Skip to content

Commit d11f40d

Browse files
schmurkyschmurky
committed
Graph API audit events
1 parent e980057 commit d11f40d

File tree

4 files changed

+70
-0
lines changed

4 files changed

+70
-0
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,8 @@
298298
href: advanced-hunting-exposuregraphedges-table.md
299299
- name: ExposureGraphNodes
300300
href: advanced-hunting-exposuregraphnodes-table.md
301+
- name: GraphApiAuditEvents
302+
href: advanced-hunting-graphapiauditevents-table.md
301303
- name: IdentityDirectoryEvents
302304
href: advanced-hunting-identitydirectoryevents-table.md
303305
- name: IdentityInfo

‎defender-xdr/advanced-hunting-graphapiauditevents-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: GraphApiAuditEvents table in the advanced hunting schema
3+
description: Learn about the GraphApiAuditEvents table in the advanced hunting schema, which provides information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-mjosephy
10+
author: mjosephym
11+
ms.localizationpriority: medium
12+
manager: rayne-wiselman
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 03/12/2024
22+
---
23+
24+
# GraphApiAuditEvents (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
> [!IMPORTANT]
30+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
31+
32+
The `GraphApiAuditEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant. Use this reference to construct queries that return information from this table.
33+
34+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
35+
36+
| Column name | Data type | Description |
37+
|-------------|-----------|-------------|
38+
| `IdentityProvider` | `string` | Identity provider that authenticated the subject of the token |
39+
| `ApiVersion` | `string` | The API version of the event |
40+
| `ApplicationId` | `string` | Unique identifier for the application |
41+
| `ClientRequestId` | `string` | Identifier for the client request sent; if none is available, the operation identifier is used instead |
42+
| `RequestUri` | `string` | Uniform resource identifier (URI) of the request |
43+
| `OperationId` | `string` | Identifier for a batch of requests; the same identifier is used for all requests in a batch but if requests are non-batched, the identifier is unique per request |
44+
| `AccountObjectId` | `string` | Unique identifier for the user making the request |
45+
| `Location` | `string` | Name of the region that served the request |
46+
| `RequestDuration` | `string` | Duration of the request in milliseconds |
47+
| `RequestMethod` | `string` | HTTP method of the request |
48+
| `Timestamp` | `string` | Date and time when the request was recorded |
49+
| `ResponseStatusCode` | `string` | HTTP response status code for the request |
50+
| `Scopes` | `string` | Scopes in token claims |
51+
| `RequesterRoles` | `string` | Denotes the tenant-wide roles assigned to the user making the request|
52+
| `RequestDetails` | `string` | Contains information about the request, like the IP address of the client from where the request occurred, the URI of the request, the user-agent information related to request, the application display name |
53+
| `UserAgent` | `string` |User agent information from the web browser or other client application|
54+
| `EntityType` | `string` | Type of entity that performed the action |
55+
56+
## Related articles
57+
58+
- [Advanced hunting overview](advanced-hunting-overview.md)
59+
- [Learn the query language](advanced-hunting-query-language.md)
60+
- [Use shared queries](advanced-hunting-shared-queries.md)
61+
- [Understand the schema](advanced-hunting-schema-tables.md)
62+
- [Apply query best practices](advanced-hunting-best-practices.md)
63+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ The following reference lists all the tables in the schema. Each table name link
9696
| **[EmailUrlInfo](advanced-hunting-emailurlinfo-table.md)** | Information about URLs on emails |
9797
| **[ExposureGraphEdges](advanced-hunting-exposuregraphedges-table.md)** | Microsoft Security Exposure Management exposure graph edge information provides visibility into relationships between entities and assets in the graph |
9898
| **[ExposureGraphNodes](advanced-hunting-exposuregraphnodes-table.md)** | Microsoft Security Exposure Management exposure graph node information, about organizational entities and their properties |
99+
| **[GraphApiAuditEvents](advanced-hunting-graphapiauditevents-table.md)** | Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant |
99100
| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)** | Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller. |
100101
| **[IdentityInfo](advanced-hunting-identityinfo-table.md)** | Account information from various sources, including Microsoft Entra ID |
101102
| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)** | Authentication events on Active Directory and Microsoft online services |

‎defender-xdr/whats-new.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ For more information on what's new with other Microsoft Defender security produc
3232

3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

35+
36+
## March 2025
37+
- (Preview) The [GraphApiAuditEvents](advanced-hunting-graphapiauditevents-table.md) table in advanced hunting is now available for preview. This table contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.
38+
3539
## February 2025
3640

3741
- (Preview) IP addresses can now be excluded from automated responses in attack disruption. This feature allows you to exclude specific IPs from automated containment actions triggered by attack disruption. For more information, see [Exclude assets from automated responses in automatic attack disruption](automatic-attack-disruption-exclusions.md).

0 commit comments

Comments
 (0)