New-MgSecurityAuditLogQuery

Module:: Microsoft.Graph.Security Module

Create a new auditLogQuery object.

Note

To view the beta release of this cmdlet, view New-MgBetaSecurityAuditLogQuery

Syntax

CreateExpanded (Default)

New-MgSecurityAuditLogQuery
    [-ResponseHeadersVariable <string>]
    [-AdditionalProperties <hashtable>]
    [-AdministrativeUnitIdFilters <string[]>]
    [-DisplayName <string>]
    [-FilterEndDateTime <datetime>]
    [-FilterStartDateTime <datetime>]
    [-IPAddressFilters <string[]>]
    [-Id <string>]
    [-KeywordFilter <string>]
    [-ObjectIdFilters <string[]>]
    [-OperationFilters <string[]>]
    [-RecordTypeFilters <string[]>]
    [-Records <IMicrosoftGraphSecurityAuditLogRecord[]>]
    [-ServiceFilters <string[]>]
    [-Status <string>]
    [-UserPrincipalNameFilters <string[]>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Create

New-MgSecurityAuditLogQuery
    -BodyParameter <IMicrosoftGraphSecurityAuditLogQuery>
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Parameters

-AdditionalProperties

Additional Parameters

Parameter properties

Type:	System.Collections.Hashtable
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-AdministrativeUnitIdFilters

The collection of administrative unit IDs to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-BodyParameter

Represents a query against the unified audit log. To construct, see NOTES section for BODYPARAMETER properties and create a hash table.

Parameter properties

Type:	Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityAuditLogQuery
Supports wildcards:	False
DontShow:	False

Parameter sets

Create

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Break

Wait for .NET debugger to attach

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DisplayName

The display name of the audit log query.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-FilterEndDateTime

The end date and time of the audit log query filter.

Parameter properties

Type:	System.DateTime
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-FilterStartDateTime

The start date and time of the audit log query filter.

Parameter properties

Type:	System.DateTime
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Headers

Optional headers that will be added to the request.

Parameter properties

Type:	System.Collections.IDictionary
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelineAppend

SendAsync Pipeline Steps to be appended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelinePrepend

SendAsync Pipeline Steps to be prepended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Id

The unique identifier for an entity. Read-only.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-IPAddressFilters

The collection of IP addresses to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-KeywordFilter

The keyword to filter on.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ObjectIdFilters

The collection of object IDs to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-OperationFilters

The collection of operations to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Proxy

The URI for the proxy server to use

Parameter properties

Type:	System.Uri
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyCredential

Credentials for a proxy server to use for the remote call

Parameter properties

Type:	System.Management.Automation.PSCredential
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyUseDefaultCredentials

Use the default credentials for the proxy

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Records

The collection of audit log records retrieved by the query. To construct, see NOTES section for RECORDS properties and create a hash table.

Parameter properties

Type:	Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityAuditLogRecord[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-RecordTypeFilters

The collection of record types to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False
Aliases:	RHV

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ServiceFilters

The collection of services to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Status

Status of an audit log query.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-UserPrincipalNameFilters

The collection of user principal names to filter on.

Parameter properties

Type:	System.String[]
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-WhatIf

Runs the command in a mode that only reports what would happen without performing the actions.

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityAuditLogQuery

System.Collections.IDictionary

Outputs

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityAuditLogQuery

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphSecurityAuditLogQuery>: Represents a query against the unified audit log. [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [AdministrativeUnitIdFilters <String[]>]: The collection of administrative unit IDs to filter on. [DisplayName <String>]: The display name of the audit log query. [FilterEndDateTime <DateTime?>]: The end date and time of the audit log query filter. [FilterStartDateTime <DateTime?>]: The start date and time of the audit log query filter. [IPAddressFilters <String[]>]: The collection of IP addresses to filter on. [KeywordFilter <String>]: The keyword to filter on. [ObjectIdFilters <String[]>]: The collection of object IDs to filter on. [OperationFilters <String[]>]: The collection of operations to filter on. [RecordTypeFilters <String[]>]: The collection of record types to filter on. [Records <IMicrosoftGraphSecurityAuditLogRecord[]>]: The collection of audit log records retrieved by the query. [Id <String>]: The unique identifier for an entity. Read-only. [AdministrativeUnits <String[]>]: The collection of administrative units associated with the record. [AuditData <IMicrosoftGraphSecurityAuditData>]: Abstract base type for audit event data. [(Any) <Object>]: This indicates any property can be added to this object. [DynamicProperties <IMicrosoftGraphSecurityAuditRecordTypeDictionary>]: A dictionary of name-value pairs for dynamic audit event properties. [(Any) <Object>]: This indicates any property can be added to this object. [AuditLogRecordType <String>]: Specifies the type of audit log record. [ClientIP <String>]: The IP address of the client that performed the activity. [CreatedDateTime <DateTime?>]: The date and time when the activity was performed. [ObjectId <String>]: The identifier of the object that was affected by the activity. [Operation <String>]: The name of the activity that was performed. [OrganizationId <String>]: The GUID of the organization's Microsoft 365 tenant. [Service <String>]: The Microsoft 365 service where the activity occurred. [UserId <String>]: The identifier of the user, system account, service, or application that performed the activity. [UserPrincipalName <String>]: The user principal name of the user who performed the activity. [UserType <String>]: Type of user associated with an audit log record. [ServiceFilters <String[]>]: The collection of services to filter on. [Status <String>]: Status of an audit log query. [UserPrincipalNameFilters <String[]>]: The collection of user principal names to filter on.

RECORDS <IMicrosoftGraphSecurityAuditLogRecord[]>: The collection of audit log records retrieved by the query. [Id <String>]: The unique identifier for an entity. Read-only. [AdministrativeUnits <String[]>]: The collection of administrative units associated with the record. [AuditData <IMicrosoftGraphSecurityAuditData>]: Abstract base type for audit event data. [(Any) <Object>]: This indicates any property can be added to this object. [DynamicProperties <IMicrosoftGraphSecurityAuditRecordTypeDictionary>]: A dictionary of name-value pairs for dynamic audit event properties. [(Any) <Object>]: This indicates any property can be added to this object. [AuditLogRecordType <String>]: Specifies the type of audit log record. [ClientIP <String>]: The IP address of the client that performed the activity. [CreatedDateTime <DateTime?>]: The date and time when the activity was performed. [ObjectId <String>]: The identifier of the object that was affected by the activity. [Operation <String>]: The name of the activity that was performed. [OrganizationId <String>]: The GUID of the organization's Microsoft 365 tenant. [Service <String>]: The Microsoft 365 service where the activity occurred. [UserId <String>]: The identifier of the user, system account, service, or application that performed the activity. [UserPrincipalName <String>]: The user principal name of the user who performed the activity. [UserType <String>]: Type of user associated with an audit log record.