{
    "id": "Office365",
    "title": "Microsoft 365 (formerly, Office 365)",
    "publisher": "Microsoft",
    "descriptionMarkdown": "The Microsoft 365 (formerly, Office 365) activity log connector provides insight into ongoing user activities. You will get details of operations such as file downloads, access requests sent, changes to group events, set-mailbox and details of the user who performed the actions. By connecting Microsoft 365 logs into Microsoft Sentinel you can use this data to view dashboards, create custom alerts, and improve your investigation process. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219943&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "logo": "Office365Logo.svg",
    "graphQueries": [
      {
        "metricName": "Total data received",
        "legend": "SharePoint",
        "baseQuery": "OfficeActivity\n| where OfficeWorkload == \"SharePoint\" or OfficeWorkload == \"OneDrive\""
      },
      {
        "metricName": "Total data received",
        "legend": "Exchange",
        "baseQuery": "OfficeActivity\n| where OfficeWorkload == \"Exchange\""
      },
      {
        "metricName": "Total data received",
        "legend": "Teams",
        "baseQuery": "OfficeActivity\n| where OfficeWorkload == \"MicrosoftTeams\""
      }
    ],
    "sampleQueries": [
      {
        "description": "SharePoint and OneDrive logs",
        "query": "OfficeActivity\n| where OfficeWorkload == \"SharePoint\" or OfficeWorkload == \"OneDrive\"\n            | sort by TimeGenerated"
      },
      {
        "description": "Exchange logs",
        "query": "OfficeActivity\n| where OfficeWorkload == \"Exchange\"\n            | sort by TimeGenerated"
      },
      {
        "description": "Teams logs",
        "query": "OfficeActivity\n| where OfficeWorkload == \"MicrosoftTeams\"\n            | sort by TimeGenerated"
      }
    ],
    "connectivityCriterias": [
      {
        "type": "SentinelKinds",
        "value": [
          "Office365"
        ]
      }
    ],
    "dataTypes": [
      {
        "name": "OfficeActivity (SharePoint)",
        "lastDataReceivedQuery": "OfficeActivity\n| where OfficeWorkload == \"SharePoint\" or OfficeWorkload == \"OneDrive\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
        "name": "OfficeActivity (Exchange)",
        "lastDataReceivedQuery": "OfficeActivity\n| where OfficeWorkload == \"Exchange\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      },
      {
        "name": "OfficeActivity (Teams)",
        "lastDataReceivedQuery": "OfficeActivity\n| where OfficeWorkload == \"MicrosoftTeams\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
      }
    ],
    "availability": {
      "status": 2,
      "isPreview": false,
      "featureFlag": {
        "feature": "Office365Connector",
        "featureStates": {
          "1": 3,
          "2": 3,
          "3": 3,
          "4": 3,
          "5": 2,
          "6": 2,
          "7": 2,
          "8": 2
        }
      }
    },
    "permissions": {
      "resourceProvider": [
        {
          "provider": "Microsoft.OperationalInsights/workspaces",
          "permissionsDisplayText": "read and write permissions.",
          "providerDisplayName": "Workspace",
          "scope": "Workspace",
          "requiredPermissions": {
            "read": true,
            "write": true,
            "delete": true
          }
        }
      ],
      "tenant": [
        "GlobalAdmin",
        "SecurityAdmin"
      ]
    },
    "instructionSteps": [
      {
        "title": "Connect Office 365 activity logs to your Microsoft Sentinel.",
        "description": "Select the record types you want to collect from your tenant and click **Apply Changes**.",
        "instructions": [
          {
            "type": "OfficeDataTypes",
            "parameters": {
              "connectorKind": "Office365",
              "dataTypes": [
                {
                  "title": "Exchange",
                  "name": "exchange"
                },
                {
                  "title": "SharePoint",
                  "name": "sharePoint"
                },
                {
                  "title": "Teams",
                  "name": "teams"
                }
              ]
            }
          }
        ]
      },
      {
        "title": "2. Previously connected tenants",
        "description": "Microsoft Sentinel now enables Office 365 single-tenant connection. You can modify your previously connected tenants and click **Save**.",
        "instructions": [
          {
            "type": "Office365"
          }
        ]
      }
    ],
    "metadata": {
        "id": "b568ccbf-376d-411c-82ca-729d4b3f2973",
        "version": "2.0.0",
        "kind": "dataConnector",
        "source": {
            "kind": "community"
        },
        "author": {
            "name": "Microsoft"
        },
        "support": {
            "tier": "community",
            "name": "Microsoft",
            "link":"https://github.com/Azure/Azure-Sentinel/issues"
        }
    }
}