and malware events from Exchange Online Protection and Microsoft Defender for Office 365. | YES |
| 29 | MailSubmission | Submission events from Exchange Online Protection and Microsoft Defender for Office 365. | YES |
| 34 | ThreatFinder | Campaign-related events from Microsoft Defender for Office 365. | NO |
| 41 | ThreatIntelligenceUrl | Safe links time-of-block and block override events from Microsoft Defender for Office 365. | YES |
| 47 | ThreatIntelligenceAtpContent | Phishing and malware events for files in SharePoint, OneDrive for Business, and Microsoft Teams from Microsoft Defender for Office 365. | YES |
| 61 | InformationWorkerProtection | Events related to compromised user alerts. | NO |
| 62 | Campaign | Email campaign events from Microsoft Defender for Office 365. | NO |
| 90 | MSTIC | Threat intelligence events in Microsoft Defender for Office 365. | NO |
The above, in some cases, MAY overlap with the Microsoft 365 Defender/ATP integration, however from what I've seen from live logs ingested via Microsoft 365 Defender/ATP integrations, they do not.
Activity
elasticmachine commentedon May 19, 2022
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
jamiehynds commentedon Jan 18, 2023
Closing, as the record types listed above are now supported.