Event Publishing Wizard - Edit Mode

Event Name

Native Name

Service

SK4 Unified Event

Event Type

Status

SK4 Version

Splunk Data Exists

Created Date

Mon Dec 17 2018 10:57:43 GMT+0000 (Coordinated Universal Time)

Last Update

Tue Jun 18 2019 11:13:39 GMT+0000 (Coordinated Universal Time)

Description

SPL Query

ELK Query

Development Notes

Raw Data

CEF:0|Skyformation|SkyFormation Cloud Apps Security|2.0.0|sk4-resource-property-updated|resource-property-updated|0|msg=Resource [defaultresourcegroupe362] of type [storage-account] was updated by [nadav@skyformation.onmicrosoft.com] - [label] was set new value [defaultresourcegroupe362] cs1=defaultresourcegroupe362 request=Success cs3=label cs6={"authorization":{"action":"Microsoft.Storage/storageAccounts/write","scope":"/subscriptions/5f491a61-5e41-4d79-bde5-010c9d22b907/resourcegroups/DefaultResourceGroup-EUS/providers/Microsoft.Storage/storageAccounts/defaultresourcegroupe362"},"caller":"nadav@skyformation.onmicrosoft.com","channels":"Operation","claims":{"aud":"https://management.core.windows.net/","iss":"https://sts.windows.net/3d50b419-ff21-4255-9328-c2f25e251886/","iat":"1530609543","nbf":"1530609543","exp":"1530613443","http://schemas.microsoft.com/claims/authnclassreference":"1","aio":"Y2dgYDjJ0rqSq6nsZS/jf8sq3vyGQ/4ityZ/W2J1d3UJj6Xr1KcA","http://schemas.microsoft.com/claims/authnmethodsreferences":"pwd","appid":"c44b4083-3bb0-49c1-b47d-974e53cbdf3c","appidacr":"2","e_exp":"262800","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname":"Lavy","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname":"Nadav","groups":"71989386-42b6-4e3b-9339-2ca16d21b1b2","ipaddr":"82.80.134.106","name":"Nadav Lavy (onmicrosoft)","http://schemas.microsoft.com/identity/claims/objectidentifier":"0701e765-354b-4933-9943-88641b03aab1","puid":"1003BFFD9989B247","http://schemas.microsoft.com/identity/claims/scope":"user_impersonation","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier":"td8NdSaB5BKzNlgxn5O8iAnSdp_vlNkijTyQipP_Q8o","http://schemas.microsoft.com/identity/claims/tenantid":"3d50b419-ff21-4255-9328-c2f25e251886","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":"nadav@skyformation.onmicrosoft.com","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn":"nadav@skyformation.onmicrosoft.com","uti":"xRgZ6mcW80Wuo4mocvMeAA","ver":"1.0","wids":"62e90394-69f5-4237-9190-012177145e10"},"correlationId":"063c9a5c-d825-4361-ac1f-de1b5e2ece4a","description":"","eventDataId":"a423d259-88e3-4a0f-8c56-2442669a64e7","eventName":{"value":"EndRequest","localizedValue":"EndRequest"},"category":{"value":"Administrative","localizedValue":"Administrative"},"id":"/subscriptions/5f491a61-5e41-4d79-bde5-010c9d22b907/resourcegroups/DefaultResourceGroup-EUS/providers/Microsoft.Storage/storageAccounts/defaultresourcegroupe362/events/a423d259-88e3-4a0f-8c56-2442669a64e7/ticks/636662082066837109","level":"Informational","resourceGroupName":"DefaultResourceGroup-EUS","resourceProviderName":{"value":"Microsoft.Storage","localizedValue":"Microsoft.Storage"},"resourceId":"/subscriptions/5f491a61-5e41-4d79-bde5-010c9d22b907/resourcegroups/DefaultResourceGroup-EUS/providers/Microsoft.Storage/storageAccounts/defaultresourcegroupe362","resourceType":{"value":"Microsoft.Storage/storageAccounts","localizedValue":"Microsoft.Storage/storageAccounts"},"operationId":"f1e5775c-1457-417a-a509-50b7ef85905d","operationName":{"value":"Microsoft.Storage/storageAccounts/write","localizedValue":"Microsoft.Storage/storageAccounts/write"},"status":{"value":"Succeeded","localizedValue":"Succeeded"},"subStatus":{"value":"","localizedValue":""},"eventTimestamp":"2018-07-03T09:50:06.6837109Z","submissionTimestamp":"2018-07-03T09:50:20.2295957Z","subscriptionId":"5f491a61-5e41-4d79-bde5-010c9d22b907","tenantId":"3d50b419-ff21-4255-9328-c2f25e251886"} fileHash=N/A cs1Label=New value suid=email cs6Label=raw-event dproc=iaas-events sourceServiceName=azure deviceInboundInterface=063c9a5c-d825-4361-ac1f-de1b5e2ece4a cs3Label=Property name cat=application-data flexString1Label=application-action end=1530611406006 fname=defaultresourcegroupe362 src=82.80.134.106 destinationServiceName=Azure filePath=/subscriptions/5f491a61-5e41-4d79-bde5-010c9d22b907/resourcegroups/DefaultResourceGroup-EUS/providers/Microsoft.Storage/storageAccounts/defaultresourcegroupe362 dtz=Nike Corp flexString1=Microsoft.Storage/storageAccounts/write requestClientApplication=azure-test-v20 suser=nadav@skyformation.onmicrosoft.com fileType=storage-account

Supported also on