auditLog resource type

Namespace: microsoft.graph.security.caseManagement

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents an audit event that records a change or action in a case.

Inherited from activity.

Methods

This resource is part of a polymorphic collection managed by the activity base type. Use the Get activity endpoint to read audit log activities. Create, update, and delete operations aren't supported for audit logs.

Properties

Property	Type	Description
action	microsoft.graph.security.caseManagement.auditAction	The action represented by the audit log activity.
createdBy	String	The user or service that created the resource. Inherited from caseManagementEntity.
createdDateTime	DateTimeOffset	The date and time when the resource was created. Inherited from caseManagementEntity.
details	microsoft.graph.security.caseManagement.activityResourceDetails	The target resource details for the audit activity.
id	String	The unique identifier for the resource. Inherited from entity.
lastModifiedBy	String	The user or service that last modified the resource. Inherited from caseManagementEntity.
lastModifiedDateTime	DateTimeOffset	The date and time when the resource was last modified. Inherited from caseManagementEntity.
modifiedProperties	microsoft.graph.security.caseManagement.modifiedProperty collection	The collection of property changes recorded in the audit log.

auditAction values

Member	Description
link	A resource was linked to the case.
unlink	A resource was unlinked from the case.
update	A resource was updated.
delete	A resource was deleted.
create	A resource was created.
upload	A file was uploaded.
download	A file was downloaded.
fileUploadMalwareDetected	Malware was detected during file upload.
unknownFutureValue	Evolvable enumeration sentinel value. Don't use.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.caseManagement.auditLog",
  "id": "String (identifier)",
  "createdDateTime": "String (timestamp)",
  "createdBy": "String",
  "lastModifiedDateTime": "String (timestamp)",
  "lastModifiedBy": "String",
  "action": "String",
  "details": {
    "@odata.type": "#microsoft.graph.security.caseManagement.activityResourceDetails"
  },
  "modifiedProperties": [
    {
      "@odata.type": "#microsoft.graph.security.caseManagement.modifiedProperty"
    }
  ]
}