Skip to content

Commit cc4e247

Browse files
DanielabomDanielabom
authored
Merge pull request #26158 from microsoftgraph/graph-api-promotion-to-v1
Promoted API documentation from beta to v1.0
2 parents a289df9 + 40a06ff commit cc4e247

19 files changed

+1643
-37
lines changed

‎api-reference/v1.0/api/security-auditcoreroot-list-auditlogqueries.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: "List auditLogQueries"
3+
description: "Get a list of the auditLogQuery objects and their properties."
4+
author: "arishojaswi"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: apiPageType
8+
ms.date: 10/29/2024
9+
---
10+
11+
# List auditLogQueries
12+
Namespace: microsoft.graph.security
13+
14+
Get a list of [auditLogQuery](../resources/security-auditlogquery.md) objects and their properties.
15+
16+
[!INCLUDE [national-cloud-support](../../includes/global-only.md)]
17+
18+
## Permissions
19+
Auditing data can be accessed through Microsoft Purview Audit Search API via the following permissions, which are classified at a Microsoft 365 service level. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
20+
21+
<!-- { "blockType": "permissions", "name": "security_auditcoreroot_list_auditlogqueries" } -->
22+
[!INCLUDE [permissions-table](../includes/permissions/security-auditcoreroot-list-auditlogqueries-permissions.md)]
23+
24+
25+
## HTTP request
26+
27+
<!-- {
28+
"blockType": "ignored"
29+
}
30+
-->
31+
``` http
32+
GET /security/auditLog/queries
33+
```
34+
35+
## Optional query parameters
36+
This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
37+
38+
## Request headers
39+
|Name|Description|
40+
|:---|:---|
41+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
42+
43+
## Request body
44+
Don't supply a request body for this method.
45+
46+
## Response
47+
48+
If successful, this method returns a `200 OK` response code and a collection of [auditLogQuery](../resources/security-auditlogquery.md) objects in the response body.
49+
50+
## Examples
51+
52+
### Request
53+
The following example shows a request.
54+
55+
<!-- {
56+
"blockType": "request",
57+
"name": "list_auditlogquery"
58+
}
59+
-->
60+
``` http
61+
GET https://graph.microsoft.com/v1.0/security/auditLog/queries
62+
```
63+
64+
### Response
65+
The following example shows the response.
66+
>**Note:** The response object shown here might be shortened for readability.
67+
<!-- {
68+
"blockType": "response",
69+
"truncated": true,
70+
"@odata.type": "Collection(microsoft.graph.security.auditLogQuery)"
71+
}
72+
-->
73+
``` http
74+
HTTP/1.1 200 OK
75+
Content-Type: application/json
76+
77+
{
78+
"value": [
79+
{
80+
"@odata.type": "#microsoft.graph.security.auditLogQuery",
81+
"id": "168ec429-084b-a489-90d8-504a87846305",
82+
"displayName": "String",
83+
"filterStartDateTime": "String (timestamp)",
84+
"filterEndDateTime": "String (timestamp)",
85+
"recordTypeFilters": [
86+
"String"
87+
],
88+
"keywordFilter": "String",
89+
"serviceFilter": "String",
90+
"operationFilters": [
91+
"String"
92+
],
93+
"userPrincipalNameFilters": [
94+
"String"
95+
],
96+
"ipAddressFilters": [
97+
"String"
98+
],
99+
"objectIdFilters": [
100+
"String"
101+
],
102+
"administrativeUnitIdFilters": [
103+
"String"
104+
],
105+
"status": "String"
106+
}
107+
]
108+
}
109+
```
110+

