The Microsoft Management Activity API integration enables you to subscribe or unsubscribe to different audits, receive their content, and fetch new content as incidents. Through the integration you can subscribe to new content types or stop your subscription, list the available content of each content type, and most importantly, fetch new content records from content types of your choice as Cortex XSOAR incidents.
This integration was integrated and tested with version 1.0 of Microsoft Management Activity API (O365 Azure Events)
To allow Cortex XSOAR access to the Microsoft Management Activity API you will be required to give authorization to access it.
- To grant authorization, click HERE.
- After you click the link, click the Start Authorization Process button.
- When prompted, accept the Microsoft authorization request for the required permissions. You will get an ID, Token, and Key, which you need to enter in the corresponding fields when configuring an integration instance.
- Enter the following URL
(Note: CLIENT_ID and REDIRECT_URI should be replaced by your own client ID and redirect URI, accordingly):
- When prompted, accept the Microsoft authorization request for the required permissions.
- The URL will change and will have the following structure: SOME_PREFIX?code=AUTH_CODE&session_state=SESSION_STATE Take the AUTH_CODE (without the “code=” prefix) and enter it to the instance configuration under the “Authentication” code section. Moreover, enter your client secret as the “Key” parameter and your client ID as the “ID” parameter.
- Navigate to Settings > Integrations > Servers & Services.
- Search for Microsoft Management Activity API (O365 Azure Events).
- Click Add instance to create and configure a new integration instance.
|auth_id||ID (received from the authorization step - see Detailed Instructions (?) section)||False|
|enc_key||Key (received from the authorization step - see Detailed Instructions (?) section)||False|
|Certificate Thumbprint||Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.||Falser|
|Private Key||Used for certificate authentication. The private key of the registered certificate.||False|
|refresh_token||Token (received from the authorization step - see Detailed Instructions (?) section)||False|
|self_deployed||Use a self-deployed Azure application||False|
|auth_code||The authentication code you got for the service. For instructions on how to receive it, see Detailed Instructions (?) section.||False|
|timeout||The default timeout (in seconds) for API calls. Can be overridden by providing value to the corresponding argument when calling supported commands. Default is 15 seconds.||True|
|insecure||Trust any certificate (not secure)||False|
|proxy||Use system proxy settings||False|
|redirect_uri||Application redirect URI (for self-deployed mode)||False|
|first_fetch_delta||First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)||False|
|content_types_to_fetch||Content types to fetch||False|
|record_types_filter||Record types to fetch (Comma-separated list of the record types you wish to fetch. Content records with a record type that is not specified will not be fetched. If this field is left empty, all record types will be fetched.)||False|
|workloads_filter||Workloads to fetch (Comma-separated list of the workloads you wish to fetch. Content records with a workload that is not specified will not be fetched. If this field is left empty, all workloads will be fetched.)||False|
|operations_filter||Operations to (Comma-separated list of the operations you wish to fetch. Content records with an operation that is not specified will not be fetched. If this field is left empty, all operations will be fetched.)||False|
- Click Test to validate the URLs, token, and connection.
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
Starts a subscription to a given content type.
|content_type||The content type to subscribe to. Possible values are ||Required|
There is no context output for this command.
Successfully started subscription to content type: Audit.Exchange
Stops a subscription to a given content type.
|content_type||The content type to unsubscribe from. Possible values are ||Required|
There is no context output for this command.
Successfully stopped subscription to content type: Audit.Exchange
List the content types you are currently subscribed to
There are no input arguments for this command.
|MicrosoftManagement.Subscription||string||List of current subscriptions|
Returns all content of a specific content type.
|content_type||The content type for which to receive content. Possible values are ||Required|
|start_time||The earliest time to get content from. If start_time is specified, end_time must also be specified. The start_time must be before the end_time, can be at most 7 days ago, and has to be within 24 hours from end_time. Required format: YYYY-MM-DDTHH:MM:SS. If not specified, start time will be 24 hours ago.||Optional|
|end_time||The latest time to get content from. If end_time is specified, start_time must be also specified. The start_time must be before the end_time and has to be within 24 hours from start_time. Required format: YYYY-MM-DDTHH:MM:SS. If not specified, end_time will be now.||Optional|
|record_types_filter||A comma-separated list of the record types to fetch. Content records with a record type that is not specified will not be fetched. If this field is left empty, all record types will be fetched.||Optional|
|workloads_filter||A comma-separated list of the workloads to fetch. Content records with a workload that is not specified will not be fetched. If this field is left empty, all workloads will be fetched.||Optional|
|operations_filter||A comma-separated list of the operations to fetch. Content records with an operation that is not specified will not be fetched. If this field is left empty, all operations will be fetched.||Optional|
|timeout||The timeout for the content requesting http call. The default is configured at the corresponding integration instance parameter.||Optional|
|MicrosoftManagement.ContentRecord.ID||number||The ID of the record.|
|MicrosoftManagement.ContentRecord.CreationTime||date||The creation time of the record.|
|MicrosoftManagement.ContentRecord.RecordType||string||The type of the record.|
|MicrosoftManagement.ContentRecord.Operation||string||The operation described in the record.|
|MicrosoftManagement.ContentRecord.UserType||string||The type of the related user.|
|MicrosoftManagement.ContentRecord.OrganizationID||number||The ID of the organization relevant to the record.|
|MicrosoftManagement.ContentRecord.UserKey||string||The key of the related user.|
|MicrosoftManagement.ContentRecord.ClientIP||string||The IP of the record's client.|
|MicrosoftManagement.ContentRecord.Scope||string||The scope of the record.|
|MicrosoftManagement.ContentRecord.Workload||string||The workload of the record.|
|MicrosoftManagement.ContentRecord.ResultsStatus||string||The results status of the record.|
|MicrosoftManagement.ContentRecord.ObjectID||string||The ID of the record's object.|
|MicrosoftManagement.ContentRecord.UserID||string||The ID of the record's user.|
Record types to fetch from should be set with numerical values from the Microsoft documentation. For example, in order to fetch events of type MailSubmission, the value 29 should be set.