detection.wiki

eDiscovery and Content Search activity

OperationDescriptionSampleRule
anyCatch-all for M365-Discovery rules matching the RecordType but no specific Operation.NN
CaseAddedCase Added activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).YN
CaseAdminUpdatedThe organization-wide list of eDiscovery Administrators was replaced with a new set of users (Update-eDiscoveryCaseAdmin). Adding or removing a single eDiscovery Administrator is logged as CaseAdminAdded instead.YN
CaseRemovedCase Removed activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).YN
CustodianCreatedCustodian Created activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).YN
SearchCreatedA content search was created in Microsoft Purview eDiscovery / Content Search (real UAL sample: Operation SearchCreated, RecordType 24, Workload SecurityComplianceCenter).YY
SearchExportDownloadedThe results of an eDiscovery content search were downloaded; a primary data-exfiltration signal.YN
SearchExportedThe results of a content search were exported in Microsoft Purview eDiscovery / Content Search; a common data-gathering and exfiltration-staging signal.YY
SearchStartedAn eDiscovery content search was started.YN
SearchUpdatedAn eDiscovery content search was modified.YN
ViewedSearchExportedAn eDiscovery search export was viewed; precedes download of collected content.YN

any: eDiscovery and Content Search activity (catch-all)

#
RecordType
Discovery

Description

Catch-all for M365-Discovery rules matching the RecordType but no specific Operation.

References #

CaseAdded

#
RecordType
Discovery

Description

Case Added activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "Case": "dw-deleg-case",
  "CreationDate": "2026-07-03T05:29:04",
  "CreationTime": "2026-07-03T05:29:04",
  "ExtendedProperties": [
    {
      "Name": "CaseId",
      "Value": "9e38d9e0-a28f-4d3d-8e64-f5bc3bef9e58"
    },
    {
      "Name": "CaseMembersSmtp",
      "Value": "adminuser@example.onmicrosoft.com"
    },
    {
      "Name": "CaseMembersGuid",
      "Value": "aaaaaaaa-0000-0000-0000-000000000001"
    }
  ],
  "Id": "42f17be8-d3aa-4613-f5ab-08ded8c3ff31",
  "ObjectId": "dw-deleg-case",
  "ObjectType": "Case",
  "Operation": "CaseAdded",
  "Operations": "CaseAdded",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "RecordType": "Discovery",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

CaseAdminUpdated

#
RecordType
Discovery

Description

The organization-wide list of eDiscovery Administrators was replaced with a new set of users (Update-eDiscoveryCaseAdmin). Adding or removing a single eDiscovery Administrator is logged as CaseAdminAdded instead.

Example Audit Record #

{
  "CreationTime": "2020-12-15T19:11:41",
  "ExtendedProperties": [
    {
      "Name": "CaseAdminsSmtp",
      "Value": "pbareiss@rodsoto.onmicrosoft.com,rodsoto@rodsoto.onmicrosoft.com,jhernan@rodsoto.onmicrosoft.com,bpatel@rodsoto.onmicrosoft.com"
    },
    {
      "Name": "CaseAdminsGuid",
      "Value": "746a9075-97ca-497f-8799-29e4a768e624,bfb8c366-0406-41a5-b3e3-328f4a3b4484,c0282018-2447-42b4-88a5-fe4ddf5f4c9f,425b75db-38be-4c7b-a474-5f0709247370"
    }
  ],
  "Id": "61033408-6753-4161-fa55-08d8a12d4192",
  "ObjectId": "Global Case Admin",
  "ObjectType": "CaseAdmin",
  "Operation": "CaseAdminUpdated",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Users (\"746a9075-97ca-497f-8799-29e4a768e624\",\"bfb8c366-0406-41a5-b3e3-328f4a3b4484\",\"c0282018-2447-42b4-88a5-fe4ddf5f4c9f\",\"425b75db-38be-4c7b-a474-5f0709247370\")"
    },
    {
      "Name": "Cmdlet",
      "Value": "Update-eDiscoveryCaseAdmin"
    }
  ],
  "RecordType": 24,
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

CaseRemoved

#
RecordType
Discovery

Description

Case Removed activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "Case": "dw-deleg-case",
  "CreationDate": "2026-07-03T05:29:26",
  "CreationTime": "2026-07-03T05:29:26",
  "ExtendedProperties": [
    {
      "Name": "CaseId",
      "Value": "9e38d9e0-a28f-4d3d-8e64-f5bc3bef9e58"
    }
  ],
  "Id": "67590b15-5a38-486e-76d0-08ded8c40c24",
  "ObjectId": "dw-deleg-case",
  "ObjectType": "Case",
  "Operation": "CaseRemoved",
  "Operations": "CaseRemoved",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "RecordType": "Discovery",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

CustodianCreated

#
RecordType
Discovery

Description

Custodian Created activity in Microsoft Purview eDiscovery, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "CaseId": "7cab8992-84c7-4276-9f53-64d86a7acb10",
  "ContactEmail": "adminuser@example.onmicrosoft.com",
  "CreationDate": "2026-07-03T05:30:48",
  "CreationTime": "2026-07-03T05:30:48",
  "CustodianId": "11111111111111111111111111111111",
  "Id": "20cbe4d3-e46a-466d-b28e-026d129d278b",
  "Name": "Admin User",
  "Operation": "CustodianCreated",
  "Operations": "CustodianCreated",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 24,
  "Scope": 0,
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": "Regular",
  "Workload": "SecurityComplianceCenter"
}

References #

SearchCreated

#
RecordType
Discovery

Description

A content search was created in Microsoft Purview eDiscovery / Content Search (real UAL sample: Operation SearchCreated, RecordType 24, Workload SecurityComplianceCenter).

Example Audit Record #

{
  "CreationTime": "2020-12-15T19:21:02",
  "ExchangeLocations": "Include:[All]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    }
  ],
  "Id": "4fb66ee8-07f1-4019-0cef-08d8a12e8fb2",
  "ObjectId": "TestSearch",
  "ObjectType": "Search",
  "Operation": "SearchCreated",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Name \"TestSearch\" -Description \"\" -HoldNames () -PublicFolderLocation (\"All\") -ExchangeLocationExclusion () -SharePointLocationExclusion () -Force \"True\" -Language \"\" -SharePointLocation (\"All\") -ExchangeLocation (\"All\") -ContentMatchQuery \"(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rod)(size>0)(subjecttitle=T)(-compliancetag:a)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(Ite[...]\""
    },
    {
      "Name": "Cmdlet",
      "Value": "New-ComplianceSearch"
    }
  ],
  "PublicFolderLocations": "Include:[All]",
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rod)(size>0)(subjecttitle=T)(-compliancetag:a)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(ItemClass=IPM.Note.Microsoft.Conversation)(ItemClass=IPM.Note.Microsoft.Missed)(ItemClass=IPM.Note.Microsoft.Conversation.Voice)(ItemClass=IPM.Note.Microsoft.Missed.Voice)(ItemClass=IPM.SkypeTeams.Message)(received=2020-11-14..2020-12-15)(recipients=rodsoto@rodsoto.onmicrosoft.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:t)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • O365 Compliance Content Search Started source: The following analytic detects when a content search is initiated within the Office 365 Security and Compliance Center. It leverages the SearchCreated operation from the o365_management_activity logs under the SecurityComplianceCenter…T1114, T1114.002

References #

SearchExportDownloaded

#
RecordType
Discovery

Description

The results of an eDiscovery content search were downloaded; a primary data-exfiltration signal.

Example Audit Record #

{
  "CreationTime": "2020-12-15T20:11:38",
  "ExchangeLocations": "Include:[rodsoto@rodsoto.onmicrosoft.com]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    },
    {
      "Name": "ActionId",
      "Value": "2229c178-367a-43c8-0a85-08d8a131a3c2"
    }
  ],
  "Id": "fa859988-f7d2-401f-b0f7-08d8a135a164",
  "ObjectId": "TestSearch\\TestSearch_Export",
  "ObjectType": "SearchAction",
  "Operation": "SearchExportDownloaded",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rodsoto@rodsoto.onmicrosoft.com)(size>1)(subjecttitle=test)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(received=2020-11-14..2020-12-15)(recipients=research@splunk.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:test)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

SearchExported

#
RecordType
Discovery

Description

The results of a content search were exported in Microsoft Purview eDiscovery / Content Search; a common data-gathering and exfiltration-staging signal.

Example Audit Record #

{
  "CreationTime": "2020-12-15T19:43:06",
  "ExchangeLocations": "Include:[rodsoto@rodsoto.onmicrosoft.com]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    },
    {
      "Name": "ActionId",
      "Value": "2229c178-367a-43c8-0a85-08d8a131a3c2"
    }
  ],
  "Id": "65ec4d77-1e9f-4a33-f5ba-08d8a131a4b6",
  "ObjectId": "TestSearch\\TestSearch_Export",
  "ObjectType": "SearchAction",
  "Operation": "SearchExported",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-EnableDedupe \"True\" -Format \"FxStream\" -Export \"True\" -Scope \"IndexedItemsOnly\" -IncludeSharePointDocumentVersions \"True\" -SharePointArchiveFormat \"PerUserZip\" -SearchName (\"TestSearch\") -Scenario \"General\" -ExchangeArchiveFormat \"PerUserPst\""
    },
    {
      "Name": "Cmdlet",
      "Value": "New-ComplianceSearchAction"
    }
  ],
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rodsoto@rodsoto.onmicrosoft.com)(size>1)(subjecttitle=test)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(received=2020-11-14..2020-12-15)(recipients=research@splunk.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:test)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

References #

SearchStarted

#
RecordType
Discovery

Description

An eDiscovery content search was started.

