Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Description

...

Log Structure

Expand
titleSample Office365SharePointFileOperation logof Office365SharePointFileOperation Event (in JSON format)
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:44",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "FileAccessed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 6,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso-my.sharepoint.com/User Photos/Profile Pictures/admin_contoso_onmicrosoft_com_MThumb.jpg",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"DoNotDistributeEvent": true,
"EventSource": "SharePoint",
"ItemType": "File",
"ListId": "f1c23344-5667-890f-1234-8ee1171747ad",
"ListItemUniqueId": "a11111bc-8394-40d1-8e2f-a0b6c3334455",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48",
"HighPriorityMediaProcessing": false,
"SourceFileExtension": "jpg",
"SiteUrl": "https://contoso-my.sharepoint.com/",
"SourceFileName": "admin_contoso_onmicrosoft_com_MThumb.jpg",
"SourceRelativeUrl": "User Photos/Profile Pictures"
}
]

...

Field

Description

TABLE

Office365SharePointFileOperation

RECORDTYPE

Based on RecordType is “6”, , where this field indicates the operation performed by the record.
For this log type its value is 6
See more details about RecordType here.

AADSESSIONIDAADSessionId

- Value will be based on AppAccessContext→AADSessionIdBased on AADSessionId, a value derived from the AppAccessContext field.

SITEURL

SiteUrl - The Based on SiteUrl, where this field contains the URL of the site where the file or folder accessed by the user is located.

SRCRELATIVEURL

SourceRelativeUrl - The Based on SourceRelativeUrl, where this field contains the URL of the folder that contains the file accessed by the user.The combination of the values for the SiteURLSourceRelativeURL, and SourceFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file accessed by the user.

SRCFILENAME

SourceFileName - The SRCFILENAME

Based on SourceFileName, where this field contains the name of the file or folder accessed by the user.

SRCFILEEXTENSION

SourceFileExtension - The Based on SourceFileExtension, where this field contains the file extension of the file that was accessed by the user. This property is blank if the object that was accessed is a folder.

DSTRELATIVEURL

DestinationRelativeUrl - The Based on DestinationRelativeUrl, where this field contains the URL of the destination folder where a file is copied or moved.The combination of the values for SiteURLDestinationRelativeURL, and DestinationFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file that was copied.
This property is displayed only for FileCopied and FileMoved events.

DSTFILENAME

DestinationFileName - The DSTFILENAME

Based on DestinationFileName, where this field contains the name of the file that is copied or moved.This property is displayed only for FileCopied and FileMoved events.

DSTFILEEXTENSION

DestinationFileExtension - The Based on DestinationFileExtension, where this field contains the file extension of a file that is copied or moved.This property is displayed only for FileCopied and FileMoved events.

USERSHAREWITH

UserSharedWith - The Based on UserSharedWith, where this field contains the user that a resource was shared with.

SHARINGTYPE

SharingType - The Based on SharingType, where this field contains the type of sharing permissions that were assigned to the user that the resource was shared with.
This user is identified by the UserSharedWith parameter.

LISTID

ListId - The Based on ListId, where this field contains the Guid of the list. This information is present only if it is applicable.

LISTITEMUNIQUEID

ListItemUniqueId - The Based on ListItemUniqueId, where this field contains the ID of the application performing the operation.

WEBID

WebId - No Based on WebId, there’s no available documentation for this field.

FILESIZE

FileSizeBytes - No Based on FileSizeBytes, there’s no available documentation for this field.

HIGHPRIOMEDIAPROC

HighPriorityMediaProcessing - No Based on HighPriorityMediaProcessing, there’s no available documentation for this field.

IMPLICITSHARE

ImplicitShare - No Based on ImplicitShare, there’s no available documentation for this field.

SNAREDATAMAP

All unclassified field/s in the log (s) parsed from this log type will be pushed into the SNAREDATAMAP.

...