{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Admin Audit Log\r\n\r\n** This workbook requires Option 1** (upload of the OfficeActivity logs)\r\n\r\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**" }, "name": "text - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "79f1e435-df12-4c83-9967-501ab5f6ad6a", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "59486bcb-db99-43b3-97dc-a63b271a91d1", "version": "KqlParameterItem/1.0", "name": "EnvironmentList", "label": "Environment", "type": 2, "query": "OfficeActivity | where TimeGenerated {TimeRange}\r\n | summarize by OrganizationName", "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "079b3cc5-dab3-4d38-b4d0-71101802949d", "version": "KqlParameterItem/1.0", "name": "Help", "label": "Show Help", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }\r\n]" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "9d830b00-95f4-4fd5-8cfb-95c2e63f5d0b", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Cmdlets Analysis", "subTarget": "CmdletAna", "style": "link" }, { "id": "944a83ef-377f-4374-83e8-46816b6ce570", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Admin Audit Log - All Admins", "subTarget": "AllAAL", "style": "link" }, { "id": "cdab541f-8d91-4882-ba46-7c04cdff257b", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Workbook Help", "subTarget": "Start", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Global Admin Audit Log Search", "items": [ { "type": 1, "content": { "json": "If needed, select an item in the dropdownlist. Dropdownlist are independent." }, "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e100ee8b-d63b-4c49-9004-6555b56051aa", "version": "KqlParameterItem/1.0", "name": "Admin", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller = replace_string(Caller, '\\\\', '\\\\\\\\')\r\n| extend admin = Caller\r\n| distinct admin\r\n\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "0d7c1223-d108-4d10-bb24-50891a3415fd", "version": "KqlParameterItem/1.0", "name": "CmdLet", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where Caller in ({Admin})\r\n| distinct CmdletName", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**How to understand the data**\r\n\r\nThese information are extracted from the OfficeActivity logs.\r\n\r\nEach entry is analyzed regarding the following conditions :\r\n\r\n - Check if the Target Object is a VIP. The VIP list is based on the watchlist \"Exchange VIP\".\r\n\r\n - Check if the Cdmlet is a Sensitive Cmdlet. The Sensitive Cmdlet list is based on the watchlist \"Monitored Exchange Cmdlets\". \r\n - This list contains the list of Cmdlet that are considered as Sensitive. \r\n - Some Cmdlet will be considered as Sensitive only if some specific parameters defined in the \"Monitored Exchange Cmdlets\" watchlist are used.\r\n\r\nColumn explainatations : \r\n - Caller : Named of the Administrators that used this cmdlet\r\n - TargetObject : Object modified by the cmdlet\r\n - IsVIP : If the Target Object part of the \"Exchange VIP\" watchlist\r\n - Cmdlet : Name of the cmdlet that was used\r\n - CmdletParameters : Cmdlet parameters used with the command\r\n - IsSensitive :\r\n - true : This cmdlet is Sensitive because it was part of the list of the \"Monitored Exchange Cmdlets\" watchlist and Sensitive parameters have been used for cmdlet with specifc sensitive parameters \r\n\r\n" }, "showPin": false, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where Caller in ({Admin}) and CmdletName in ({CmdLet})\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",TargetObject), TargetObject )\r\n| extend CmdletName = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",CmdletName), CmdletName )\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",tostring(IsVIP)), tostring(IsVIP ))\r\n| extend IsSensitive = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",tostring(IsSenstiveCmdlet)), tostring(IsSenstiveCmdlet))\r\n| project TimeGenerated, Caller,IsVIP,TargetObject,IsSensitive,CmdletName,CmdletParameters\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "AllAAL" }, "name": "Global Admin Audit Log" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Analysis of Administrators actions", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Total Cmdlets for the Time Range", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller\r\n| extend CmdletName\r\n| summarize Count=count() by CmdletName", "size": 2, "showAnalytics": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = Caller\r\n| summarize Count=dcount(CmdletName) by Account,CmdletName", "size": 2, "showAnalytics": true, "title": "Total Unique Cmdlet per Account for the Time Range", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Account", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 1" } ] }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| summarize Count=count() by CmdletName\r\n| sort by CmdletName asc", "size": 0, "showAnalytics": true, "title": "Total List of Cmdlets", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = Caller\r\n| summarize Count=count() by CmdletName, Account\r\n| sort by Count asc", "size": 0, "showAnalytics": true, "title": "List of Cmdlet per Account", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section displayed the list of Cmdlet used in your environment for the defined period of time with the number of time they have been used." }, "name": "text - 0" } ] }, "customWidth": "50", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "expandable": true, "items": [ { "type": 1, "content": { "json": "This section will display the list of Cmdlet launch by Administrators for the defined period of time and the number of time they have been used" }, "name": "text - 0" } ] }, "customWidth": "50", "name": "group - 3" } ] }, "name": "Result Analysis" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "CmdletAna" }, "name": "Analysis of actions performed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Workbook goals\r\nThe goals of this workbook is to allow search in the Exchange Admin Audit log.\r\n\r\nThe source of this workbook is not an export of the Admin Audit log mailbox but an export of the MSExchange Management for each Exchange servers.\r\n\r\nIf the Admin Audit Log is bypassed, the information won't be displayed in this workbook as there is no method to track this data.\r\n\r\n## Tabs\r\n\r\nLet quicly review the content of each tab\r\n\r\n### Cmdlets Analysis\r\n\r\nThis tab will show for the defined time range :\r\n - A summary of all cmdets used\r\n\r\n - A summary of all cmdlets used by each Account\r\n\r\n### Global Admin Audit Log\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"\r\n\r\n\r\n### AdminAuditLog for Org Mgmt\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content for only account members on the Organization Management groups.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "Start" }, "name": "group - 5" } ], "fromTemplateId": "sentinel-MicrosoftExchangeSearchAdminAuditLog-Online", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }