package build

Author: lucian-ioan

packages/azure/data_stream/auditlogs/_dev/test/pipeline/test-audit-logs-sample.log

@@ -1,3 +1,3 @@
 { "time": "2022-01-22T18:15:02.5168093Z", "resourceId": "/tenants/4bbb79f7-5724-4c9e-95f3-de075f6ec090/providers/Microsoft.aadiam", "operationName": "Add service principal credentials", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "4bbb79f7-5724-4c9e-95f3-de075f6ec090", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.128.3.4", "correlationId": "53161141-e3f4-4944-85b6-7b953f17265e", "identity": "Managed Service Identity", "Level": 4, "properties": {"id":"Directory_53161141-e3f4-4944-85b6-7b953f17265e_6X649_134684731","category":"ApplicationManagement","correlationId":"53161141-e3f4-4944-85b6-7b953f17265e","result":"success","resultReason":"","activityDisplayName":"Add service principal credentials","activityDateTime":"2022-01-22T18:15:02.5168093+00:00","loggedByService":"Core Directory","operationType":"Update","userAgent":null,"initiatedBy":{"app":{"appId":null,"displayName":"Managed Service Identity","servicePrincipalId":"b9814691-9ca1-4e55-a1ac-8ef5dd010ec0","servicePrincipalName":null}},"targetResources":[{"id":"a7d5dcbe-0627-4ddf-a2f4-86b6785bcc42","displayName":"billing-test-wus","type":"ServicePrincipal","modifiedProperties":[{"displayName":"KeyDescription","oldValue":"[\"[KeyIdentifier=7dffcdc5-f2d5-43ae-86f1-682561befd4b,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=CN=a70a7931-c387-4dce-9f35-fbf95bdcc91e]\",\"[KeyIdentifier=c9c0b961-a80a-4a71-9c3a-b67b33edf874,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=CN=a70a7931-c387-4dce-9f35-fbf95bdcc91e]\"]","newValue":"[\"[KeyIdentifier=c9c0b961-a80a-4a71-9c3a-b67b33edf874,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=CN=a70a7931-c387-4dce-9f35-fbf95bdcc91e]\",\"[KeyIdentifier=7dffcdc5-f2d5-43ae-86f1-682561befd4b,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=CN=a70a7931-c387-4dce-9f35-fbf95bdcc91e]\",\"[KeyIdentifier=d747da7e-e11b-4af2-aede-0487c44067af,KeyType=AsymmetricX509Cert,KeyUsage=Verify,DisplayName=CN=a70a7931-c387-4dce-9f35-fbf95bdcc91e]\"]"},{"displayName":"Included Updated Properties","oldValue":null,"newValue":"\"KeyDescription\""},{"displayName":"TargetId.ServicePrincipalNames","oldValue":null,"newValue":"\"a70a7931-c387-4dce-9f35-fbf95bdcc91e;https://identity.azure.net/N8CUySpCeRFU3iB/PEuFlON4zd8+n8d3qgzrF1MviSY=\""}],"administrativeUnits":[]}],"additionalDetails":[{"key":"User-Agent","value":"Microsoft Azure Graph Client Library 2.1.17-internal"},{"key":"AppId","value":"a70a7931-c387-4dce-9f35-fbf95bdcc91e"}]}}
 { "time": "2022-01-22T18:15:02.5168093Z", "resourceId": "/tenants/4bbb79f7-5724-4c9e-95f3-de075f6ec090/providers/Microsoft.aadiam", "operationName": "Update service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "4bbb79f7-5724-4c9e-95f3-de075f6ec090", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.128.3.4", "correlationId": "53161141-e3f4-4944-85b6-7b953f17265e", "identity": "Managed Service Identity", "Level": 4, "properties": {"id":"Directory_53161141-e3f4-4944-85b6-7b953f17265e_6X649_134684743","category":"ApplicationManagement","correlationId":"53161141-e3f4-4944-85b6-7b953f17265e","result":"success","resultReason":"","activityDisplayName":"Update service principal","activityDateTime":"2022-01-22T18:15:02.5168093+00:00","loggedByService":"Core Directory","operationType":"Update","userAgent":null,"initiatedBy":{"app":{"appId":null,"displayName":"Managed Service Identity","servicePrincipalId":"b9814691-9ca1-4e55-a1ac-8ef5dd010ec0","servicePrincipalName":null}},"targetResources":[{"id":"a7d5dcbe-0627-4ddf-a2f4-86b6785bcc42","displayName":"billing-test-wus","type":"ServicePrincipal","modifiedProperties":[{"displayName":"TargetId.ServicePrincipalNames","oldValue":null,"newValue":"\"a70a7931-c387-4dce-9f35-fbf95bdcc91e;https://identity.azure.net/N8CUySpCeRFU3iB/PEuFlON4zd8+n8d3qgzrF1MviSY=\""},{"displayName":"Included Updated Properties","oldValue":null,"newValue":"\"KeyDescription\""}],"administrativeUnits":[]}],"additionalDetails":[{"key":"User-Agent","value":"Microsoft Azure Graph Client Library 2.1.17-internal"},{"key":"AppId","value":"a70a7931-c387-4dce-9f35-fbf95bdcc91e"}]}}
