updating data sources

Author: patel-bhavin

data_sources/azure_monitor_activity.yml

@@ -0,0 +1,96 @@
+name: Azure Monitor Activity
+id: 1997a515-a61a-4f78-ada9-54af34c764f2
+version: 1
+date: '2025-01-13'
+author: Bhavin Patel, Splunk
+description: Data source object for Azure Monitor Activity.  The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. 
+source: Azure AD
+sourcetype: azure:monitor:activity
+separator: operationName
+supported_TA:
+- name: Splunk Add-on for Microsoft Cloud Services
+  url: https://splunkbase.splunk.com/app/3110
+  version: 5.4.1
+fields:
+- column
+- action
+- category
+- change_type
+- command
+- correlationId
+- dataset_name
+- date_hour
+- date_mday
+- date_minute
+- date_month
+- date_second
+- date_wday
+- date_year
+- date_zone
+- dest
+- dvc
+- eventtype
+- host
+- identity
+- image_id
+- index
+- instance_type
+- linecount
+- object
+- object_attrs
+- object_category
+- object_id
+- object_path
+- operationName
+- properties.ActivityDate
+- properties.ActivityResultStatus
+- properties.ActivityType
+- properties.Actor.ActorType
+- properties.Actor.Application
+- properties.Actor.ApplicationName
+- properties.Actor.IsDelegatedAdmin
+- properties.Actor.Name
+- properties.Actor.ObjectId
+- properties.Actor.PartnerTenantId
+- properties.Actor.UPN
+- properties.Actor.UserPermissions{}
+- properties.AdditionalDetails
+- properties.AuditEventId
+- properties.Category
+- properties.RelationId
+- properties.TargetDisplayNames{}
+- properties.TargetObjectIds{}
+- properties.Targets{}.ModifiedProperties{}.Name
+- properties.Targets{}.ModifiedProperties{}.New
+- properties.Targets{}.ModifiedProperties{}.Old
+- properties.Targets{}.Name
+- punct
+- resourceId
+- resource_provider
+- response_body
+- result
+- resultDescription
+- resultType
+- result_id
+- source
+- sourcetype
+- splunk_server
+- splunk_server_group
+- src
+- status
+- tag
+- tag::action
+- tag::eventtype
+- tag::object_category
+- tenantId
+- time
+- timeendpos
+- timestartpos
+- user
+- user_name
+- user_type
+- vendor_account
+- vendor_product
+- vendor_region
+- _time
+example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "[email protected]"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "[email protected]"}'

detections/cloud/microsoft_intune_device_health_scripts.yml

@@ -3,7 +3,8 @@ id: 6fe42e07-15b1-4caa-b547-7885666cb1bd
 version: 1
 date: '2025-01-06'
 author: Dean Luxton
-data_sources: []
+data_sources:
+- Azure Monitor Activity
 type: Hunting
 status: production
 description: >-

detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml

@@ -3,7 +3,8 @@ id: 3c49e5ed-625c-408c-a2c7-8e2b524efb2c
 version: 1
 date: '2025-01-07'
 author: Dean Luxton
-data_sources: []
+data_sources:
+- Azure Monitor Activity
 type: Hunting
 status: production
 description: >-

detections/cloud/microsoft_intune_manual_device_management.yml

@@ -3,7 +3,8 @@ id: 5ca7ebee-4ee7-4cf2-b3be-0ea26a00d822
 version: 1
 date: '2025-01-07'
 author: Dean Luxton
-data_sources: []
+data_sources:
+- Azure Monitor Activity
 type: Hunting
 status: production
 description: >-

detections/cloud/microsoft_intune_mobile_apps.yml

@@ -3,7 +3,8 @@ id: 98e6b389-2806-4426-a580-8a92cb0d9710
 version: 1
 date: '2025-01-07'
 author: Dean Luxton
-data_sources: []
+data_sources:
+- Azure Monitor Activity
 type: Hunting
 status: experimental
 description: >-