Interpreting SharePoint Online Audit Records

[Tony Redmond]

Microsoft says that SharePoint Online and OneDrive for Business offer secure collaboration within Office 365. Good auditing is part of the reason why, but because SharePoint is so chatty when it comes to generating audit records, you might need some help to filter what’s in the audit log to see what’s really important.
https://www.petri.com/sharepoint-online-audit-records

[#2]

Well, they can definitely do a better job in filtering out/combining events. But I feel like they are doing a better job compared to Exchange, which has been ignoring certain operations ever since auditing was first introduced in the product.

[#3]

Being a little grumpy tonight Vasil?

[#4]

Always :) Which doesn't make my point invalid - the Exchange folks should step up and cover all events in the logs, ideally mail flow events too.

[#5]

Not sure about mail flow events because there are tons of those, not all of which are useful. The mail logs seem a better place for the majority of that information.

As to admin and mailbox auditing, there have been some tweaks to the events captured since their introduction in Exchange 2010, but it could probably do with a review to ensure that all important events are in the net.