Cloud / Audit

OfficeActivity

Office 365 audit events covering Exchange, SharePoint, OneDrive, and Teams user and admin activities

Analytics Data lake Primary Secondary Primary · Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C6 Collaboration, SaaS, and business application activity

Collaboration, SaaS, and business application activity

ACSC

8. Cloud platform loggingOffice 365 and Google Workspace

CISA

7. Microsoft 3657a Unified audit log

MITRE data sources

Application Log: Application Log Content

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

ClientIPExternalAccessItemNameOfficeObjectIdOfficeWorkloadOperationOrganizationNameParametersRecordTypeResultStatusSourceFileNameSourceRelativeUrlTimeGeneratedUserAgentUserIdUserType

Most used in public rules

Operation50
UserId47
OfficeWorkload41
TimeGenerated41
ClientIP37
RecordType21
Parameters18
UserType16
OfficeObjectId13
ResultStatus12
UserAgent10
OriginatingServer9

Split hints

Rows to keep in Analytics with a split rule.

Keep file sharing, permission changes, mailbox delegation, and external access events in Analytics

(Operation has "SharingSet" or Operation has "AnonymousLinkCreated" or Operation has "SharingInvitationCreated" or Operation has "AddedToSecureLink" or Operation has "MemberAdded" or Operation has "MemberRemoved" or Operation has "Add-MailboxPermission" or Operation has "Set-Mailbox" or Operation has "New-InboxRule" or Operation has "Set-InboxRule" or Operation has "UpdateInboxRules" or Operation has "FileDownloaded" or Operation has "FileSyncDownloadedFull" or ExternalAccess =~ "true")

Sources for this recommendation

Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.