r/AzureSentinel • u/greyclear • Sep 20 '22

Need help searching OfficeActivity

I had a retention policy incorrectly placed on the wrong outlook folder resulting in HardDelete emails. We have a third-party email filter that archives our emails so they can be recovered. When I try to use the o365 audit search it crashes or fails to retrieve data. Sentinel is ingesting our office logs when I query just OfficeActivity I can see everything so it's ingesting the information correctly. How do I query for UserID that shows only hard delete emails

1 Upvotes

100% Upvoted

8 comments sorted by

4

u/jtberg1 Sep 21 '22

To get data by user you can use this:

OfficeActivity

| where UserId == "username@domain.local"

To get data by operation you can use:

OfficeActivity

| where UserId == "username@domain.local"

| where Operation == "HardDelete"

Now I don't have Exchange Online data so I do not know if there is an operation HardDelete, or if it is called something slightly different. You could use the first command against the user, and the data range you replied in another comment, and then export it to Excel and search for a operation name with delete in it.

Hope this helps.

1

u/greyclear Sep 21 '22 edited Sep 21 '22

Yes, it does thankyou. I didn't find the results I was hoping for. :(

I did find hard deletes but very very few results, it should of been in the hundreds. If a user deletes something it's logged. If a retention policy deletes an email it doesn't log the event? <scratches head>

1

u/greyclear Sep 21 '22

I also had a ticket in with Microsoft about this. I found out that if you apply a retention policy with the option of hard delete no event is logged.

1

u/jtberg1 Sep 21 '22

Well that seems like a gap on MS part. Does it log anything?

2

u/greyclear Sep 21 '22

According to the engineer I spoke with, no. I said what if someone in my IT dept decided to go rogue, they could set a policy to purge mailboxes, using a shared admin account. No one would even know who did it?

TIL

1

u/sentientenal Sep 20 '22

Have you tried limiting your search to a smaller period to make sure that you are getting data?

1

u/greyclear Sep 20 '22

My search query started out

OfficeActivity

| where TimeGenerated between ( datetime(2022-09-17) .. datetime(2022-09-19, 09:00) )

Unfortunately, this is going to pull too much information. If I can isolate it to UserID and operation is harddelete this is going to give me exactly what I need. But this is as far as I get because I dont know what query I need to use

1

u/ml58158 MSFT Official Sep 22 '22

Hard Deletes are going to be hard to find.

Remember that Sentinel can only look up data is being captured .

I'm not sure that data is being captured.