detection.wiki

AIR manually triggered investigation events M365-AirManualInvestigation

1 operation, identified by Operation in the audit log.

OperationDescription
_catch_allCatch-all for M365-AirManualInvestigation rules matching the RecordType but no specific Operation.

_catch_all: AIR manually triggered investigation events (catch-all)

#
RecordType
M365-AirManualInvestigation

Description

Catch-all for M365-AirManualInvestigation rules matching the RecordType but no specific Operation.

Fields #

NameDescription
RecordTypeAuditLogRecordType enum value (named string in Sentinel OfficeActivity; integer in the raw Management Activity API JSON).
OperationThe name of the user or admin activity. For Exchange admin activity this is the cmdlet name; for DLP it is DlpRuleMatch/DlpRuleUndo/DlpInfo. The per-event discriminator (event.action in Elastic ECS).
WorkloadThe Microsoft 365 service where the activity occurred (Exchange, SharePoint, AzureActiveDirectory, MicrosoftTeams, ...). Surfaces as event.provider in Elastic ECS.
ResultStatusWhether the action succeeded: Succeeded, PartiallySucceeded, or Failed (True/False for Exchange admin). For STS-logon events this reflects only the HTTP operation, not logon success: check LogonError.
UserIdUPN of the user who performed the action; system-account and app@sharepoint values also appear.
UserTypeType of actor: Regular, Admin, System, DcAdmin, Application, ServicePrincipal.
UserKeyAlternative ID for the user (the PUID for SharePoint / OneDrive / Exchange events).
ClientIPIPv4/IPv6 address of the device used; may be a trusted-app IP, and is null for Microsoft Entra ID events.
ObjectIdFor SharePoint/OneDrive, the full path of the file/folder; for Exchange admin, the object modified by the cmdlet; shape is operation-specific.
OrganizationIdGUID of the tenant's Office 365 organization (constant per tenant).
IdUnique identifier (GUID) for the audit record.
CreationTimeUTC date/time when the audit record was generated.
ScopeSource of the event: online (a Microsoft 365 service) or onprem (an on-premises service; currently SharePoint only).
AppAccessContextApplication context for the user or service principal that performed the action.

Detection Rules #

View all rules referencing this event →

Elastic #

  • M365 AIR Investigation Signal source low: Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations, manual investigations, and admin-initiated actions. These events track Microsoft's automated threat response activities and can indicate active threats being remediated. This building block rule generates security events for correlation, threat hunting, and telemetry collection to provide visibility into automated response actions.

References #