‎api-reference/v1.0/api/security-auditcoreroot-post-auditlogqueries.md

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
title: "Create auditLogQuery"
3+
description: "Create a new auditLogQuery object."
4+
author: "arishojaswi"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: apiPageType
8+
ms.date: 10/29/2024
9+
---
10+
11+
# Create auditLogQuery
12+
Namespace: microsoft.graph.security
13+
14+
Create a new [auditLogQuery](../resources/security-auditlogquery.md) object.
15+
16+
[!INCLUDE [national-cloud-support](../../includes/global-only.md)]
17+
18+
## Permissions
19+
Auditing data can be accessed through Microsoft Purview Audit Search API via the following permissions, which are classified at a Microsoft 365 service level. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
20+
21+
<!-- { "blockType": "permissions", "name": "security_auditcoreroot_post_auditlogqueries" } -->
22+
[!INCLUDE [permissions-table](../includes/permissions/security-auditcoreroot-post-auditlogqueries-permissions.md)]
23+
24+
## HTTP request
25+
26+
<!-- {
27+
"blockType": "ignored"
28+
}
29+
-->
30+
``` http
31+
POST /security/auditLog/queries
32+
```
33+
34+
## Request headers
35+
|Name|Description|
36+
|:---|:---|
37+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
38+
|Content-Type|application/json. Required.|
39+
40+
## Request body
41+
In the request body, supply a JSON representation of the [auditLogQuery](../resources/security-auditlogquery.md) object.
42+
43+
You can specify the following properties when creating a **auditLogQuery**.
44+
45+
|Property|Type|Description|
46+
|:---|:---|:---|
47+
|displayName|String|Display name for the saved audit log query. Optional.|
48+
|filterStartDateTime|DateTimeOffset|Start date of the date range in the query. Optional.|
49+
|filterEndDateTime|DateTimeOffset|End date of the date range in the query. Optional.|
50+
|recordTypeFilters|Collection(string) of microsoft.graph.security.auditLogRecordType|The operation type or types indicated by the record. The possible values are: `exchangeAdmin`, `exchangeItem`, `exchangeItemGroup`, `sharePoint`, `syntheticProbe`, `sharePointFileOperation`, `oneDrive`, `azureActiveDirectory`, `azureActiveDirectoryAccountLogon`, `dataCenterSecurityCmdlet`, `complianceDLPSharePoint`, `sway`, `complianceDLPExchange`, `sharePointSharingOperation`, `azureActiveDirectoryStsLogon`, `skypeForBusinessPSTNUsage`, `skypeForBusinessUsersBlocked`, `securityComplianceCenterEOPCmdlet`, `exchangeAggregatedOperation`, `powerBIAudit`, `crm`, `yammer`, `skypeForBusinessCmdlets`, `discovery`, `microsoftTeams`, `threatIntelligence`, `mailSubmission`, `microsoftFlow`, `aeD`, `microsoftStream`, `complianceDLPSharePointClassification`, `threatFinder`, `project`, `sharePointListOperation`, `sharePointCommentOperation`, `dataGovernance`, `kaizala`, `securityComplianceAlerts`, `threatIntelligenceUrl`, `securityComplianceInsights`, `mipLabel`, `workplaceAnalytics`, `powerAppsApp`, `powerAppsPlan`, `threatIntelligenceAtpContent`, `labelContentExplorer`, `teamsHealthcare`, `exchangeItemAggregated`, `hygieneEvent`, `dataInsightsRestApiAudit`, `informationBarrierPolicyApplication`, `sharePointListItemOperation`, `sharePointContentTypeOperation`, `sharePointFieldOperation`, `microsoftTeamsAdmin`, `hrSignal`, `microsoftTeamsDevice`, `microsoftTeamsAnalytics`, `informationWorkerProtection`, `campaign`, `dlpEndpoint`, `airInvestigation`, `quarantine`, `microsoftForms`, `applicationAudit`, `complianceSupervisionExchange`, `customerKeyServiceEncryption`, `officeNative`, `mipAutoLabelSharePointItem`, `mipAutoLabelSharePointPolicyLocation`, `microsoftTeamsShifts`, `secureScore`, `mipAutoLabelExchangeItem`, `cortanaBriefing`, `search`, `wdatpAlerts`, `powerPlatformAdminDlp`, `powerPlatformAdminEnvironment`, `mdatpAudit`, `sensitivityLabelPolicyMatch`, `sensitivityLabelAction`, `sensitivityLabeledFileAction`, `attackSim`, `airManualInvestigation`, `securityComplianceRBAC`, `userTraining`, `airAdminActionInvestigation`, `mstic`, `physicalBadgingSignal`, `teamsEasyApprovals`, `aipDiscover`, `aipSensitivityLabelAction`, `aipProtectionAction`, `aipFileDeleted`, `aipHeartBeat`, `mcasAlerts`, `onPremisesFileShareScannerDlp`, `onPremisesSharePointScannerDlp`, `exchangeSearch`, `sharePointSearch`, `privacyDataMinimization`, `labelAnalyticsAggregate`, `myAnalyticsSettings`, `securityComplianceUserChange`, `complianceDLPExchangeClassification`, `complianceDLPEndpoint`, `mipExactDataMatch`, `msdeResponseActions`, `msdeGeneralSettings`, `msdeIndicatorsSettings`, `ms365DCustomDetection`, `msdeRolesSettings`, `mapgAlerts`, `mapgPolicy`, `mapgRemediation`, `privacyRemediationAction`, `privacyDigestEmail`, `mipAutoLabelSimulationProgress`, `mipAutoLabelSimulationCompletion`, `mipAutoLabelProgressFeedback`, `dlpSensitiveInformationType`, `mipAutoLabelSimulationStatistics`, `largeContentMetadata`, `microsoft365Group`, `cdpMlInferencingResult`, `filteringMailMetadata`, `cdpClassificationMailItem`, `cdpClassificationDocument`, `officeScriptsRunAction`, `filteringPostMailDeliveryAction`, `cdpUnifiedFeedback`, `tenantAllowBlockList`, `consumptionResource`, `healthcareSignal`, `dlpImportResult`, `cdpCompliancePolicyExecution`, `multiStageDisposition`, `privacyDataMatch`, `filteringDocMetadata`, `filteringEmailFeatures`, `powerBIDlp`, `filteringUrlInfo`, `filteringAttachmentInfo`, `coreReportingSettings`, `complianceConnector`, `powerPlatformLockboxResourceAccessRequest`, `powerPlatformLockboxResourceCommand`, `cdpPredictiveCodingLabel`, `cdpCompliancePolicyUserFeedback`, `webpageActivityEndpoint`, `omePortal`, `cmImprovementActionChange`, `filteringUrlClick`, `mipLabelAnalyticsAuditRecord`, `filteringEntityEvent`, `filteringRuleHits`, `filteringMailSubmission`, `labelExplorer`, `microsoftManagedServicePlatform`, `powerPlatformServiceActivity`, `scorePlatformGenericAuditRecord`, `filteringTimeTravelDocMetadata`, `alert`, `alertStatus`, `alertIncident`, `incidentStatus`, `case`, `caseInvestigation`, `recordsManagement`, `privacyRemediation`, `dataShareOperation`, `cdpDlpSensitive`, `ehrConnector`, `filteringMailGradingResult`, `publicFolder`, `privacyTenantAuditHistoryRecord`, `aipScannerDiscoverEvent`, `eduDataLakeDownloadOperation`, `m365ComplianceConnector`, `microsoftGraphDataConnectOperation`, `microsoftPurview`, `filteringEmailContentFeatures`, `powerPagesSite`, `powerAppsResource`, `plannerPlan`, `plannerCopyPlan`, `plannerTask`, `plannerRoster`, `plannerPlanList`, `plannerTaskList`, `plannerTenantSettings`, `projectForTheWebProject`, `projectForTheWebTask`, `projectForTheWebRoadmap`, `projectForTheWebRoadmapItem`, `projectForTheWebProjectSettings`, `projectForTheWebRoadmapSettings`, `quarantineMetadata`, `microsoftTodoAudit`, `timeTravelFilteringDocMetadata`, `teamsQuarantineMetadata`, `sharePointAppPermissionOperation`, `microsoftTeamsSensitivityLabelAction`, `filteringTeamsMetadata`, `filteringTeamsUrlInfo`, `filteringTeamsPostDeliveryAction`, `mdcAssessments`, `mdcRegulatoryComplianceStandards`, `mdcRegulatoryComplianceControls`, `mdcRegulatoryComplianceAssessments`, `mdcSecurityConnectors`, `mdaDataSecuritySignal`, `vivaGoals`, `filteringRuntimeInfo`, `attackSimAdmin`, `microsoftGraphDataConnectConsent`, `filteringAtpDetonationInfo`, `privacyPortal`, `managedTenants`, `unifiedSimulationMatchedItem`, `unifiedSimulationSummary`, `updateQuarantineMetadata`, `ms365DSuppressionRule`, `purviewDataMapOperation`, `filteringUrlPostClickAction`, `irmUserDefinedDetectionSignal`, `teamsUpdates`, `plannerRosterSensitivityLabel`, `ms365DIncident`, `filteringDelistingMetadata`, `complianceDLPSharePointClassificationExtended`, `microsoftDefenderForIdentityAudit`, `supervisoryReviewDayXInsight`, `defenderExpertsforXDRAdmin`, `cdpEdgeBlockedMessage`, `hostedRpa`, `cdpContentExplorerAggregateRecord`, `cdpHygieneAttachmentInfo`, `cdpHygieneSummary`, `cdpPostMailDeliveryAction`, `cdpEmailFeatures`, `cdpHygieneUrlInfo`, `cdpUrlClick`, `cdpPackageManagerHygieneEvent`, `filteringDocScan`, `timeTravelFilteringDocScan`, `mapgOnboard`, `unknownFutureValue`. Optional.|
