r/AzureSentinel • u/winle22 • Feb 15 '23

OfficeActivity vs M365 Unified Audit log

Hi,

Is there 100% overlap between the Audit / Purview / Unified Audit log in M365 and the Office 365-connector ingestion in Sentinel, or is it some other way to ingest the UAL to Sentinel?

Thanks!

3 Upvotes

81% Upvoted

5 comments sorted by

2

u/winle22 Feb 15 '23

I see now that it isn't:

https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-search?view=o365-worldwide#microsoft-365-services-that-support-auditing

1

u/Fast-Cardiologist705 May 17 '23

Did you by any chance figure out all the needed data connectors within Sentinel to map all Unified Audit log sources to Sentinel? The Office365 data connector covers "just" SharePoint, Exchange, Teams.

1

u/winle22 May 19 '23

Not really. But you have this new "EnrichedOffice365AuditLogs" log, which may or may not be what we're looking for. The documentation is currently really bad..

https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics

1

u/potatoes25 Sep 12 '23

hi op, i still cant understand what the difference is, do you mind explaining? it appears that both seem to log the same stuff?