Skip to content

Commit 2fae1e9

Browse files
PMEds28PMEds28
authored
Merge pull request #222722 from limwainstein/aip-mip-connector
New Microsoft Purview connector
2 parents 61746be + 2b2ebba commit 2fae1e9

File tree

5 files changed

+197
-7
lines changed

5 files changed

+197
-7
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,8 @@
266266
href: connect-dns-ama.md
267267
- name: Syslog (raw) sources
268268
href: connect-syslog.md
269+
- name: Microsoft Purview Information Protection
270+
href: connect-microsoft-purview.md
269271
- name: Microsoft Sentinel Data Collector API
270272
href: connect-rest-api-template.md
271273
- name: Azure Functions API connection
@@ -579,6 +581,8 @@
579581
href: windows-security-event-id-reference.md
580582
- name: DNS over AMA reference
581583
href: dns-ama-fields.md
584+
- name: Microsoft Purview Information Protection reference
585+
href: microsoft-purview-record-types-activities.md
582586
- name: Microsoft 365 Defender connector data type support
583587
href: microsoft-365-defender-cloud-support.md
584588
- name: Detection and analysis references

‎articles/sentinel/connect-microsoft-purview.md

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
title: Stream data from Microsoft Purview Information Protection to Microsoft Sentinel
3+
description: Stream data from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to Microsoft Sentinel so you can analyze and report on data from the Microsoft Purview labeling clients and scanners.
4+
author: limwainstein
5+
ms.topic: how-to
6+
ms.date: 01/02/2023
7+
ms.author: lwainstein
8+
#Customer intent: As a security operator, I want to get specific labeling data from Microsoft Purview, so I can track, analyze, report on the data and use it for compliance purposes.
9+
---
10+
11+
# Stream data from Microsoft Purview Information Protection to Microsoft Sentinel
12+
13+
This article describes how to stream data from Microsoft Purview Information Protection (formerly Microsoft Information Protection or MIP) to Microsoft Sentinel. You can use the data ingested from the Microsoft Purview labeling clients and scanners to track, analyze, report on the data, and use it for compliance purposes.
14+
15+
> [!IMPORTANT]
16+
> The Microsoft Purview Information Protection connector is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17+
18+
## Overview
19+
20+
Auditing and reporting are an important part of organizations' security and compliance strategy. With the continued expansion of the technology landscape that has an ever-increasing number of systems, endpoints, operations, and regulations, it becomes even more important to have a comprehensive logging and reporting solution in place.
21+
22+
With the Microsoft Purview Information Protection connector, you stream auditing events generated from unified labeling clients and scanners. The data is then emitted to the Microsoft 365 audit log for central reporting in Microsoft Sentinel.
23+
24+
With the connector, you can:
25+
26+
- Track adoption of labels, explore, query, and detect events.
27+
- Monitor labeled and protected documents and emails.
28+
- Monitor user access to labeled documents and emails, while tracking classification changes.
29+
- Gain visibility into activities performed on labels, policies, configurations, files and documents. This visibility helps security teams identify security breaches, and risk and compliance violations.
30+
- Use the connector data during an audit, to prove that the organization is compliant.
31+
32+
### Azure Information Protection connector vs. Microsoft Purview Information Protection connector
33+
34+
This connector replaces the Azure Information Protection (AIP) data connector. The Azure Information Protection (AIP) data connector uses the AIP audit logs (public preview) feature. As of **March 31, 2023**, the AIP analytics and audit logs public preview will be retired, and moving forward will be using the [Microsoft 365 auditing solution](/microsoft-365/compliance/auditing-solutions-overview).
35+
36+
For more information:
37+
- See [Removed and retired services](/azure/information-protection/removed-sunset-services#azure-information-protection-analytics).
38+
- Learn how to [disconnect the AIP connector](#disconnect-the-azure-information-protection-connector).
39+
40+
When you enable the Microsoft Purview Information Protection connector, audit logs stream into the standardized
41+
`MicrosoftPurviewInformationProtection` table. Data is gathered through the [Office Management API](/office/office-365-management-api/office-365-management-activity-api-schema), which uses a structured schema. The new standardized schema is adjusted to enhance the deprecated schema used by AIP, with more fields and easier access to parameters.
42+
43+
Review the list of supported [audit log record types and activities](microsoft-purview-record-types-activities.md).
44+
45+
## Prerequisites
46+
47+
Before you begin, verify that you have:
48+
49+
- The Microsoft Sentinel solution enabled.
50+
- A defined Microsoft Sentinel workspace.
51+
- A valid license to [Microsoft Purview Information Protection](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).
52+
- [Enabled Sensitivity labels for Office](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files?view=o365-worldwide#use-the-microsoft-purview-compliance-portal-to-enable-support-for-sensitivity-labels&preserve-view=true) and [enabled auditing](/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide#use-the-compliance-center-to-turn-on-auditing&preserve-view=true).
53+
- The Global Administrator or Security Administrator role on the workspace.
54+
55+
## Set up the connector
56+
57+
> [!NOTE]
58+
> If you set the connector on a workspace located in a different region than your Office 365 location, data might be streamed across regions.
59+
60+
1. Open the [Azure portal](https://portal.azure.com/) and navigate to the **Microsoft Sentinel** service.
61+
1. In the **Data connectors** blade, in the search bar, type *Purview*.
62+
1. Select the **Microsoft Purview Information Protection (Preview)** connector.
63+
1. Below the connector description, select **Open connector page**.
64+
1. Under **Configuration**, select **Connect**.
65+
66+
When a connection is established, the **Connect** button changes to **Disconnect**. You're now connected to the Microsoft Purview Information Protection.
67+
68+
Review the list of supported [audit log record types and activities](microsoft-purview-record-types-activities.md).
69+
70+
## Disconnect the Azure Information Protection connector
71+
72+
We recommend using the Azure Information Protection connector and the Microsoft Purview Information Protection connector simultaneously (both enabled) for a short testing period. After the testing period, we recommend that you disconnect the Azure Information Protection connector to avoid data duplication and redundant costs.
73+
74+
To disconnect the Azure Information Protection connector:
75+
76+
1. In the **Data connectors** blade, in the search bar, type *Azure Information Protection*.
77+
1. Select **Azure Information Protection**.
78+
1. Below the connector description, select **Open connector page**.
79+
1. Under **Configuration**, select **Disconnect**.
80+
81+
## Known Issues And Limitations
82+
83+
- The Office Management API doesn't obtain a Downgrade Label with the names of the labels before and after the downgrade. To retrieve this information, extract the `labelId` of each label and enrich the results.
84+
85+
Here's an example KQL query:
86+
87+
```kusto
88+
let labelsMap = parse_json('{'
89+
'"566a334c-ea55-4a20-a1f2-cef81bfaxxxx": "MyLabel1",'
90+
'"aa1c4270-0694-4fe6-b220-8c7904b0xxxx": "MyLabel2",'
91+
'"MySensitivityLabelId": "MyLabel3"'
92+
'}');
93+
MicrosoftPurviewInformationProtection
94+
| extend SensitivityLabelName = iif(isnotempty(SensitivityLabelId),
95+
tostring(labelsMap[tostring(SensitivityLabelId)]), "")
96+
| extend OldSensitivityLabelName = iif(isnotempty(OldSensitivityLabelId),
97+
tostring(labelsMap[tostring(OldSensitivityLabelId)]), "")
98+
```
99+
100+
- The `MicrosoftPurviewInformationProtection` table and the `OfficeActivity` table might include some duplicated events.
101+
102+
## Next steps
103+
104+
In this article, you learned how to set up the Microsoft Purview Information Protection connector to track, analyze, report on the data, and use it for compliance purposes. To learn more about Microsoft Sentinel, see the following articles:
105+
106+
- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
107+
- Get started [detecting threats with Microsoft Sentinel](detect-threats-built-in.md).
108+
- [Use workbooks](monitor-your-data.md) to monitor your data.

‎articles/sentinel/data-connectors-reference.md

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -367,20 +367,21 @@ See [Microsoft Defender for Cloud](#microsoft-defender-for-cloud).
367367

368368
## Azure Information Protection (Preview)
369369

370+
> [!NOTE]
371+
> The Azure Information Protection (AIP) data connector uses the AIP audit logs (public preview) feature. As of **March 31, 2023**, the AIP analytics and audit logs public preview will be retired, and moving forward will be using the [Microsoft 365 auditing solution](/microsoft-365/compliance/auditing-solutions-overview).
372+
>
373+
> For more information, see [Removed and retired services](/azure/information-protection/removed-sunset-services#azure-information-protection-analytics).
374+
>
375+
376+
See the [Microsoft Purview Information Protection](#microsoft-purview-information-protection-preview) connector, which will replace this connector.
377+
370378
| Connector attribute | Description |
371379
| --- | --- |
372380
| **Data ingestion method** | [**Azure service-to-service integration**](connect-azure-windows-microsoft-services.md) |
373381
| **Log Analytics table(s)** | InformationProtectionLogs_CL |
374382
| **DCR support** | Not currently supported |
375383
| **Supported by** | Microsoft |
376384

