Event Publishing Wizard - Edit Mode

Event Name

Native Name

Service

SK4 Unified Event

Event Type

Status

SK4 Version

Splunk Data Exists

Created Date

Sun Dec 02 2018 10:06:56 GMT+0000 (Coordinated Universal Time)

Last Update

Tue Jun 18 2019 11:15:12 GMT+0000 (Coordinated Universal Time)

Description

SPL Query

ELK Query

Development Notes

Raw Data

CEF:0|Skyformation|SkyFormation Cloud Apps Security|2.0.0|sk4-authz-group-assigned|authz-group-assigned|0|msg=Authorization group [splunkAppforO365] of type [app] was assigned to user [email:simona@skyformationlabs.onmicrosoft.com] fname=splunkAppforO365 duid=email destinationServiceName=Office 365 filePath=318709cf-c504-4630-95f2-d737eb2f6e32 cs6={"CreationTime":"2018-01-04T12:59:42","Id":"92555b34-32ea-499d-a367-f8691708e6ca","Operation":"Add app role assignment grant to user.","OrganizationId":"36b58f3b-a278-4fd0-916f-6a269c9782a0","RecordType":8,"ResultStatus":"success","UserKey":"1003BFFDA748EF8B@skyformationlabs.onmicrosoft.com","UserType":0,"Version":1,"Workload":"AzureActiveDirectory","ObjectId":"318709cf-c504-4630-95f2-d737eb2f6e32","UserId":"simona@skyformationlabs.onmicrosoft.com","AzureActiveDirectoryEventType":1,"ExtendedProperties":[{"Name":"User.ObjectID","Value":"64ba6d10-a6e3-4c1e-a7d9-5aca38a54038"},{"Name":"User.UPN","Value":"simona@skyformationlabs.onmicrosoft.com"},{"Name":"User.PUID","Value":"1003BFFDA748EF8B"},{"Name":"TargetId.ServicePrincipalNames","Value":"https://skyformationlabs.onmicrosoft.com/05596d25-e946-4462-a320-be9b2aedee58;318709cf-c504-4630-95f2-d737eb2f6e32"}],"Actor":[{"ID":"simona@skyformationlabs.onmicrosoft.com","Type":5},{"ID":"1003BFFDA748EF8B","Type":3},{"ID":"74658136-14ec-4630-ad9b-26e160ff0fc6","Type":4},{"ID":"User_64ba6d10-a6e3-4c1e-a7d9-5aca38a54038","Type":2}],"ActorContextId":"36b58f3b-a278-4fd0-916f-6a269c9782a0","InterSystemsId":"53b8f0f3-93d1-4434-9909-e6d5c585cd65","IntraSystemId":"82c8449a-5554-47d7-8af6-e8663076971d","Target":[{"ID":"ServicePrincipal_2d4a70b5-fdc2-4614-87d4-c0531c11b372","Type":2},{"ID":"splunkAppforO365","Type":1},{"ID":"318709cf-c504-4630-95f2-d737eb2f6e32","Type":4}],"TargetContextId":"36b58f3b-a278-4fd0-916f-6a269c9782a0"} smac=STANDARD fileHash=N/A suid=email dtz=default-tenant cs6Label=raw-event dproc=management-active-directory flexString1=Add app role assignment grant to user. requestClientApplication=sanity-0365-trial-0280 sourceServiceName=AzureActiveDirectory suser=simona@skyformationlabs.onmicrosoft.com duser=simona@skyformationlabs.onmicrosoft.com cat=privilege-management flexString1Label=application-action fileType=app

Supported also on