From 506464e13b0e411600ccd4823053e395d4822ced Mon Sep 17 00:00:00 2001 From: mayanksahu11 <168190827+mayanksahu11@users.noreply.github.com> Date: Tue, 15 Oct 2024 17:41:20 +0530 Subject: [PATCH 1/3] Update Export-ActivityExplorerData.md Adding the list of supported filters --- .../exchange/Export-ActivityExplorerData.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md index d480f0498d..70402fa341 100644 --- a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md +++ b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md @@ -33,6 +33,28 @@ Export-ActivityExplorerData -EndTime -OutputFormat -StartTim ``` ## DESCRIPTION +This cmdlet supports following filters + +| | | | | +| --- | --- | --- | --- | +| Activity | Application | ArtifactType | ClientIP | +| ColdScanPolicyId | CopilotAppHost | CopilotThreadId | CopilotType | +| CreationTime | DataState | DestinationFilePath | DestinationLocationType | +| DeviceName | DLPPolicyId | DLPPolicyRuleId | EmailReceiver | +| EmailSender | EndpointOperation | EnforcementMode | FalsePositive | +| FileExtension | GeneralPurposeComparison | HowApplied | HowAppliedDetail | +| IrmUrlCategory | IsProtected | IsProtectedBefore | ItemName | +| LabelEventType | Location | MDATPDeviceId | OriginatingDomain | +| PageSize | ParentArchiveHash | Platform | PolicyId | +| PolicyMode | PolicyName | PolicyRuleAction | PolicyRuleId | +| PolicyRuleName | PreviousFileName | PreviousProtectionOwner | ProtectionEventType | +| ProtectionOwner | RemovableMediaDeviceManufacturer | RemovableMediaDeviceModel | RemovableMediaDeviceSerialNumber | +| RetentionLabel | RMSEncrypted | SensitiveInfoTypeClassifierType | SensitiveInfoTypeConfidence | +| SensitiveInfoTypeCount | SensitiveInfoTypeId | SensitivityLabel | SensitivityLabelPolicy | +| Sha1 | Sha256 | SourceLocationType | TargetDomain | +| TargetPrinterName | User | UsersPerDay | Workload | + + Valid workload filters include the following values: - Copilot From 76c2095a582ad9034e0344e372deadfe9495dd78 Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Tue, 15 Oct 2024 07:55:19 -0700 Subject: [PATCH 2/3] Update Export-ActivityExplorerData.md --- .../exchange/Export-ActivityExplorerData.md | 86 ++++++++++++++----- 1 file changed, 65 insertions(+), 21 deletions(-) diff --git a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md index 70402fa341..7018a74382 100644 --- a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md +++ b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md @@ -33,27 +33,71 @@ Export-ActivityExplorerData -EndTime -OutputFormat -StartTim ``` ## DESCRIPTION -This cmdlet supports following filters - -| | | | | -| --- | --- | --- | --- | -| Activity | Application | ArtifactType | ClientIP | -| ColdScanPolicyId | CopilotAppHost | CopilotThreadId | CopilotType | -| CreationTime | DataState | DestinationFilePath | DestinationLocationType | -| DeviceName | DLPPolicyId | DLPPolicyRuleId | EmailReceiver | -| EmailSender | EndpointOperation | EnforcementMode | FalsePositive | -| FileExtension | GeneralPurposeComparison | HowApplied | HowAppliedDetail | -| IrmUrlCategory | IsProtected | IsProtectedBefore | ItemName | -| LabelEventType | Location | MDATPDeviceId | OriginatingDomain | -| PageSize | ParentArchiveHash | Platform | PolicyId | -| PolicyMode | PolicyName | PolicyRuleAction | PolicyRuleId | -| PolicyRuleName | PreviousFileName | PreviousProtectionOwner | ProtectionEventType | -| ProtectionOwner | RemovableMediaDeviceManufacturer | RemovableMediaDeviceModel | RemovableMediaDeviceSerialNumber | -| RetentionLabel | RMSEncrypted | SensitiveInfoTypeClassifierType | SensitiveInfoTypeConfidence | -| SensitiveInfoTypeCount | SensitiveInfoTypeId | SensitivityLabel | SensitivityLabelPolicy | -| Sha1 | Sha256 | SourceLocationType | TargetDomain | -| TargetPrinterName | User | UsersPerDay | Workload | - +This cmdlet supports following filters: +- Activity +- Application +- ArtifactType +- ClientIP +- ColdScanPolicyId +- CopilotAppHost +- CopilotThreadId +- CopilotType +- CreationTime +- DataState +- DestinationFilePath +- DestinationLocationType +- DeviceName +- DLPPolicyId +- DLPPolicyRuleId +- EmailReceiver +- EmailSender +- EndpointOperation +- EnforcementMode +- FalsePositive +- FileExtension +- GeneralPurposeComparison +- HowApplied +- HowAppliedDetail +- IrmUrlCategory +- IsProtected +- IsProtectedBefore +- ItemName +- LabelEventType +- Location +- MDATPDeviceId +- OriginatingDomain +- PageSize +- ParentArchiveHash +- Platform +- PolicyId +- PolicyMode +- PolicyName +- PolicyRuleAction +- PolicyRuleId +- PolicyRuleName +- PreviousFileName +- PreviousProtectionOwner +- ProtectionEventType +- ProtectionOwner +- RemovableMediaDeviceManufacturer +- RemovableMediaDeviceModel +- RemovableMediaDeviceSerialNumber +- RetentionLabel +- RMSEncrypted +- SensitiveInfoTypeClassifierType +- SensitiveInfoTypeConfidence +- SensitiveInfoTypeCount +- SensitiveInfoTypeId +- SensitivityLabel +- SensitivityLabelPolicy +- Sha1 +- Sha256 +- SourceLocationType +- TargetDomain +- TargetPrinterName +- User +- UsersPerDay +- Workload Valid workload filters include the following values: From 89e632473dc59ab0b48c4ddf794f22ae9472d54d Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Tue, 15 Oct 2024 07:57:35 -0700 Subject: [PATCH 3/3] Update Export-ActivityExplorerData.md --- exchange/exchange-ps/exchange/Export-ActivityExplorerData.md | 1 + 1 file changed, 1 insertion(+) diff --git a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md index 7018a74382..8d5bf12471 100644 --- a/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md +++ b/exchange/exchange-ps/exchange/Export-ActivityExplorerData.md @@ -34,6 +34,7 @@ Export-ActivityExplorerData -EndTime -OutputFormat -StartTim ## DESCRIPTION This cmdlet supports following filters: + - Activity - Application - ArtifactType