Monitoring Office 365 audit logs

Plans

All API operations are restricted to a single tenant, and the API's root URL includes a tenant ID that specifies the tenant context. The URL of the API endpoint you use depends on the type of Office 365 subscription plan for your organization.

The following list shows the available plans and their corresponding API endpoint URLs.

• Enterprise plan

  https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/{operation}
  

• Government Community Cloud (GCC) government plan

  https://manage-gcc.office.com/api/v1.0/{tenant_id}/activity/feed/{operation}
  

• Government Community Cloud (GCC) High government plan

  https://manage.office365.us/api/v1.0/{tenant_id}/activity/feed/{operation}
  

• Department of Defense (DoD) government plan

  https://manage.protection.apps.mil/api/v1.0/{tenant_id}/activity/feed/{operation}
  

Activities

Office 365 subscription plans can include different features and services, so the available activities can vary depending on your specific plan. The following are categories of activities that you might find in the Office 365 Management API, depending on common Office 365 plans and services:

• Azure Entra ID activities: Events related to the creation, modification, or deletion of users and groups in Azure Entra ID. This also includes sign-ins, authentication events, and role assignments and changes.

• Exchange Online activities: This includes email-related activities, mailbox permission changes, and changes to email properties, attachments, and folders.

• SharePoint Online activities: This category includes events related to sharing documents and sites, changes to user access rights and permissions, and file and folder operations.

• Microsoft Teams activities: Activities relating to channel and team management, message and chat operations, and meeting-related events.

• Security and Compliance Center activities: This category includes events related to compliance policies and data loss prevention (DLP). This also includes alerts for policy violations and eDiscovery activities.

• General activities: Events that do not fall into specific service categories. This category might include general changes and administrative activities.

Operations

The Office 365 Management Activity API supports several operations. These include starting a subscription to receive notifications, retrieving a tenant's activity data, and stopping a subscription to discontinue data retrieval for that tenant. Using the Activity API, you can list current subscriptions, available content, and the corresponding content URLs. You can also retrieve content by using the content URL.

The following sections show how to use the Activity API to list available content and retrieve content.

Listing available content

You can list the content currently available for retrieval for a specified content type. This content is a collection of actions and events that occur in an Office 365 environment. Microsoft provides the following API endpoint to retrieve data when using an Office 365 enterprise plan:

Get https://manage.office.com/api/v1.0/<TENANT_ID>/activity/feed/subscriptions/content?contentType=<CONTENT_TYPE>&startTime=<START_TIME>&endTime=<END_TIME>

Where:

• The <TENANT_ID> variable is the tenant ID for the subscription.

• The <CONTENT_TYPE> variable indicates the content type. For example, Audit.AzureActiveDirectory and Audit.General.

• The <START_TIME> and <END_TIME> variables indicate the time range of content to return, based on when the content became available (date format: YYYY-MM-DD).

Perform the following steps to manually list the available content.

1. Use the PowerShell script below to generate an access token. Create a file AccessToken.ps1 and paste the following content into it. Replace <YOUR_APPLICATION_ID>, <YOUR_CLIENT_SECRET>, and <YOUR_TENANT_ID> with the values collected during the application registration:

   $clientId = "<YOUR_CLIENT_ID>"
   $clientSecret = "<YOUR_CLIENT_SECRET>"
   $tenantId = "<YOUR_TENANT_ID>"
   $resource = "https://manage.office.com"
   $tokenEndpoint = "https://login.microsoftonline.com/$tenantId/oauth2/token"
   $tokenRequestBody = @{
       grant_type    = "client_credentials"
       client_id     = $clientId
       client_secret = $clientSecret
       resource      = $resource
   }
   $tokenResponse = Invoke-RestMethod -Uri $tokenEndpoint -Method POST -Body $tokenRequestBody
   $MyToken = $tokenResponse.access_token
   echo $MyToken
   

2. Open a regular PowerShell terminal and run the commands below to execute the PowerShell script AccessToken.ps1 created in the previous step:

   > Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
   > $accessToken = & "<PATH>\AccessToken.ps1"
   

   Note

   The command Set-ExecutionPolicy RemoteSigned -Scope CurrentUser allows the execution of local scripts. Replace <PATH> with the file path to the PowerShell script.

