{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Admin Audit Log\r\n\r\n** This workbook requires Option 1**" }, "name": "text - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "79f1e435-df12-4c83-9967-501ab5f6ad6a", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "59486bcb-db99-43b3-97dc-a63b271a91d1", "version": "KqlParameterItem/1.0", "name": "EnvironmentList", "label": "Environment", "type": 2, "isRequired": true, "query": "ExchangeAdminAuditLogs | where TimeGenerated {TimeRange}\r\n | summarize by ESIEnvironment", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "9d830b00-95f4-4fd5-8cfb-95c2e63f5d0b", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Cmdlets Analysis", "subTarget": "CmdletAna", "style": "link" }, { "id": "944a83ef-377f-4374-83e8-46816b6ce570", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Admin Audit Log - All Admins", "subTarget": "AllAAL", "style": "link" }, { "id": "beb06fb7-fd78-4048-a0d9-01960cbd0c66", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Admin Audit Log - Members of Organization Management", "subTarget": "AALOM", "preText": "AdminAuditLog Org Mgmt", "style": "link" }, { "id": "cdab541f-8d91-4882-ba46-7c04cdff257b", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Workbook Help", "subTarget": "Start", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Search in AdminAudit log focused on Organization Management members", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "How to understand the data", "expandable": true, "items": [ { "type": 1, "content": { "json": "These information are extracted from the log MSExchange Management.\r\n\r\nEach entry is analyzed regarding the following conditions :\r\n\r\n - Check if the Target Object is a VIP. The VIP list is based on the watchlist \"Exchange VIP\".\r\n\r\n - Check if the Cdmlet is a Sensitive Cmdlet. The Sensitive Cmdlet list is based on the watchlist \"Monitored Exchange Cmdlets\". \r\n - This list contains the list of Cmdlet that are considered as Sensitive. \r\n - Some Cmdlet will be considered as Sensitive only if some specific parameters defined in the \"Monitored Exchange Cmdlets\" watchlist are used.\r\n\r\nColumn explainatations : \r\n - Caller : Named of the Administrators that used this cmdlet\r\n - TargetObject : Object modified by the cmdlet\r\n - IsVIP : If the Target Object part of the \"Exchange VIP\" watchlist\r\n - CmdletName : Name of the cmdlet that was used\r\n - CmdletParameters : Cmdlet parameters used with the command\r\n - IsSenstiveCmdlet : \r\n - true : the Cmdlet is part of the \"Monitored Exchange Cmdlets\" watchlist\r\n - false : the Cmdlet is not part of the \"Monitored Exchange Cmdlets\" watchlist\r\n - IsRestrictedCmdLet : This cmdlet is considered as sentisitve only when some specifc parameters are used\r\n - ExtractedParameters : List of parameters used by the cmdlet\r\n - IsSenstiveCmdletParameters :\r\n - true : Sensitive parameters have been used\r\n - false : Sensitive parameters have not been used\r\n - RestrictedParameters : List of restricted parameters used\r\n - IsSensitive :\r\n - true : This cmdlet is Sensitive because it was part of the list of the \"Monitored Exchange Cmdlets\" watchlist and Sensitive parameters have been used for cmdlet with specifc sensitive parameters \r\n - UserOriented : The Sensitive cmdlet used is a user cmdlet and not a general configuration cmdlet. This information is part of the list of the \"Monitored Exchange Cmdlets\" watchlist\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 2" }, { "type": 1, "content": { "json": "If needed, select an item in the dropdownlist. Dropdownlist are independent." }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d9d4e0a2-b75d-4825-9f4e-7606516500e1", "version": "KqlParameterItem/1.0", "name": "OrgMAdm", "type": 2, "query": "ExchangeConfiguration(SpecificSectionList=\"ExGroup\",SpecificConfigurationDate=\"lastdate\",SpecificConfigurationEnv=\"{EnvironmentList:Value}\")\r\n| where CmdletResultValue.Parentgroup == \"Organization Management\" and CmdletResultValue.Level != 0\r\n| where TimeGenerated {TimeRange}\r\n| project CmdletResultValue\r\n| extend Members = tostring(CmdletResultValue.SamAccountName)\r\n| distinct Members\r\n| sort by Members asc\r\n", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b11b4ca7-2ce0-4116-b9ed-d3a514db354d", "version": "KqlParameterItem/1.0", "name": "Cmdlet", "type": 2, "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| distinct CmdletName", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Caller contains \"{OrgMAdm}\" and CmdletName contains \"{Cmdlet}\"\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",tostring(IsVIP)), tostring(IsVIP ))\r\n| extend IsSensitive = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",tostring(IsSenstiveCmdlet)), tostring(IsSenstiveCmdlet))\r\n| project TimeGenerated, Caller,IsVIP,TargetObject,IsSensitive,CmdletName,CmdletParameters,ExtractedParameters,IsSenstiveCmdlet,IsRestrictedCmdLet,IsSenstiveCmdletParameters,RestrictedParameters,UserOriented\r\n| sort by TimeGenerated desc\r\n", "size": 0, "showAnalytics": true, "title": "To manually search in AdminAuditLog action perfrom by Organization Management members. The list of user is only members of Organization Mangement", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CmdletName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "31.5ch" } }, { "columnMatch": "Total", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "9.3ch" } }, { "columnMatch": "Count", "formatter": 21, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "330px" } }, { "columnMatch": "Anomalies", "formatter": 10, "formatOptions": { "palette": "redBright", "customColumnWidthSetting": "330px" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section display all the information of the Admin Audit Log for the defined time range.\r\n\r\nUsing the dropdownlist you are able to tack which Cmdlet has been used, by whom and on which object.\r\n\r\nSensitive Cmdlet or a VIP user, will be displayed" }, "name": "text - 0" } ] }, "name": "group - 3" } ] }, "name": "Manual Search AAL" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "AALOM" }, "name": "Search Admin Audit Log" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Global Admin Audit Log Search", "items": [ { "type": 1, "content": { "json": "If needed, select an item in the dropdownlist. Dropdownlist are independent." }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e100ee8b-d63b-4c49-9004-6555b56051aa", "version": "KqlParameterItem/1.0", "name": "Admin", "type": 2, "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend admin = tostring(split(Caller,\"/\")[countof(Caller,\"/\")])\r\n| distinct admin\r\n\r\n", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "0d7c1223-d108-4d10-bb24-50891a3415fd", "version": "KqlParameterItem/1.0", "name": "CmdLet", "type": 2, "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where Status == \"Success\"\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| distinct CmdletName", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "How to understand the data", "expandable": true, "items": [ { "type": 1, "content": { "json": "These information are extracted from the log MSExchange Management.\r\n\r\nEach entry is analyzed regarding the following conditions :\r\n\r\n - Check if the Target Object is a VIP. The VIP list is based on the watchlist \"Exchange VIP\".\r\n\r\n - Check if the Cdmlet is a Sensitive Cmdlet. The Sensitive Cmdlet list is based on the watchlist \"Monitored Exchange Cmdlets\". \r\n - This list contains the list of Cmdlet that are considered as Sensitive. \r\n - Some Cmdlet will be considered as Sensitive only if some specific parameters defined in the \"Monitored Exchange Cmdlets\" watchlist are used.\r\n\r\nColumn explainatations : \r\n - Caller : Named of the Administrators that used this cmdlet\r\n - TargetObject : Object modified by the cmdlet\r\n - IsVIP : If the Target Object part of the \"Exchange VIP\" watchlist\r\n - CmdletName : Name of the cmdlet that was used\r\n - CmdletParameters : Cmdlet parameters used with the command\r\n - IsSenstiveCmdlet : \r\n - true : the Cmdlet is part of the \"Monitored Exchange Cmdlets\" watchlist\r\n - false : the Cmdlet is not part of the \"Monitored Exchange Cmdlets\" watchlist\r\n - IsRestrictedCmdLet : This cmdlet is considered as sentisitve only when some specifc parameters are used\r\n - ExtractedParameters : List of parameters used by the cmdlet\r\n - IsSenstiveCmdletParameters :\r\n - true : Sensitive parameters have been used\r\n - false : Sensitive parameters have not been used\r\n - RestrictedParameters : List of restricted parameters used\r\n - IsSensitive :\r\n - true : This cmdlet is