-{ "time": "2022-01-22T18:15:02.3875429Z", "resourceId": "/tenants/4bbb79f7-5724-4c9e-95f3-de075f6ec090/providers/Microsoft.aadiam", "operationName": "Update service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "4bbb79f7-5724-4c9e-95f3-de075f6ec090", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.128.3.4", "correlationId": "87979703-118b-498f-99c2-ccd1a56f1a5a", "identity": "Managed Service Identity", "Level": 4, "properties": {"id":"Directory_87979703-118b-498f-99c2-ccd1a56f1a5a_ULAYA_144938566","category":"ApplicationManagement","correlationId":"87979703-118b-498f-99c2-ccd1a56f1a5a","result":"success","resultReason":"","activityDisplayName":"Update service principal","activityDateTime":"2022-01-22T18:15:02.3875429+00:00","loggedByService":"Core Directory","operationType":"Update","userAgent":null,"initiatedBy":{"app":{"appId":null,"displayName":"Managed Service Identity","servicePrincipalId":"b9814691-9ca1-4e55-a1ac-8ef5dd010ec0","servicePrincipalName":null}},"targetResources":[{"id":"a7d5dcbe-0627-4ddf-a2f4-86b6785bcc42","displayName":"billing-test-wus","type":"ServicePrincipal","modifiedProperties":[{"displayName":"TargetId.ServicePrincipalNames","oldValue":null,"newValue":"\"a70a7931-c387-4dce-9f35-fbf95bdcc91e;https://identity.azure.net/N8CUySpCeRFU3iB/PEuFlON4zd8+n8d3qgzrF1MviSY=\""}],"administrativeUnits":[]}],"additionalDetails":[{"key":"User-Agent","value":"Microsoft Azure Graph Client Library 2.1.17-internal"},{"key":"AppId","value":"a70a7931-c387-4dce-9f35-fbf95bdcc91e"}]}}
+{ "time": "2022-01-22T18:15:02.3875429Z", "resourceId": "/tenants/4bbb79f7-5724-4c9e-95f3-de075f6ec090/providers/Microsoft.aadiam", "operationName": "Update service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "4bbb79f7-5724-4c9e-95f3-de075f6ec090", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.128.3.4", "correlationId": "87979703-118b-498f-99c2-ccd1a56f1a5a", "identity": "Managed Service Identity", "Level": 4, "properties": {"id":"Directory_87979703-118b-498f-99c2-ccd1a56f1a5a_ULAYA_144938566","category":"ApplicationManagement","correlationId":"87979703-118b-498f-99c2-ccd1a56f1a5a","result":"success","resultReason":"","activityDisplayName":"Update service principal","activityDateTime":"2022-01-22T18:15:02.3875429+00:00","loggedByService":"Core Directory","operationType":"Update","userAgent":null,"initiatedBy":{"app":{"appId":null,"displayName":"Managed Service Identity","servicePrincipalId":"b9814691-9ca1-4e55-a1ac-8ef5dd010ec0","servicePrincipalName":null}},"targetResources":[{"id":"a7d5dcbe-0627-4ddf-a2f4-86b6785bcc42","displayName":"billing-test-wus","type":"ServicePrincipal","modifiedProperties":[{"displayName":"TargetId.ServicePrincipalNames","oldValue":null,"newValue":"\"a70a7931-c387-4dce-9f35-fbf95bdcc91e;https://identity.azure.net/N8CUySpCeRFU3iB/PEuFlON4zd8+n8d3qgzrF1MviSY=\""}],"administrativeUnits":[]}],"additionalDetails":[{"key":"User-Agent","value":"Microsoft Azure Graph Client Library 2.1.17-internal"},{"key":"AppId","value":"a70a7931-c387-4dce-9f35-fbf95bdcc91e"}]}}

packages/azure/docs/adlogs.md

@@ -1013,6 +1013,7 @@ An example event for `auditlogs` looks as following:
 | azure.auditlogs.properties.initiated_by.user.displayName | Display name | keyword |
 | azure.auditlogs.properties.initiated_by.user.id | ID | keyword |
 | azure.auditlogs.properties.initiated_by.user.ipAddress | ip Address | keyword |
+| azure.auditlogs.properties.initiated_by.user.roles | User roles | keyword |
 | azure.auditlogs.properties.initiated_by.user.userPrincipalName | User principal name | keyword |
 | azure.auditlogs.properties.logged_by_service | Logged by service | keyword |
 | azure.auditlogs.properties.operation_type | Operation type | keyword |