51+
|keywordFilter|String|Free text field to search non-indexed properties of the audit log. Optional.|
52+
|serviceFilter|String|Refers to the workload property in the audit record. This is the Microsoft service where the activity occurred. Optional.|
53+
|operationFilters|String collection|The name of the user or admin activity. For a description of the most common operations/activities, see [Search the audit log in the Office 365 Protection Center](https://go.microsoft.com/fwlink/p/?LinkId=708432). Optional.|
54+
|userPrincipalNameFilters|String collection|The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged; for example, _my_name@my_domain_name_. Optional.|
55+
|ipAddressFilters|String collection|The IP address of the device that was used when the activity was logged. Optional.|
56+
|objectIdFilters|String collection|For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet. Optional.|
57+
|administrativeUnitIdFilters|String collection|Administrative units tagged to an audit log record. Optional.|
58+
|status|microsoft.graph.security.auditLogQueryStatus|Current status of the query. The possible values are: `notStarted`, `running`, `succeeded`, `failed`, `cancelled`, `unknownFutureValue`. Optional.|
59+
60+
61+
62+
## Response
63+
64+
If successful, this method returns a `201 Created` response code and a [auditLogQuery](../resources/security-auditlogquery.md) object in the response body.
65+
66+
## Examples
67+
68+
### Request
69+
The following example shows a request.
70+
71+
<!-- {
72+
"blockType": "request",
73+
"name": "create_auditlogquery_from_"
74+
}
75+
-->
76+
``` http
77+
POST https://graph.microsoft.com/v1.0/security/auditLog/queries
78+
Content-Type: application/json
79+
80+
{
81+
"@odata.type": "#microsoft.graph.security.auditLogQuery",
82+
"displayName": "String",
83+
"filterStartDateTime": "String (timestamp)",
84+
"filterEndDateTime": "String (timestamp)",
85+
"recordTypeFilters": [
86+
"String"
87+
],
88+
"keywordFilter": "String",
89+
"serviceFilter": "String",
90+
"operationFilters": [
91+
"String"
92+
],
93+
"userPrincipalNameFilters": [
94+
"String"
95+
],
96+
"ipAddressFilters": [
97+
"String"
98+
],
99+
"objectIdFilters": [
100+
"String"
101+
],
102+
"administrativeUnitIdFilters": [
103+
"String"
104+
],
105+
"status": "String"
106+
}
107+
```
108+
---
109+
110+
### Response
111+
The following example shows the response.
112+
>**Note:** The response object shown here might be shortened for readability.
113+
<!-- {
114+
"blockType": "response",
115+
"truncated": true,
116+
"@odata.type": "microsoft.graph.security.auditLogQuery"
117+
}
118+
-->
119+
``` http
120+
HTTP/1.1 201 Created
121+
Content-Type: application/json
122+
123+
{
124+
"@odata.type": "#microsoft.graph.security.auditLogQuery",
125+
"id": "168ec429-084b-a489-90d8-504a87846305",
126+
"displayName": "String",
127+
"filterStartDateTime": "String (timestamp)",
128+
"filterEndDateTime": "String (timestamp)",
129+
"recordTypeFilters": [
130+
"String"
131+
],
132+
"keywordFilter": "String",
133+
"serviceFilter": "String",
134+
"operationFilters": [
135+
"String"
136+
],
137+
"userPrincipalNameFilters": [
138+
"String"
139+
],
140+
"ipAddressFilters": [
141+
"String"
142+
],
143+
"objectIdFilters": [
144+
"String"
145+
],
146+
"administrativeUnitIdFilters": [
147+
"String"
148+
],
149+
"status": "String"
150+
}
151+
```
152+