Sensitive because it was part of the list of the \"Monitored Exchange Cmdlets\" watchlist and Sensitive parameters have been used for cmdlet with specifc sensitive parameters \r\n - UserOriented : The Sensitive cmdlet used is a user cmdlet and not a general configuration cmdlet. This information is part of the list of the \"Monitored Exchange Cmdlets\" watchlist\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Caller contains \"{Admin}\" and CmdletName contains \"{CmdLet}\"\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",tostring(IsVIP)), tostring(IsVIP ))\r\n| extend IsSensitive = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",tostring(IsSenstiveCmdlet)), tostring(IsSenstiveCmdlet))\r\n| project TimeGenerated, Caller,IsVIP,TargetObject,IsSensitive,CmdletName,CmdletParameters,ExtractedParameters,IsSenstiveCmdlet,IsRestrictedCmdLet,IsSenstiveCmdletParameters,RestrictedParameters,UserOriented\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section display all the information of the Admin Audit Log for the defined time range.\r\n\r\nUsing the dropdownlist you are able to tack which Cmdlet has been used, by whom and on which object.\r\n\r\nSensitive Cmdlet or a VIP user, will be displayed" }, "name": "text - 0" } ] }, "name": "group - 4" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "AllAAL" }, "name": "Global Admin Audit Log" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Analysis of Administrators actions", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Total Cmdlets for the Time Range", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller\r\n| extend CmdletName\r\n| summarize Count=count() by CmdletName", "size": 2, "showAnalytics": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = tostring(split(Caller,\"/\")[countof(Caller,\"/\")])\r\n| extend CmdletName\r\n| summarize Count=dcount(CmdletName) by Account,CmdletName", "size": 2, "showAnalytics": true, "title": "Total Unique Cmdlet per Account for the Time Range", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Account", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 1" } ] }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller\r\n| extend CmdletName\r\n| summarize Count=count() by CmdletName\r\n| sort by CmdletName asc", "size": 0, "showAnalytics": true, "title": "Total List of Cmdlets", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = tostring(split(Caller,\"/\")[countof(Caller,\"/\")])\r\n| extend CmdletName\r\n| summarize Count=count() by CmdletName, Account\r\n| sort by Count asc", "size": 0, "showAnalytics": true, "title": "List of Cmdlet per Account", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section displayed the list of Cmdlet used in your environment for the defined period of time with the number of time they have been used." }, "name": "text - 0" } ] }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section will display the list of Cmdlet launch by Administrators for the defined period of time and the number of time they have been used" }, "name": "text - 0" } ] }, "customWidth": "50", "name": "group - 3" } ] }, "name": "Result Analysis" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "CmdletAna" }, "name": "Analysis of actions performed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Workbook goals\r\nThe goals of this workbook is to allow search in the Exchange Admin Audit log.\r\n\r\nThe source of this workbook is not an export of the Admin Audit log mailbox but an export of the MSExchange Management for each Exchange servers.\r\n\r\nIf the Admin Audit Log is bypassed, the information won't be displayed in this workbook as there is no method to track this data.\r\n\r\n## Tabs\r\n\r\nLet quicly review the content of each tab\r\n\r\n### Cmdlets Analysis\r\n\r\nThis tab will show for the defined time range :\r\n - A summary of all cmdets used\r\n\r\n - A summary of all cmdlets used by each Account\r\n\r\n### Global Admin Audit Log\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"\r\n\r\n\r\n### AdminAuditLog for Org Mgmt\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content for only account members on the Organization Management groups.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "Start" }, "name": "group - 5" } ], "fromTemplateId": "sentinel-MicrosoftExchangeSearchAdminAuditLog", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }