Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Description

...

Expand
titleSample of Office365SharePointFileOperation Event (in JSON format)
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:44",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "FileAccessed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 6,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso-my.sharepoint.com/User Photos/Profile Pictures/admin_contoso_onmicrosoft_com_MThumb.jpg",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"DoNotDistributeEvent": true,
"EventSource": "SharePoint",
"ItemType": "File",
"ListId": "f1c23344-5667-890f-1234-8ee1171747ad",
"ListItemUniqueId": "a11111bc-8394-40d1-8e2f-a0b6c3334455",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48",
"HighPriorityMediaProcessing": false,
"SourceFileExtension": "jpg",
"SiteUrl": "https://contoso-my.sharepoint.com/",
"SourceFileName": "admin_contoso_onmicrosoft_com_MThumb.jpg",
"SourceRelativeUrl": "User Photos/Profile Pictures"
}
]

...

Field

Description

TABLE

Office365SharePointFileOperation

RECORDTYPE

Based on RecordType, where this field indicates the operation performed by the record.
For this log type its value is 6
See more details about RecordType For available RecordType values, you can visit Microsoft’s documentation here.

AADSESSIONID

Based on AADSessionId, a value derived from the AppAccessContext field.

SITEURL

Based on SiteUrl, where this field contains the URL of the site where the file or folder accessed by the user is located.

SRCRELATIVEURL

Based on SourceRelativeUrl, where this field contains the URL of the folder that contains the file accessed by the user.

SRCFILENAME

Based on SourceFileName, where this field contains the name of the file or folder accessed by the user.

SRCFILEEXTENSION

Based on SourceFileExtension, where this field contains the file extension of the file that was accessed by the user.

DSTRELATIVEURL

Based on DestinationRelativeUrl, where this field contains the URL of the destination folder where a file is copied or moved.

DSTFILENAME

Based on DestinationFileName, where this field contains the name of the file that is copied or moved.

DSTFILEEXTENSION

Based on DestinationFileExtension, where this field contains the file extension of a file that is copied or moved.

USERSHAREWITH

Based on UserSharedWith, where this field contains the user that a resource was shared with.

SHARINGTYPE

Based on SharingType, where this field contains the type of sharing permissions that were assigned to the user that the resource was shared with.

LISTID

Based on ListId, where this field contains the Guid of the list.

LISTITEMUNIQUEID

Based on ListItemUniqueId, where this field contains the ID of the application performing the operation.

WEBID

Based on WebId, there’s no available documentation for this field.

FILESIZE

Based on FileSizeBytes, there’s no available documentation for this field.

HIGHPRIOMEDIAPROC

Based on HighPriorityMediaProcessing, there’s no available documentation for this field.

IMPLICITSHARE

Based on ImplicitShare, there’s no available documentation for this field.

SNAREDATAMAP

All unclassified field(s) parsed from this log type will be pushed into the SNAREDATAMAP.

...