377-
378-
> [!NOTE]
379-
> The Azure Information Protection (AIP) data connector uses the AIP audit logs (public preview) feature. As of **March 18, 2022**, we are sunsetting the AIP analytics and audit logs public preview, and moving forward will be using the [Microsoft 365 auditing solution](/microsoft-365/compliance/auditing-solutions-overview). Full retirement is scheduled for **September 30, 2022**.
380-
>
381-
> For more information, see [Removed and retired services](/azure/information-protection/removed-sunset-services#azure-information-protection-analytics).
382-
>
383-
384385
## Azure Key Vault
385386

386387
| Connector attribute | Description |
@@ -1230,6 +1231,14 @@ Add http://localhost:8081/ under **Authorized redirect URIs** while creating [We
12301231
| **Log Analytics table(s)** | ProjectActivity |
12311232
| **Supported by** | Microsoft |
12321233

1234+
## Microsoft Purview Information Protection (Preview)
1235+
| Connector attribute | Description |
1236+
| --- | --- |
1237+
| **Data ingestion method** | **Azure service-to-service integration: <br>[API-based connections](connect-microsoft-purview.md)** |
1238+
| **License prerequisites/<br>Cost information** | Your Office 365 deployment must be on the same tenant as your Microsoft Sentinel workspace.<br>Other charges may apply. |
1239+
| **Log Analytics table(s)** | MicrosoftPurviewInformationProtection |
1240+
| **Supported by** | Microsoft |
1241+
12331242