3. Run the command below in the same PowerShell terminal to get the list of currently available content for a content type:

   $response = Invoke-RestMethod -Uri "https://manage.office.com/api/v1.0/<TENANT_ID>/activity/feed/subscriptions/content?contentType=<CONTENT_TYPE>&startTime=<START_TIME>&endTime=<END_TIME>" -Headers @{ Authorization = "Bearer $accessToken"; ContentType = "application/json" } -Method Get; $response.value
   

   Replace:

   • The <TENANT_ID> variable with a valid tenant ID.

   • The <CONTENT_TYPE> variable with a valid content type. For example, Audit.AzureActiveDirectory.

   • The <START_TIME> and <END_TIME> variables with a date range (format: YYYY-MM-DD).

   contentUri        : https://manage.office.com/api/v1.0/<Tenant_ID>/activity/feed/audit/
                       20240129073247100003384$20*********081955691028239
                       $audit_azureactivedirectory$Audit_AzureActiveDirectory$emea0010
   contentId         : 20240129073247100003384$20*********081955691028239$audit_azureactivedirectory$Audit_AzureActiveDirectory$emea0010
   contentType       : Audit.AzureActiveDirectory
   contentCreated    : 2024-01-29T08:19:55.691Z
   contentExpiration : 2024-02-05T07:32:47.100Z
   ...
   

Retrieving content

To retrieve a content blob, make a GET request against the corresponding content URI that is included in the list of available content. The returned content is a collection of one or more actions or events in JSON format.

GET <contentUri>

Replace the <contentUri> variable with the value of a content URI that is included in the list of available content.

For more information about the available endpoints and response formats, see the Office 365 Management Activity API reference.

Configuring multiple tenants

You can configure Wazuh to monitor multiple tenants in an organization by specifying the organization's credentials (<tenant_id>, <client_id>, <client_secret>, and <api_type>) in individual <api_auth> blocks.

For example, the following configuration monitors two tenants in an organization:

<ossec_config>
  <office365>
    <enabled>yes</enabled>
    <interval>1m</interval>
    <curl_max_size>1M</curl_max_size>
    <only_future_events>yes</only_future_events>

    <api_auth>
      <tenant_id><YOUR_TENANT_ID_1></tenant_id>
      <client_id><YOUR_CLIENT_ID_1></client_id>
      <client_secret><YOUR_CLIENT_SECRET_1></client_secret>
      <api_type>commercial</api_type>
    </api_auth>

    <api_auth>
      <tenant_id><YOUR_TENANT_ID_2></tenant_id>
      <client_id><YOUR_CLIENT_ID_2></client_id>
      <client_secret><YOUR_CLIENT_SECRET_2></client_secret>
      <api_type>commercial</api_type>
    </api_auth>

    <subscriptions>
      <subscription>Audit.AzureActiveDirectory</subscription>
      <subscription>Audit.General</subscription>
    </subscriptions>
  </office365>
</ossec_config>

Replace:

• <YOUR_TENANT_ID_1>, <YOUR_CLIENT_ID_1>, and <YOUR_CLIENT_SECRET_1> with the organization's credentials for tenant 1.

• <YOUR_TENANT_ID_2>, <YOUR_CLIENT_ID_2>, and <YOUR_CLIENT_SECRET_2> with the organization's credentials for tenant 2.

Configuring multiple subscriptions

Wazuh pulls audit logs from the following subscription types in Office 365:

• Audit.AzureActiveDirectory: User identity management.

• Audit.Exchange: Mail and calendaring server.

• Audit.SharePoint: Web-based collaborative platform.

• Audit.General: Includes all other workloads not included in the previous content types.

• DLP.All: Data loss prevention workloads.

You can configure Wazuh to monitor multiple subscriptions in an organization's tenants by specifying the subscription type in individual <subscription> tags within the same <subscriptions> block.

For example, the following configuration pulls only the Audit.AzureActiveDirectory and Audit.General events within a tenant in an organization:

<ossec_config>
  <office365>
    <enabled>yes</enabled>
    <interval>1m</interval>
    <curl_max_size>1M</curl_max_size>
    <only_future_events>yes</only_future_events>

    <api_auth>
      <tenant_id><YOUR_TENANT_ID></tenant_id>
      <client_id><YOUR_CLIENT_ID></client_id>
      <client_secret><YOUR_CLIENT_SECRET></client_secret>
      <api_type>commercial</api_type>
    </api_auth>

    <subscriptions>
      <subscription>Audit.AzureActiveDirectory</subscription>
      <subscription>Audit.General</subscription>
    </subscriptions>
  </office365>
</ossec_config>

Replace <YOUR_TENANT_ID>, <YOUR_CLIENT_ID>, and <YOUR_CLIENT_SECRET> with the organization's credentials for the tenant.

