Description
SharePoint events.
Log Structure
Sample of Office365SharePoint Event (in JSON format)
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:59",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "PageViewed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 4,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso.sharepoint.com/_layouts/15/onedrive.aspx",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"CustomUniqueId": true,
"EventSource": "SharePoint",
"ItemType": "Page",
"ListItemUniqueId": "f1c23344-5667-890f-1234-8ee1171747ad",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48"
}
]
Table Fields
Field | Description |
|---|
TABLE | Office365SharePoint |
RECORDTYPE | Based on RecordType, this field indicates the operation performed by the record.
For this log type its value is 4.
For available RecordType values, you can visit Microsoft’s documentation here. |
CUSTOMEVENT | Based on CustomEvent, this field contains the optional string value for custom events. |
EVENTDATA | Based on EventData, this field contains the optional payload for custom events. |
MODIFIEDPROPERTIES | Based on ModifiedProperties, a structure field that contains details such as: modified property, current value of the modified property and the new value of the modified property. |
SNAREDATAMAP | All unclassified field(s) parsed from this log type will be pushed into the SNAREDATAMAP. |
Note: See other fields here, which are common among all SharePoint* log types.
Notes
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema?view=o365-worldwide#sharepoint-schema
