<group name="office365,">
  <rule id="108000" level="3">
    <location>office_365</location>
    <description>$(office_365.Workload) $(office_365.Operation) operation.</description>
    <options>no_full_log</options>
  </rule>
<rule id="108001" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UserLoggedIn$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108002" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Update group.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1484</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108003" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Update user.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1484</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108004" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Delete group.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1484</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108005" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Add user.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1136</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108006" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Add member to group.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108007" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Add registered owner to device.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108008" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Add registered users to device.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108009" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Change user password.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108010" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ReportingAccessed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108011" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^FileVisited$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108012" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^TeamsSessionStarted$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108013" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Update device.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108014" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MemberRemoved$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108015" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^TeamSettingChanged$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1484</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108016" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewReport$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108017" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ThreadViewed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108018" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^LaunchPowerApp$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108019" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ListForms$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108020" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^FileDownloaded$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1105</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108021" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^FileCreated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1204</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108022" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Add device.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108023" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^EditForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1565</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108024" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1083</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108025" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MemberAdded$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1069</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108026" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ExportForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1567</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108027" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageCreation$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108028" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageUpdated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108029" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UserSubmissionTriage$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1566</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108030" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageCreatedHasLink$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1189</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108031" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^CreateResponse$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108032" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MeetingDetail$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108033" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^PreviewForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1567</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108034" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewRuntimeForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1567</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108035" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MeetingParticipantDetail$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108036" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageUpdatedNotification$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108037" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^SubscribedToMessages$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108038" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^RunEmailSubscription$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108039" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^AnalyzedByExternalApplication$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108040" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^AppInstalled$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1518</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108041" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^AuthorizeCustomTag$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108042" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Change user license.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108043" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ConnectFromExternalApplication$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1518</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108044" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^CreateDataset$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108045" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^CreateGatewayClusterDatasource$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1518</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108046" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^CreateReport$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108047" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^CustomFieldOrLookupTableModified$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1518</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108048" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DeleteDataset$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1564</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108049" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DeleteReport$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1564</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108050" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DlpRuleMatch$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108051" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DLPRuleUndo$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108052" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DownloadReport$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108053" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^EditDataset$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108054" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^EditFlow$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108055" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^EditForm$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108056" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ExportArtifact$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108057" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ExportReport$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108058" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GenerateDataflowSasToken$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108059" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GenerateScreenshot$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108060" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetAllGatewayClusterDatasources$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108061" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Get-ComplianceSearchAction$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108062" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Get-CSSimpleUrlConfiguration$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108063" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Get-CsTeamsUpgradeOverridePolicy$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108064" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetGatewayClusterDatasourceStatus$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108065" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetGatewayClusters$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108066" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetGatewayClusterStatus$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108067" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetGatewayClusterSupportedDatasources$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108068" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetGatewayRegions$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108069" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Get-QuarantineMessage$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108070" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Get-QuarantineMessageHeader$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108071" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetSnapshots$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108072" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetWorkspaces$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108073" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Import$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108074" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^InsightGenerated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108075" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MemberRoleChanged$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1098</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108076" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageDeleted$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1564</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108077" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageEditedHasLink$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108078" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^MessageHostedContentRead$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108079" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ProjectAccessed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108080" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ProjectCheckedIn$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108081" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ProjectCheckedOut$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108082" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ProjectPublished$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108083" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^PublishPowerApp$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108084" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^QuarantineViewMessageHeader$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108085" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^RefreshDataset$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108086" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^SearchDataInsightsSubscription$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108087" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^SearchMtpRoleInfo$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108088" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^SearchMtpStatus$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108089" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^SetScheduledRefresh$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108090" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamEditUserSettings$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108091" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeChannelView$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108092" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeGetTranscript$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108093" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeVideoSetLink$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108094" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeVideoThumbnailUpload$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108095" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeVideoUpload$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108096" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^StreamInvokeVideoView$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108097" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^TabUpdated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108098" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^TeamCreated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108099" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Update StsRefreshTokenValidFrom Timestamp.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108100" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UpdateApp$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108101" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UpdatedUserMyAnalyticsSettings$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108102" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UpdateFormSetting$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108103" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UpdatePowerApp$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108104" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewDashboard$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108105" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewedSearchExported$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108106" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^ViewResponse$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108107" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^HeartBeat$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1538</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108108" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Delete user.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1531</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108109" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^DeleteDatasetRows$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108110" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Device no longer compliant.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1552</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108111" level="12">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Disable account.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1531</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108112" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UserSubmission$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1114</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108113" level="12">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^AlertEntityGenerated$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1562</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108114" level="12">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^AlertTriggered$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1562</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108115" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^BindMonikersToDatasources$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108116" level="10">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Delete device.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1531</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108117" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GenerateCustomVisualAADAccessToken$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108118" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^GetSummaryLink$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108119" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^OptInForPPUTrial$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108120" level="3">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^OptInForProTrial$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1213</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108121" level="12">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^Remove users strong authentication phone app detail.$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1552</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108122" level="5">
<if_sid>108000</if_sid>
<field name="office_365.Operation">^UserLoginFailed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1078</id>
</mitre>
<options>no_full_log</options>
</rule>
<!-- LOGON FAILED RULES-->
<rule id="108123" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^IdsLocked$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108124" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UserStrongAuthClientAuthNRequiredInterrupt$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108125" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^DeviceAuthenticationFailed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108126" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^PasswordResetRegistrationRequiredInterrupt$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108127" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^SsoArtifactExpiredDueToConditionalAccess$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108128" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^AuthenticationFailedSasError$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108129" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UserStrongAuthClientAuthNRequired$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1552</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108130" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^InvalidGrantDeviceNotFound$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108131" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^MisconfiguredApplicationWithReasonsListed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1526</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108132" level="10">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^SsoArtifactRevoked$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108133" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^SsoUserAccountNotFoundInResourceTenant$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108134" level="10">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UserDisabled$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108135" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^FlowTokenExpired$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108136" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UserStrongAuthEnrollmentRequiredInterrupt$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1552</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108137" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^MessagePromptInterrupt$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1552</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108138" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^InvalidReplyTo$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1539</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108139" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^MissingSigningKeyCertificateNotConfigured$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1539</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108140" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^NotAllowedTenantRestrictedTenant$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108141" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^DeviceAuthenticationRequired$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108142" level="10">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^PassThroughUserMfaError$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108143" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UserStrongAuthEnrollmentRequired$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1621</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108144" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^BrokerAppNotInstalledDeviceAuthenticationFailed$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108145" level="10">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^DeviceIsDisabled$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1606</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108146" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^AdminConsentRequired$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108147" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^GuestUserInPendingState$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108148" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^InvalidResourceServicePrincipalNotFound$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108149" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^RequestExceededGatewayTimeout$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108150" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^TriggerBrowserCapabilitiesInterrupt$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1539</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108151" level="5">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^FreshTokenNeeded$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1528</id>
</mitre>
<options>no_full_log</options>
</rule>
<rule id="108152" level="10">
<if_sid>108122</if_sid>
<field name="office_365.LogonError">^UnauthorizedClientDoesNotMatchRequest$</field>
<description>$(office_365.Workload) $(office_365.Operation) operation.</description>
<mitre>
<id>T1087</id>
</mitre>
<options>no_full_log</options>
</rule>
</group>
