Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Endpoint DLP log (device activity log) schema is missing #220

Open
rykoma opened this issue Mar 8, 2021 · 2 comments
Open

Endpoint DLP log (device activity log) schema is missing #220

rykoma opened this issue Mar 8, 2021 · 2 comments

Comments

@rykoma
Copy link

rykoma commented Mar 8, 2021

The following page does not have Endpoint DLP schema information, even though we can get Endpoint DLP logs (device activity log) using Office 365 Management Activity API.

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema
https://github.com/MicrosoftDocs/office-365-management-api/blob/live/office-365-management-api/office-365-management-activity-api-schema.md

For example, we can get an Endpoint DLP log (device activity log) like below (some values are masked):

 {
    "SourceLocationType": 1,
    "Platform": 1,
    "Application": "EXCEL.EXE",
    "FileExtension": "xlsx",
    "DeviceName": "device01.corp.contoso.com",
    "MDATPDeviceId": "1e82df73acf2c509bc12b4d7bcc4a394be6aa67c",
    "FileSize": 0,
    "FileType": "Microsoft Excel",
    "Hidden": false,
    "ObjectId": "C:\\Users\\User01\\Desktop\\~$test.xlsx",
    "UserId": User01@contoso.com,
    "ClientIP": "x.x.x.x",
    "Id": "a70cb637-7b6e-4002-8170-eb66ce46f28b",
    "RecordType": 63,
    "CreationTime": "2021-03-04T14:06:26",
    "Operation": "FileDeleted",
    "OrganizationId": "70c32610-3071-4013-8607-d338463e92e4",
    "UserType": 0,
    "UserKey": User01@contoso.com,
    "Workload": "Endpoint",
    "Version": 1,
    "Scope": 1
  }
@lindalu-MSFT
Copy link
Collaborator

@rykoma Please create a PR with your proposed changes! Thanks, linda

@rykoma
Copy link
Author

rykoma commented Mar 22, 2021

@lindalu-MSFT Sorry for the late reply. But I cannot create a PR, because I don't know the correct schema information. Could you collaborate with the right person in engineering group and update the documentation, please?

JFYI. I submitted a similar issue last year, and the documentation was fixed without creating a PR.
#134

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants