Microsoft 365 Exchange audit
Microsoft 365 Exchange audit. Unified audit record for the named Microsoft 365 workload.
Source and collection
Microsoft 365 audit export / Management Activity API.
Verify workload auditing, licensing, permissions, subscriptions and retention.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — events[0].event.original
Decoded event.original string; collector envelope removed; native JSON values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 1ecfb3b9b059ff4503f42f0921a9e958f3fe385e356dde20bfe7b2340c8e2e2a
{"AppId":"","ClientAppId":"","CreationTime":"2020-02-07T20:49:49","ExternalAccess":true,"Id":"1c7412a6-858d-49ff-3f93-08d7ac0f45bf","ObjectId":"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}","Operation":"Set-Mailbox","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","OrganizationName":"testsiem.onmicrosoft.com","OriginatingServer":"HE1PR0102MB3228 (67.43.156.13)","Parameters":[{"Name":"DomainController","Value":""},{"Name":"Identity","Value":"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}"}],"RecordType":"1","ResultStatus":"True","UserId":"NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)","UserKey":"NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)","UserType":"3","Version":"1","Workload":"Exchange"}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
AppId | str |
ClientAppId | str |
CreationTime | str |
ExternalAccess | bool |
Id | str |
ObjectId | str |
Operation | str |
OrganizationId | str |
OrganizationName | str |
OriginatingServer | str |
Parameters | array |
Parameters[0].Name | str |
Parameters[0].Value | str |
RecordType | str |
ResultStatus | str |
UserId | str |
UserKey | str |
UserType | str |
Version | str |
Workload | str |
- Operation
- Workload-specific activity.
- RecordType
- Selects the workload record schema.
- CreationTime
- Source activity time.
- UserId
- Actor identity as recorded by the service.
Investigation uses
- Review Operation, UserId, workload and affected objects.
- Correlate session and object identifiers with identity and endpoint records.
Validation boundaries
Fields vary by workload and RecordType; audit ingestion can be delayed.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.