Do EOP actions create entries in the Office 365 audit log?

[Calum Steen]

We feed the Office 365 audit log into IBM QRadar for additional analysis, together with logs from firewalls, domain controllers etc.

If EOP puts an email into user quarantine or removes a email due to malware, does this event get written into the Office 365 audit log?

[#2]

No. The audit log includes data from the Exchange admin audit log and mailbox level auditing, none of these include EOP events or mail flow in general. It's documented here: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...

If you want to include such events, look into the mail flow data you can obtain via Get-Message trace or the good old reporting web service.

[#3]

Use the Office 365 REST reporting web service.

https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...)

This should have the reports you are looking for. They are not in the audit log.

https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...

Best, Chris