Microsoft 365 SharePoint audit
Microsoft 365 SharePoint audit. Unified audit record for the named Microsoft 365 workload.
Source and collection
Microsoft 365 audit export / Management Activity API.
Verify workload auditing, licensing, permissions, subscriptions and retention.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — events[0].event.original
Decoded event.original string; collector envelope removed; native JSON values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: f966a28fcb04039476b45360cc948cbe63d83776e5dd35c10e8564dddde0dde7
{"ClientIP":"67.43.156.15","CorrelationId":"652b339f-908c-a000-f25f-91423da7dd9b","CreationTime":"2020-02-07T16:44:07","EventSource":"SharePoint","Id":"ec04aa09-0a43-4879-cdc8-08d7abecf327","ItemType":"File","ListId":"2b6ad2bd-0fd7-4556-9c89-a97847085b85","ListItemUniqueId":"4803608a-df7d-4f63-aa73-67aa33bb576e","ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/Documents/Screenshot 2020-01-27 at 11.30.48.png","Operation":"FileDeleted","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","RecordType":"6","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","SiteUrl":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/","SourceFileExtension":"png","SourceFileName":"Screenshot 2020-01-27 at 11.30.48.png","SourceRelativeUrl":"Documents","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","UserId":"asr@testsiem.onmicrosoft.com","UserKey":"i:0h.f|membership|1003200096971f55@live.com","UserType":"0","Version":"1","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","Workload":"OneDrive"}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
ClientIP | str |
CorrelationId | str |
CreationTime | str |
EventSource | str |
Id | str |
ItemType | str |
ListId | str |
ListItemUniqueId | str |
ObjectId | str |
Operation | str |
OrganizationId | str |
RecordType | str |
Site | str |
SiteUrl | str |
SourceFileExtension | str |
SourceFileName | str |
SourceRelativeUrl | str |
UserAgent | str |
UserId | str |
UserKey | str |
UserType | str |
Version | str |
WebId | str |
Workload | str |
- Operation
- Workload-specific activity.
- RecordType
- Selects the workload record schema.
- CreationTime
- Source activity time.
- UserId
- Actor identity as recorded by the service.
Investigation uses
- Review Operation, UserId, workload and affected objects.
- Correlate session and object identifiers with identity and endpoint records.
Validation boundaries
Fields vary by workload and RecordType; audit ingestion can be delayed.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.