From a9c297a59a7809a065b889ea3ede9b0080db3a57 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Mon, 1 Feb 2021 13:26:49 +0100 Subject: [PATCH] o365: Fix processing of ModifiedProperties field A bug was causing entries for the ModifiedProperties field to be dropped. --- CHANGELOG.next.asciidoc | 1 + .../module/o365/audit/config/pipeline.js | 2 +- .../audit/test/08-azuread.log-expected.json | 100 ++++++++++++++++++ 3 files changed, 102 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 2d9dfe00b18..0f52146894c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -377,6 +377,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Simplify regex for organization custom prefix in AWS/CloudTrail fileset. {issue}23203[23203] {pull}23204[23204] - Fix syslog header parsing in infoblox module. {issue}23272[23272] {pull}23273[23273] - Fix concurrent modification exception in Suricata ingest node pipeline. {pull}23534[23534] +- Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777] *Heartbeat* diff --git a/x-pack/filebeat/module/o365/audit/config/pipeline.js b/x-pack/filebeat/module/o365/audit/config/pipeline.js index b7be6418c18..5d314822af6 100644 --- a/x-pack/filebeat/module/o365/audit/config/pipeline.js +++ b/x-pack/filebeat/module/o365/audit/config/pipeline.js @@ -157,7 +157,7 @@ function makeDictFromModifiedPropertyArray(options) { if (src[i] == null || (name=src[i].Name) == null || (newValue=src[i].NewValue) == null - || (oldValue=src[i].OldValue)) continue; + || (oldValue=src[i].OldValue) == null) continue; name = validFieldName(name); if (name in dict) { if (dict[name].NewValue instanceof Array) { diff --git a/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json b/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json index 78cfca3dbfb..ee64d193719 100644 --- a/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json @@ -91,6 +91,8 @@ "o365.audit.Id": "8f6eb24b-6e61-4ee2-a376-31368c300613", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -235,6 +237,8 @@ "o365.audit.Id": "8f6eb24b-6e61-4ee2-a376-31368c300613", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -379,6 +383,8 @@ "o365.audit.Id": "8f6eb24b-6e61-4ee2-a376-31368c300613", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -2939,6 +2945,8 @@ "o365.audit.Id": "fe115c66-3e08-4ab4-8a00-84ae25a59078", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -3083,6 +3091,8 @@ "o365.audit.Id": "fe115c66-3e08-4ab4-8a00-84ae25a59078", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -3382,6 +3392,8 @@ "o365.audit.Id": "d6ad8dba-dd88-499e-a1e1-e649bf8eeb71", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -3526,6 +3538,8 @@ "o365.audit.Id": "d6ad8dba-dd88-499e-a1e1-e649bf8eeb71", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -3670,6 +3684,8 @@ "o365.audit.Id": "d6ad8dba-dd88-499e-a1e1-e649bf8eeb71", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -5582,6 +5598,8 @@ "o365.audit.Id": "83c924c1-f2e2-4b39-8eda-b80c3823a875", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "StrongAuthenticationPhoneAppDetail", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.StrongAuthenticationPhoneAppDetail.NewValue": "[\r\n {\r\n \"DeviceName\": \"NO_DEVICE\",\r\n \"DeviceToken\": \"NO_DEVICE_TOKEN\",\r\n \"DeviceTag\": \"SoftwareTokenActivated\",\r\n \"PhoneAppVersion\": \"NO_PHONE_APP_VERSION\",\r\n \"OathTokenTimeDrift\": -1,\r\n \"DeviceId\": null,\r\n \"Id\": \"3b539b10-3846-4f9b-877d-55b0b8e76147\",\r\n \"TimeInterval\": null,\r\n \"AuthenticationType\": 2,\r\n \"NotificationType\": 1,\r\n \"SecuredPartitionId\": 0,\r\n \"SecuredKeyId\": 0\r\n }\r\n]", + "o365.audit.ModifiedProperties.StrongAuthenticationPhoneAppDetail.OldValue": "[\r\n {\r\n \"DeviceName\": \"NO_DEVICE\",\r\n \"DeviceToken\": \"NO_DEVICE_TOKEN\",\r\n \"DeviceTag\": \"SoftwareTokenActivated\",\r\n \"PhoneAppVersion\": \"NO_PHONE_APP_VERSION\",\r\n \"OathTokenTimeDrift\": 0,\r\n \"DeviceId\": null,\r\n \"Id\": \"3b539b10-3846-4f9b-877d-55b0b8e76147\",\r\n \"TimeInterval\": null,\r\n \"AuthenticationType\": 2,\r\n \"NotificationType\": 1,\r\n \"SecuredPartitionId\": 0,\r\n \"SecuredKeyId\": 0\r\n }\r\n]", "o365.audit.ModifiedProperties.TargetId_UserType.NewValue": "Member", "o365.audit.ModifiedProperties.TargetId_UserType.OldValue": "", "o365.audit.ObjectId": "asr@testsiem.onmicrosoft.com", @@ -9932,8 +9950,16 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "689aaff0-b34f-4077-9244-0563b9f9c03b", + "o365.audit.ModifiedProperties.AppId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppId.OldValue": "[]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.NewValue": "[\r\n false\r\n]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Add application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -10076,8 +10102,16 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "689aaff0-b34f-4077-9244-0563b9f9c03b", + "o365.audit.ModifiedProperties.AppId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppId.OldValue": "[]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.NewValue": "[\r\n false\r\n]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Add application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -10220,8 +10254,16 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "689aaff0-b34f-4077-9244-0563b9f9c03b", + "o365.audit.ModifiedProperties.AppId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppId.OldValue": "[]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.NewValue": "[\r\n false\r\n]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Add application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -10364,8 +10406,16 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "689aaff0-b34f-4077-9244-0563b9f9c03b", + "o365.audit.ModifiedProperties.AppId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppId.OldValue": "[]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.NewValue": "[\r\n false\r\n]", + "o365.audit.ModifiedProperties.AvailableToOtherTenants.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AppId, AvailableToOtherTenants, DisplayName, RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Add application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -10663,8 +10713,18 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "48403af8-b712-4e63-a999-686b631240ac", + "o365.audit.ModifiedProperties.AccountEnabled.NewValue": "[\r\n true\r\n]", + "o365.audit.ModifiedProperties.AccountEnabled.OldValue": "[]", + "o365.audit.ModifiedProperties.AppPrincipalId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppPrincipalId.OldValue": "[]", + "o365.audit.ModifiedProperties.Credential.NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", + "o365.audit.ModifiedProperties.Credential.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.ServicePrincipalName.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.ServicePrincipalName.OldValue": "[]", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.NewValue": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.OldValue": "", "o365.audit.ObjectId": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", @@ -10818,8 +10878,18 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "48403af8-b712-4e63-a999-686b631240ac", + "o365.audit.ModifiedProperties.AccountEnabled.NewValue": "[\r\n true\r\n]", + "o365.audit.ModifiedProperties.AccountEnabled.OldValue": "[]", + "o365.audit.ModifiedProperties.AppPrincipalId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppPrincipalId.OldValue": "[]", + "o365.audit.ModifiedProperties.Credential.NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", + "o365.audit.ModifiedProperties.Credential.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.ServicePrincipalName.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.ServicePrincipalName.OldValue": "[]", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.NewValue": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.OldValue": "", "o365.audit.ObjectId": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", @@ -10973,8 +11043,18 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "48403af8-b712-4e63-a999-686b631240ac", + "o365.audit.ModifiedProperties.AccountEnabled.NewValue": "[\r\n true\r\n]", + "o365.audit.ModifiedProperties.AccountEnabled.OldValue": "[]", + "o365.audit.ModifiedProperties.AppPrincipalId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppPrincipalId.OldValue": "[]", + "o365.audit.ModifiedProperties.Credential.NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", + "o365.audit.ModifiedProperties.Credential.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.ServicePrincipalName.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.ServicePrincipalName.OldValue": "[]", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.NewValue": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.OldValue": "", "o365.audit.ObjectId": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", @@ -11128,8 +11208,18 @@ "o365.audit.ExtendedProperties.teamName": "MSODS.", "o365.audit.ExtendedProperties.version": "2", "o365.audit.Id": "48403af8-b712-4e63-a999-686b631240ac", + "o365.audit.ModifiedProperties.AccountEnabled.NewValue": "[\r\n true\r\n]", + "o365.audit.ModifiedProperties.AccountEnabled.OldValue": "[]", + "o365.audit.ModifiedProperties.AppPrincipalId.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.AppPrincipalId.OldValue": "[]", + "o365.audit.ModifiedProperties.Credential.NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", + "o365.audit.ModifiedProperties.Credential.OldValue": "[]", + "o365.audit.ModifiedProperties.DisplayName.NewValue": "[\r\n \"siem2\"\r\n]", + "o365.audit.ModifiedProperties.DisplayName.OldValue": "[]", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.ServicePrincipalName.NewValue": "[\r\n \"7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40\"\r\n]", + "o365.audit.ModifiedProperties.ServicePrincipalName.OldValue": "[]", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.NewValue": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", "o365.audit.ModifiedProperties.TargetId_ServicePrincipalNames.OldValue": "", "o365.audit.ObjectId": "7d74cd19-0dc4-4e59-a2d7-ba6fdb44ac40", @@ -11426,6 +11516,8 @@ "o365.audit.Id": "20a82fa1-625b-491a-a3e8-54d779a9b17e", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "KeyDescription", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.KeyDescription.NewValue": "[\r\n \"[KeyIdentifier=6d944a5f-234c-4879-8de4-39f089d8b96b,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=E=asr@example.net, CN=testsiem.onmicrosoft.com, OU=SIEM, O=Elastic, L=Barcelona, S=Barce]\"\r\n]", + "o365.audit.ModifiedProperties.KeyDescription.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application \u2013 Certificates and secrets management ", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -11570,6 +11662,8 @@ "o365.audit.Id": "20a82fa1-625b-491a-a3e8-54d779a9b17e", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "KeyDescription", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.KeyDescription.NewValue": "[\r\n \"[KeyIdentifier=6d944a5f-234c-4879-8de4-39f089d8b96b,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=E=asr@example.net, CN=testsiem.onmicrosoft.com, OU=SIEM, O=Elastic, L=Barcelona, S=Barce]\"\r\n]", + "o365.audit.ModifiedProperties.KeyDescription.OldValue": "[]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application \u2013 Certificates and secrets management ", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -12179,6 +12273,8 @@ "o365.audit.Id": "d23b201c-5436-4ecc-a789-18d3f00ea76c", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -12323,6 +12419,8 @@ "o365.audit.Id": "d23b201c-5436-4ecc-a789-18d3f00ea76c", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", @@ -12467,6 +12565,8 @@ "o365.audit.Id": "d23b201c-5436-4ecc-a789-18d3f00ea76c", "o365.audit.ModifiedProperties.Included_Updated_Properties.NewValue": "RequiredResourceAccess", "o365.audit.ModifiedProperties.Included_Updated_Properties.OldValue": "", + "o365.audit.ModifiedProperties.RequiredResourceAccess.NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"c5393580-f805-4401-95e8-94b7a6ef2fc2\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"594c1fb6-4f81-4475-ae41-0c394909246c\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"4807a72c-ad38-4250-94c9-4eabfe26cd55\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"e2cea78f-e743-4d8f-a16a-75b629a038ae\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", + "o365.audit.ModifiedProperties.RequiredResourceAccess.OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "o365.audit.ObjectId": "Not Available", "o365.audit.Operation": "Update application.", "o365.audit.OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd",