Skip to content

Commit 86ca8ce

Browse files
limwainsteinlimwainstein
committed
New Microsoft Purview connector
1 parent 305e8a8 commit 86ca8ce

File tree

2 files changed

+146
-0
lines changed

2 files changed

+146
-0
lines changed

‎articles/sentinel/connect-microsoft-purview.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
title: Stream data from Microsoft Purview Information Protection to Microsoft Sentinel
3+
description: Stream data from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to Microsoft Sentinel so you can analyze and report on data from the Microsoft Purview labeling clients and scanners.
4+
author: limwainstein
5+
ms.topic: how-to
6+
ms.date: 01/02/2023
7+
ms.author: lwainstein
8+
#Customer intent: As a security operator, I want to get specific labeling data from Microsoft Purview, so I can track, analyze, report on the data and use it for compliance purposes.
9+
---
10+
11+
# Stream data from Microsoft Purview Information Protection to Microsoft Sentinel
12+
13+
This article describes how to stream data from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to Microsoft Sentinel. You can use the data ingested from the Microsoft Purview labeling clients and scanners to track, analyze, report on the data, and use it for compliance purposes.
14+
15+
> [!IMPORTANT]
16+
> The Microsoft Purview Information Protection connector is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17+
18+
## Overview
19+
20+
Auditing and reporting are an important part of the security and compliance strategy for many organizations. With the continued expansion of the technology landscape that has an ever-increasing number of systems, endpoints, operations, and regulations, it becomes even more important to have a comprehensive logging and reporting solution in place.
21+
22+
With the Microsoft Purview Information Protection connector, you stream auditing events generated from unified labeling clients and scanners. The data is then emitted to the Microsoft 365 audit log for central reporting in Microsoft Sentinel.
23+
24+
With the connector, you can:
25+
26+
- Track adoption of labels, explore, query and detects events.
27+
- Monitor labeled and protected documents and emails
28+
- Monitor user access to labeled documents and emails, while tracking classification changes.
29+
- Gain visibility into activities performed on labels, policies, configurations, files and documents. This helps security teams to identify security breaches, and risk and compliance violations.
30+
- Use the connector data during an audit, to prove that the organization is compliant.
31+
32+
### Schema and API
33+
34+
If you're currently using the Azure Information Protection connector, note that the Azure Information Protection (AIP) service is undergoing sunsetting.
35+
36+
When you enable the Microsoft Purview Information Protection connector, audit logs stream into the standardized
37+
`MicrosoftPurviewInformationProtection` table. Data is gathered through the [Office Management API](/office/office-365-management-api/office-365-management-activity-api-schema), which uses a structured schema. The new standardized schema is adjusted to enhance the deprecated schema used by AIP, with more fields and easier access to
38+
parameters.
39+
40+
Review the list of supported [audit log record types and activities](microsoft-purview-record-types-activities.md).
41+
42+
## Prerequisites
43+
44+
Before you begin, verify that you have:
45+
46+
- The Microsoft Sentinel solution enabled.
47+
- A defined Microsoft Sentinel workspace.
48+
- A valid license to [Microsoft Purview Information Protection](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).
49+
- [Enabled Sensitivity labels for Office](/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files?view=o365-worldwide#use-the-microsoft-purview-compliance-portal-to-enable-support-for-sensitivity-labels) and [enabled auditing](/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide#use-the-compliance-center-to-turn-on-auditing).
50+
- The Global Administrator or Security Administrator role on the workspace.
51+
52+
## Set up the connector
53+
54+
1. Open the [Azure portal](https://portal.azure.com/) and navigate to the **Microsoft Sentinel** service.
55+
1. In the **Data connectors** blade, in the search bar, type *Purview*.
56+
1. Select the **Microsoft Purview Information Protection (Preview)** connector.
57+
1. Below the connector description, select **Open connector page**.
58+
1. Under **Configuration**, select **Connect**.
59+
60+
When a connection is established, the **Connect** button changes to **Disconnect**. You are now connected to the Microsoft Purview Information Protection.
61+
62+
## Disconnect the Azure Information Protection connector
63+
64+
If you the Azure Information Protection connector is still connected in your workspace, you must disconnect the Azure Information Protection connector.
65+
66+
We recommend to use the Azure Information Protection connector and the Microsoft Purview Information Protection connector simultaneously (both enabled) for a short testing period. After the testing period, we recommend that you disconnect the Azure Information Protection connector to avoid data duplication and redundant costs.
67+
68+
To disconnect the Azure Information Protection connector:
69+
70+
1. In the **Data connectors** blade, in the search bar, type *Azure Information Protection*.
71+
1. Select **Azure Information Protection**.
72+
1. Below the connector description, select **Open connector page**.
73+
1. Under **Configuration**, select **Disconnect**.
74+
75+
## Known Issues And Limitations
76+
77+
### Office Management API doesn't obtain a Downgrade Label
78+
79+
- The Office Management API doesn't obtain a Downgrade Label with the names of the labels before and after the downgrade. To retrieve this information, extracting the `labelId` of each label and enrich the results.
80+
81+
Here's an example KQL query:
82+
83+
```kusto
84+
let labelsMap = parse_json('{'
85+
'"566a334c-ea55-4a20-a1f2-cef81bfaxxxx": "MyLabel1",'
86+
'"aa1c4270-0694-4fe6-b220-8c7904b0xxxx": "MyLabel2",'
87+
'"MySensitivityLabelId": "MyLabel3"'
88+
'}');
89+
MicrosoftPurviewInformationProtection
90+
| extend SensitivityLabelName = iif(isnotempty(SensitivityLabelId),
91+
tostring(labelsMap[tostring(SensitivityLabelId)]), "")
92+
| extend OldSensitivityLabelName = iif(isnotempty(OldSensitivityLabelId),
93+
tostring(labelsMap[tostring(OldSensitivityLabelId)]), "")
94+
```
95+
96+
- The `MicrosoftPurviewInformationProtection` table and the `OfficeActivity` table might include some duplicated events.

‎articles/sentinel/microsoft-purview-record-types-activities.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: Microsoft Purview Information Protection connector reference - audit log record types and activities support in Microsoft Sentinel
3+
description: This article lists supported audit log record types and activities when using the Microsoft Purview Information Protection connector with Microsoft Sentinel.
4+
author: limwainstein
5+
ms.author: lwainstein
6+
ms.topic: reference
7+
ms.date: 01/02/2023
8+
---
9+
10+
# Microsoft Purview Information Protection connector reference - audit log record types and activities support
11+
12+
This article lists supported audit log record types and activities when using the Microsoft Purview Information Protection connector with Microsoft Sentinel.
13+
14+
When you use the [Microsoft Purview Information Protection connector](connect-microsoft-purview.md), you stream audit logs into the
15+
`MicrosoftPurviewInformationProtection` standardized table. Data is
16+
gathered through the [Office Management API](/office-365-management-api/office-365-management-activity-api-schema), which uses a structured schema.
17+
18+
## Supported audit log record types
19+
20+
21+
|Value |Member |Name |Description |Operations |
22+
|---------|---------|---------|---------|---------|
23+
|93 |`AipDiscover` |Microsoft Purview scanner events. |Describes the type of access. |
24+
|94 |`AipSensitivityLabelAction` |Microsoft Purview sensitivity label event. |The operation type for the audit log. The name of the user or admin activity for a description of the most common operations: <ul><li>`SensitivityLabelApplied`</li><li>`SensitivityLabelUpdated`</li><li>`SensitivityLabelRemoved`</li><li>`SensitivityLabelPolicyMatched`</li><li>`SensitivityLabeledFileOpened`</li></ul> |
25+
|95 |`AipProtectionAction` |Microsoft Purview protection events. |Contains information related to Microsoft Purview protection events. |
26+
|96 |`AipFileDeleted` | Microsoft Purview file deletion event. |Contains information related to Microsoft Purview file deletion events. |
27+
|97 |`AipHeartBeat` |Microsoft Purview heartbeat event. |The operation type for the audit log. The name of the user or admin activity for a description of the most common operations or activities:<ul><li>`SensitivityLabelApplied`</li>`SensitivityLabelUpdated`</li><li>`SensitivityLabelRemoved`</li><li>`SensitivityLabelPolicyMatched`</li><li>`SensitivityLabeledFileOpened`</li> |
28+
|43 |`MipLabel` | Events detected in the transport pipeline of email messages that are tagged (manually or automatically) with sensitivity labels. | |
29+
|82 |`SensitivityLabelPolicyMatch` |Events generated when a file labeled with a sensitive label is opened or renamed. |
30+
|83 |`SensitivityLabelAction` |Event generated when sensitivity labels are applied, updated or removed. | |
31+
|84 |`SensitivityLabeledFileAction` | Events generated when a file labeled with a sensitivity label is opened or renamed. | |
32+
|71 |`MipAutoLabelSharePointItem` |Auto-labeling events in SharePoint | |
33+
|72 |`MipAutoLabelSharePointPolicyLocation` |Auto-labeling policy events in SharePoint. | |
34+
|75 |`MipAutoLabelExchangeItem` |Auto-labeling events in Microsoft Exchange. | |
35+
36+
37+
## Supported activities
38+
39+
|Friendly name |Operation |Description |
40+
|---------|---------|---------|
41+
|Applied sensitivity label to file |`FileSensitivityLabelApplied` |A sensitivity label was applied to a document via Microsoft 365 apps, Office on the web, or an auto-labeling policy. |
42+
|Changed sensitivity label applied to file |`FileSensitivityLabelChanged` |A different sensitivity label was applied to a document. An Office on the web or an auto-labeling policy changed. |
43+
|Removed sensitivity label from file |`FileSensitivityLabelRemoved` |A sensitivity label was removed from a document via Microsoft 365 apps, Office on the web, an auto-labeling policy, or the [Unlock-SPOSensitivityLabelEncryptedFile](/powershell/module/sharepoint-online/unlock-sposensitivitylabelencryptedFile) cmdlet. |
44+
|Applied sensitivity label to site |`SensitivityLabelApplied` | A sensitivity label was applied to a SharePoint or Teams site. |
45+
|Changed sensitivity label applied to file |`SensitivityLabelUpdated` |A different sensitivity label was applied to a document. |
46+
|Removed sensitivity label from site |`SensitivityLabelRemoved` |A sensitivity label was removed from a SharePoint or Teams site. |
47+
| |`SiteSensitivityLabelApplied` |A sensitivity label was applied to a SharePoint or Teams site. |
48+
|Changed sensitivity label on a site |`SensitivityLabelChanged` |A different sensitivity label was applied to a SharePoint or Teams site. |
49+
|Removed sensitivity label from site |`SiteSensitivityLabelRemoved` |A sensitivity label was removed from a SharePoint or Teams site. |
50+
|Document |`DocumentSensitivityMismatchDetected` |Non auditable activity. Signals to Substrate that the item was removed from the SharedWithMe view. This is the same as the `RemovedFromSharedWithMe` operation, but without audit. |

0 commit comments

Comments
 (0)