azure_active_directory_add_unverified_domain.yml

name: Azure Active Directory Add unverified domain
id: d4c01fb1-3b88-46d3-bd12-9b9e256450f7
version: 1
date: "2024-07-18"
author: Patrick Bareiss, Splunk
description: Data source object for Azure Active Directory Add unverified domain
source: Azure AD
sourcetype: azure:monitor:aad
separator: operationName
supported_TA:
  - name: Splunk Add-on for Microsoft Cloud Services
    url: https://splunkbase.splunk.com/app/3110
    version: 5.4.3
fields:
  - _time
  - Level
  - callerIpAddress
  - category
  - correlationId
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - durationMs
  - host
  - index
  - linecount
  - operationName
  - operationVersion
  - properties.activityDateTime
  - properties.activityDisplayName
  - properties.additionalDetails{}.key
  - properties.additionalDetails{}.value
  - properties.category
  - properties.correlationId
  - properties.id
  - properties.initiatedBy.user.displayName
  - properties.initiatedBy.user.id
  - properties.initiatedBy.user.ipAddress
  - properties.initiatedBy.user.userPrincipalName
  - properties.loggedByService
  - properties.operationType
  - properties.result
  - properties.resultReason
  - properties.targetResources{}.displayName
  - properties.targetResources{}.id
  - properties.targetResources{}.modifiedProperties{}.displayName
  - properties.targetResources{}.modifiedProperties{}.newValue
  - properties.targetResources{}.modifiedProperties{}.oldValue
  - properties.userAgent
  - punct
  - resourceId
  - resultSignature
  - source
  - sourcetype
  - splunk_server
  - tenantId
  - time
  - timeendpos
  - timestartpos
example_log:
  '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam",
  "operationName": "Add unverified domain", "operationVersion": "1.0", "category":
  "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature":
  "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1",
  "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "Level": 4, "properties":
  {"id": "Directory_bdab88f3-69a4-4e66-883d-5b1e1558e61b_311NT_82497138", "category":
  "DirectoryManagement", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b",
  "result": "success", "resultReason": "", "activityDisplayName": "Add unverified
  domain", "activityDateTime": "2023-07-26T13:45:54.1582053+00:00", "loggedByService":
  "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user":
  {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName":
  "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1",
  "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com",
  "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue":
  "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue":
  "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null,
  "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails":
  [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
  AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}'