12341243
## Microsoft Sysmon for Linux (Preview)
12351244

‎articles/sentinel/microsoft-purview-record-types-activities.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: Microsoft Purview Information Protection connector reference - audit log record types and activities support in Microsoft Sentinel
3+
description: This article lists supported audit log record types and activities when using the Microsoft Purview Information Protection connector with Microsoft Sentinel.
4+
author: limwainstein
5+
ms.author: lwainstein
6+
ms.topic: reference
7+
ms.date: 01/02/2023
8+
---
9+
10+
# Microsoft Purview Information Protection connector reference - audit log record types and activities support
11+
12+
This article lists supported audit log record types and activities when using the Microsoft Purview Information Protection connector with Microsoft Sentinel.
13+
14+
When you use the [Microsoft Purview Information Protection connector](connect-microsoft-purview.md), you stream audit logs into the
15+
`MicrosoftPurviewInformationProtection` standardized table. Data is
16+
gathered through the [Office Management API](/office/office-365-management-api/office-365-management-activity-api-schema), which uses a structured schema.
17+
18+
## Supported audit log record types
19+
20+
21+
|Value |Member |Name |Description |Operations |
22+
|---------|---------|---------|---------|---------|
23+
|93 |`AipDiscover` |Microsoft Purview scanner events. |Describes the type of access. |
24+
|94 |`AipSensitivityLabelAction` |Microsoft Purview sensitivity label event. |The operation type for the audit log. The name of the user or admin activity for a description of the most common operations: <ul><li>`SensitivityLabelApplied`</li><li>`SensitivityLabelUpdated`</li><li>`SensitivityLabelRemoved`</li><li>`SensitivityLabelPolicyMatched`</li><li>`SensitivityLabeledFileOpened`</li></ul> |
25+
|95 |`AipProtectionAction` |Microsoft Purview protection events. |Contains information related to Microsoft Purview protection events. |
26+
|96 |`AipFileDeleted` | Microsoft Purview file deletion event. |Contains information related to Microsoft Purview file deletion events. |
27+
|97 |`AipHeartBeat` |Microsoft Purview heartbeat event. |The operation type for the audit log. The name of the user or admin activity for a description of the most common operations or activities:<ul><li>`SensitivityLabelApplied`</li>`SensitivityLabelUpdated`</li><li>`SensitivityLabelRemoved`</li><li>`SensitivityLabelPolicyMatched`</li><li>`SensitivityLabeledFileOpened`</li> |
28+
|43 |`MipLabel` | Events detected in the transport pipeline of email messages that are tagged (manually or automatically) with sensitivity labels. | |
29+
|82 |`SensitivityLabelPolicyMatch` |Events generated when a file labeled with a sensitive label is opened or renamed. |
30+
|83 |`SensitivityLabelAction` |Event generated when sensitivity labels are applied, updated or removed. | |
31+
|84 |`SensitivityLabeledFileAction` | Events generated when a file labeled with a sensitivity label is opened or renamed. | |
32+
|71 |`MipAutoLabelSharePointItem` |Auto-labeling events in SharePoint | |
33+
|72 |`MipAutoLabelSharePointPolicyLocation` |Auto-labeling policy events in SharePoint. | |
34+
|75 |`MipAutoLabelExchangeItem` |Auto-labeling events in Microsoft Exchange. | |
35+
36+
37+
## Supported activities
38+
39+
|Friendly name |Operation |Description |
40+
|---------|---------|---------|
41+
|Applied sensitivity label to file |`FileSensitivityLabelApplied` |A sensitivity label was applied to a document via Microsoft 365 apps, Office on the web, or an auto-labeling policy. |
42+
|Changed sensitivity label applied to file |`FileSensitivityLabelChanged` |A different sensitivity label was applied to a document. An Office on the web or an auto-labeling policy changed. |
43+
|Removed sensitivity label from file |`FileSensitivityLabelRemoved` |A sensitivity label was removed from a document via Microsoft 365 apps, Office on the web, an auto-labeling policy, or the [Unlock-SPOSensitivityLabelEncryptedFile](/powershell/module/sharepoint-online/unlock-sposensitivitylabelencryptedFile) cmdlet. |
44+
|Applied sensitivity label to site |`SensitivityLabelApplied` | A sensitivity label was applied to a SharePoint or Teams site. |
45+
|Changed sensitivity label applied to file |`SensitivityLabelUpdated` |A different sensitivity label was applied to a document. |
46+
|Removed sensitivity label from site |`SensitivityLabelRemoved` |A sensitivity label was removed from a SharePoint or Teams site. |
47+
| |`SiteSensitivityLabelApplied` |A sensitivity label was applied to a SharePoint or Teams site. |
48+
|Changed sensitivity label on a site |`SensitivityLabelChanged` |A different sensitivity label was applied to a SharePoint or Teams site. |
49+
|Removed sensitivity label from site |`SiteSensitivityLabelRemoved` |A sensitivity label was removed from a SharePoint or Teams site. |
50+
|Document |`DocumentSensitivityMismatchDetected` |Non auditable activity. Signals to Substrate that the item was removed from the SharedWithMe view. This is the same as the `RemovedFromSharedWithMe` operation, but without audit. |
51+
52+
## Next steps
53+
54+
In this article, you learned about the audit log record types and activities supported when you use the Microsoft Purview Information Protection connector. To learn more about Microsoft Sentinel, see the following articles:
55+
56+
- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
57+
- Get started [detecting threats with Microsoft Sentinel](detect-threats-built-in.md).
58+
- [Use workbooks](monitor-your-data.md) to monitor your data.

‎articles/sentinel/whats-new.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,17 @@ The listed features were released in the last three months. For information abou
1616

1717
[!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
1818

19+
## January 2023
20+
21+
### Microsoft Purview Information Protection connector (Preview)
22+
23+
With the new [Microsoft Purview Information Protection connector](connect-microsoft-purview.md), you can stream data from Microsoft Purview Information Protection (formerly Microsoft Information Protection or MIP) to Microsoft Sentinel. You can use the data ingested from the Microsoft Purview labeling clients and scanners to track, analyze, report on the data, and use it for compliance purposes.
24+
25+
This connector replaces the Azure Information Protection (AIP) data connector, aligned with the retirement of the AIP analytics and audit logs public preview as of **March 31, 2023**.
26+
27+
The new connector streams audit logs into the standardized
28+
`MicrosoftPurviewInformationProtection` table, which has been adjusted to enhance the deprecated schema used by AIP, with more fields and easier access to parameters. Data is gathered through the [Office Management API](/office/office-365-management-api/office-365-management-activity-api-schema), which uses a structured schema. Review the list of supported [audit log record types and activities](microsoft-purview-record-types-activities.md).
29+
1930
## December 2022
2031

2132
- [Create and run playbooks on entities on-demand (Preview)](#create-and-run-playbooks-on-entities-on-demand-preview)

0 commit comments

Comments
 (0)