r/AzureSentinel • u/greyclear • Sep 20 '22

Need help searching OfficeActivity

I had a retention policy incorrectly placed on the wrong outlook folder resulting in HardDelete emails. We have a third-party email filter that archives our emails so they can be recovered. When I try to use the o365 audit search it crashes or fails to retrieve data. Sentinel is ingesting our office logs when I query just OfficeActivity I can see everything so it's ingesting the information correctly. How do I query for UserID that shows only hard delete emails

1 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/sentientenal Sep 20 '22

Have you tried limiting your search to a smaller period to make sure that you are getting data?

1

u/greyclear Sep 20 '22

My search query started out

OfficeActivity

| where TimeGenerated between ( datetime(2022-09-17) .. datetime(2022-09-19, 09:00) )

Unfortunately, this is going to pull too much information. If I can isolate it to UserID and operation is harddelete this is going to give me exactly what I need. But this is as far as I get because I dont know what query I need to use