Dashboard

The Dashboard tab visualization option provides a view of the actions performed in a monitored Office 365 environment. This information includes top actions by users, the types of events performed, and the IP addresses of these events, as shown in the following image.

Panel

This Panel tab provides detailed information about the events that occurred, including the top users of the service, the top client IP addresses using the service, the top actions triggered, and the top events performed in Office 365.

Events

The Events tab shows the findings generated by events that occur in the Office 365 environment. Here you can see details such as the agent name, the event type, the IP address of the user performing the action, and other fields.

This tab also provides the following functionality:

• Event filtering based on specific fields such as event type, IP addresses, and others.

• Dynamic searches based on structured queries.

• Complete details of the generated finding, including the full log, matched decoder, and others.

Ubuntu endpoint

1. Append the following configuration to the /var/ossec/etc/ossec.conf file on the monitored Linux endpoint:

   <ossec_config>
     <office365>
       <enabled>yes</enabled>
       <interval>1m</interval>
       <curl_max_size>1M</curl_max_size>
       <only_future_events>yes</only_future_events>
       <api_auth>
         <tenant_id><YOUR_TENANT_ID></tenant_id>
         <client_id><YOUR_CLIENT_ID></client_id>
         <client_secret><YOUR_CLIENT_SECRET></client_secret>
         <api_type>commercial</api_type>
       </api_auth>
       <subscriptions>
         <subscription>Audit.AzureActiveDirectory</subscription>
       </subscriptions>
     </office365>
   </ossec_config>
   

   Replace:

   • The <YOUR_TENANT_ID> variable with the tenant ID of your application registered in Microsoft Azure.

   • The <YOUR_CLIENT_ID> variable with the client ID of your application registered in Microsoft Azure.

   • The <YOUR_CLIENT_SECRET> variable with the client secret of your application registered in Microsoft Azure.

2. Restart the Wazuh agent service to apply the changes:

   # systemctl restart wazuh-agent
   

Microsoft Azure portal

Perform the following actions to create an Azure Active Directory login event.

1. Log in to your Azure portal. A user sign-in is the activity Wazuh detects in this use case.

Wazuh dashboard

1. Navigate to Cloud security > Office 365 on your Wazuh dashboard, then click the Findings tab to view the generated findings.

   

Ubuntu endpoint

Perform the following steps to configure the Wazuh agent for monitoring administrator activities in Microsoft Entra ID.

1. Append the following configuration to the /var/ossec/etc/ossec.conf file on the Wazuh agent:

   <ossec_config>
     <office365>
       <enabled>yes</enabled>
       <interval>1m</interval>
       <curl_max_size>1M</curl_max_size>
       <only_future_events>yes</only_future_events>
   
       <api_auth>
         <tenant_id><YOUR_TENANT_ID></tenant_id>
         <client_id><YOUR_CLIENT_ID></client_id>
         <client_secret><YOUR_CLIENT_SECRET></client_secret>
         <api_type>commercial</api_type>
       </api_auth>
   
       <subscriptions>
         <subscription>Audit.AzureActiveDirectory</subscription>
       </subscriptions>
     </office365>
   </ossec_config>
   

   Replace:

   • The <YOUR_TENANT_ID> variable with the tenant ID of your application registered in Microsoft Azure.

   • The <YOUR_CLIENT_ID> variable with the client ID of your application registered in Microsoft Azure.

   • The <YOUR_CLIENT_SECRET> variable with the client secret of your application registered in Microsoft Azure.

2. Restart the Wazuh agent service to apply the changes:

   # systemctl restart wazuh-agent
   

Microsoft Azure portal

Create and delete a user account in Microsoft Entra ID to generate activity for Wazuh to monitor and display on the dashboard.

Perform the following actions to create and delete a test user account.

1. Type Microsoft Entra ID in the search bar of the Azure portal, and click it to access your directory.

2. Navigate to Users from the side menu and click New user > Create new user.

   

3. Fill in the user's information and click the Review + create button to create the user.

   

4. Delete the user by selecting the Display name and clicking the Delete button.

   

Wazuh dashboard

1. Navigate to Cloud security > Office 365 on your Wazuh dashboard, then click the Findings tab to view the generated findings.