Example Audit Record #

{
  "CreationTime": "2020-12-15T19:26:29",
  "ExchangeLocations": "Include:[All]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    }
  ],
  "Id": "484550e5-7cb2-467c-bb5d-08d8a12f52c2",
  "ObjectId": "TestSearch",
  "ObjectType": "Search",
  "Operation": "SearchStarted",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Identity \"VGVzdFNlYXJjaA2\""
    },
    {
      "Name": "Cmdlet",
      "Value": "Start-ComplianceSearch"
    },
    {
      "Name": "Action",
      "Value": "UnknownType"
    }
  ],
  "PublicFolderLocations": "Include:[All]",
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rod)(size>0)(subjecttitle=T)(-compliancetag:a)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(ItemClass=IPM.Note.Microsoft.Conversation)(ItemClass=IPM.Note.Microsoft.Missed)(ItemClass=IPM.Note.Microsoft.Conversation.Voice)(ItemClass=IPM.Note.Microsoft.Missed.Voice)(ItemClass=IPM.SkypeTeams.Message)(received=2020-11-14..2020-12-15)(recipients=research@splunk.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:test)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

SearchUpdated

#
RecordType
Discovery

Description

An eDiscovery content search was modified.

Example Audit Record #

{
  "CreationTime": "2020-12-15T19:26:21",
  "ExchangeLocations": "Include:[All]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    }
  ],
  "Id": "6df4a362-6c99-4676-4c62-08d8a12f4dbf",
  "ObjectId": "TestSearch",
  "ObjectType": "Search",
  "Operation": "SearchUpdated",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Name \"TestSearch\" -Description \"\" -HoldNames () -PublicFolderLocation (\"All\") -SharePointLocation (\"All\") -ExchangeLocationExclusion () -SharePointLocationExclusion () -Force \"True\" -Language \"\" -Identity \"YWUwMDkwZmItM2UzYi00NzdkLTM4YzQtMDhkOGExMmYyZWE40\" -ExchangeLocation (\"All\") -ContentMatchQuery \"(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rod)(size>0)(subjecttitle=T)(-compliancetag:a)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)"
    },
    {
      "Name": "Cmdlet",
      "Value": "Set-ComplianceSearch"
    }
  ],
  "PublicFolderLocations": "Include:[All]",
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rod)(size>0)(subjecttitle=T)(-compliancetag:a)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(ItemClass=IPM.Note.Microsoft.Conversation)(ItemClass=IPM.Note.Microsoft.Missed)(ItemClass=IPM.Note.Microsoft.Conversation.Voice)(ItemClass=IPM.Note.Microsoft.Missed.Voice)(ItemClass=IPM.SkypeTeams.Message)(received=2020-11-14..2020-12-15)(recipients=research@splunk.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:test)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

ViewedSearchExported

#
RecordType
Discovery

Description

An eDiscovery search export was viewed; precedes download of collected content.

Example Audit Record #

{
  "CreationTime": "2020-12-15T20:11:38",
  "ExchangeLocations": "Include:[rodsoto@rodsoto.onmicrosoft.com]",
  "ExtendedProperties": [
    {
      "Name": "SearchIds",
      "Value": "2db0fc8f-3f43-449c-a1fc-08d8a12e8f9b"
    },
    {
      "Name": "ActionId",
      "Value": "2229c178-367a-43c8-0a85-08d8a131a3c2"
    }
  ],
  "Id": "ec0dcdb2-ab2c-41b2-b613-08d8a135a159",
  "ObjectId": "TestSearch\\TestSearch_Export",
  "ObjectType": "SearchAction",
  "Operation": "ViewedSearchExported",
  "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08",
  "Parameters": [
    {
      "Name": "CmdletOptions",
      "Value": "-Identity \"TestSearch_Export\" -IncludeCredential \"True\""
    },
    {
      "Name": "Cmdlet",
      "Value": "Get-ComplianceSearchAction"
    }
  ],
  "Query": "(c:c)(date=2020-11-01..2020-12-15)(senderauthor=rodsoto@rodsoto.onmicrosoft.com)(size>1)(subjecttitle=test)(kind=email)(participants=rodsoto@rodsoto.onmicrosoft.com)(ItemClass=IPM.Note)(ItemClass=IPM.Document)(received=2020-11-14..2020-12-15)(recipients=research@splunk.com)(from=rodsoto@rodsoto.onmicrosoft.com)(sent=2020-11-01..2020-12-15)(subject:test)",
  "RecordType": 24,
  "SharepointLocations": "Include:[All]",
  "UserId": "rodsoto@rodsoto.onmicrosoft.com",
  "UserKey": "bfb8c366-0406-41a5-b3e3-328f4a3b4484",
  "UserType": 0,
  "Version": 1,
  "Workload": "SecurityComplianceCenter"
}

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

  • Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
  • Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.
API JSON (event pages)OfficeActivity columnNote
IdOfficeIdRenamed.
WorkloadOfficeWorkloadRenamed.
ObjectIdOfficeObjectIdRenamed.
CreationTimeTimeGeneratedRenamed. OfficeActivity has no CreationTime column.
SiteUrlSite_UrlRenamed (SharePoint family).
RecordTypeRecordTypeSame name; the Int32 enum becomes its string enum name.
UserTypeUserTypeSame name; the Int32 enum becomes a string.
ClientIPClientIP, Client_IPAddressBoth columns present on OfficeActivity.
Scope(none)No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob.
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationIdsame namesUnchanged. No _s / _d suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.