Blog Post

Microsoft Sentinel Blog
14 MIN READ

Protecting your Teams with Azure Sentinel

Pete Bryan's avatar
Pete Bryan
Icon for Microsoft rankMicrosoft
Mar 30, 2020
Azure Sentinel now has an integrated connector - https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365 This is the recommended route for collecting these logs and supersedes the collecti...
Updated Sep 01, 2020
Version 13.0
connectors
hunting
msraj's avatar
msraj
Copper Contributor
Apr 09, 2020

Pete Bryan I am having issues with parser. But when i remove "AddOnGuid_g" from parser.. Works without error..

 

 

not sure, if it is typo or variables will be different from different customers..... it also works when I change parser to following:

 

O365API_CL
| where Workload_s =~ "MicrosoftTeams"
| project TimeGenerated,
Workload=Workload_s,
Operation=Operation_s,
TeamName=columnifexists('TeamName_s', ""),
UserId=columnifexists('UserId_s', ""),
AddOnName=columnifexists('AddOnName_s', AddOnGuid_s),   <-- Updated AddOnGuid_g to AddOnGuid_s
Members=columnifexists('Members_s', ""),
Settings=iif(Operation_s contains "Setting", pack("Name", columnifexists('Name_s', ""), "Old Value", columnifexists('OldValue_s', ""), "New Value", columnifexists('NewValue_s', "")),""),
Details=pack("Id", columnifexists('Id_g', ""), "OrganizationId", columnifexists('OrganizationId_g', ""), "UserType", columnifexists('UserType_d', ""), "UserKey", columnifexists('UserKey_g', ""), "TeamGuid", columnifexists('TeamGuid_s', ""))