‎api-reference/v1.0/api/security-auditlogquery-get.md

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
title: "Get auditLogQuery"
3+
description: "Read the properties and relationships of an auditLogQuery object."
4+
author: "arishojaswi"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: apiPageType
8+
ms.date: 10/29/2024
9+
---
10+
11+
# Get auditLogQuery
12+
Namespace: microsoft.graph.security
13+
14+
Read the properties and relationships of an [auditLogQuery](../resources/security-auditlogquery.md) object.
15+
16+
[!INCLUDE [national-cloud-support](../../includes/global-only.md)]
17+
18+
## Permissions
19+
Auditing data can be accessed through Microsoft Purview Audit Search API via the following permissions, which are classified at a Microsoft 365 service level. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).
20+
21+
<!-- { "blockType": "permissions", "name": "security_auditlogquery_get" } -->
22+
[!INCLUDE [permissions-table](../includes/permissions/security-auditlogquery-get-permissions.md)]
23+
24+
## HTTP request
25+
26+
<!-- {
27+
"blockType": "ignored"
28+
}
29+
-->
30+
31+
## Optional query parameters
32+
This method supports some of the OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).
33+
34+
## Request headers
35+
|Name|Description|
36+
|:---|:---|
37+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
38+
39+
## Request body
40+
Don't supply a request body for this method.
41+
42+
## Response
43+
44+
If successful, this method returns a `200 OK` response code and a [auditLogQuery](../resources/security-auditlogquery.md) object in the response body.
45+
46+
## Examples
47+
48+
### Request
49+
The following example shows a request.
50+
51+
<!-- {
52+
"blockType": "request",
53+
"name": "get_auditlogquery"
54+
}
55+
-->
56+
``` http
57+
GET https://graph.microsoft.com/beta/security/auditLog/queries/{auditLogQueryId}
58+
```
59+
60+
---
61+
62+
### Response
63+
The following example shows the response.
64+
>**Note:** The response object shown here might be shortened for readability.
65+
<!-- {
66+
"blockType": "response",
67+
"truncated": true,
68+
"@odata.type": "microsoft.graph.security.auditLogQuery"
69+
}
70+
-->
71+
``` http
72+
HTTP/1.1 200 OK
73+
Content-Type: application/json
74+
75+
{
76+
"value": {
77+
"@odata.type": "#microsoft.graph.security.auditLogQuery",
78+
"id": "168ec429-084b-a489-90d8-504a87846305",
79+
"displayName": "String",
80+
"filterStartDateTime": "String (timestamp)",
81+
"filterEndDateTime": "String (timestamp)",
82+
"recordTypeFilters": [
83+
"String"
84+
],
85+
"keywordFilter": "String",
86+
"serviceFilter": "String",
87+
"operationFilters": [
88+
"String"
89+
],
90+
"userPrincipalNameFilters": [
91+
"String"
92+
],
93+
"ipAddressFilters": [
94+
"String"
95+
],
96+
"objectIdFilters": [
97+
"String"
98+
],
99+
"administrativeUnitIdFilters": [
100+
"String"
101+
],
102+
"status": "String"
103+
}
104+
}
105+
```
106+

0 commit comments

Comments
 (0)