m365-general-logs
Fetch general logs using Office 365 Management API
o365-general-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- profile=PROFILE
- Office 365 connect profile name
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | |
| profile | String | Connect profile | The identifier of Office 365 connect profile |
| workload | String | Workload | e.g. SecurityComplianceCenter, Mip |
| user_id | String | User ID | GUID, email address, MIPContentExplorer, or NOT-FOUND |
| operation | String | Operation | e.g. SearchMtpStatus, MemberAdded, TeamSettingChanged |
| data_type | String | Data type | e.g. MtpStatus, DataInsightsSubscription, Alert |
| record_type | Integer | Record type | e.g. 18, 25, 52, 157 |
| user_type | Integer | User type | e.g. 0, 2, 5 |
| user_key | String | User key | GUID, email address, MIPContentExplorer, or NOT-FOUND |
| version | Integer | Version | e.g. 1 |
| id | String | ID | GUID format |
| org_id | String | Tenant ID | GUID format |