Forum Discussion

Patrick Taft's avatar
Patrick Taft
Copper Contributor
May 10, 2018

Audit Log changes

Like many users, we had IP ranges in Nigeria  trying to crack user passwords, and this was showing up in the Audit Logs as "UserLoginFailed"  now this seems to have disappeared completely.  I tried f...
Auditing
Elliot Munro's avatar
Elliot Munro
Copper Contributor
May 14, 2018

I'm not sure if it's related but we're having issues with the Office 365 Management API, which contains the same logs as the Unified Audit Log. 

The logs are coming in with empty Operation and ResultStatus fields, meaning our alerting engine isn't able to notify us for bulk failed, or successful logins from suspicious IPs.

To get these complete logs, I've had to run Search-UnifiedAuditLog, where the Operation and ResultStatus field is present for the same logs. Edit: I just retested this, and it seems that the data isn't there either. We haven't received any ResultStatus or Operation info since the 2nd of May for any of our customers.

 

I'll log it as a separate post, but there may be some issues with the service lately.

VasilMichev's avatar
VasilMichev
MVP
May 15, 2018

That one definitely calls for a support ticket.

  • Elliot Munro's avatar
    Elliot Munro
    Copper Contributor
    May 15, 2018
    Yep I've just logged one, I'll update with how it goes

Resources