So is there a secret tool? Or is this just an undocumented API call that people are only now finding out about?
It's a secret tool that uses undocumented APIs :)
Ahh nice, well the cat is out of the bag now
Exposing the secret Office 365 detailed activity logs and forensics tool
11–20 of 42 posts
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#12This is similar to Azure activity logs - in that they do not provide you log access to "read" actions.. only write/delete ones. However, Azure actually DOES keep those read ops logged. Though I guess, it's not similar in that: Azure still doesn't have an API to fetch them.. not even an undocumented one.
If an API is undocumented, how can you know that it doesn't exist? It might very well exist for internal debugging purposes, just not at the URL you might expect. Or maybe it's at the expected URL but returns 404 to everyone whose access token isn't flagged as an employee in the appropriate department.
As someone who relies very heavily on logs to debug issues in immature and/or fast-moving products, I would be surprised if they didn't log everything. It's sysadmin 101.
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#13This makes me wonder how many other APIs rely solely on obscurity to protect major features.
I don't know if this is to protect so much as it's an undocumented and immature API so they never made it public and kept it for internal use only.
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#14Could anyone ever honestly believe this data was not logged by Microsoft??
I'm at a loss for words, really.
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#15This is similar to Azure activity logs - in that they do not provide you log access to "read" actions.. only write/delete ones. However, Azure actually DOES keep those read ops logged. Though I guess, it's not similar in that: Azure still doesn't have an API to fetch them.. not even an undocumented one.
If an API is undocumented, how can you know that it doesn't exist? It might very well exist for internal debugging purposes, just not at the URL you might expect. Or maybe it's at the expected URL but returns 404 to everyone whose access token isn't flagged as an employee in the appropriate department. As someone who relies very heavily on logs to debug issues in immature and/or fast-moving products, I would be surpr…
What a naive / handwavey response. It's clearly not a case of "oh, we never finished up cleaning up the API for use in production" - it's a case of "here's a secret backdoor that we're only going to share with a privileged handful of powerful corporations"
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#16I looked at the API calls on the CrowdStrike blog post and I have been using parts of these API's for calls in PowerShell for at least the past year for tracking down issues we have had in Office 365. I can understand how frustrating it can be if your competitors seem to have "secret knowledge". However that knowledge may have been gotten by calling up the very helpful people at MS support, laying out the problem and…
I couldn't agree more. Why is the API not public? Is it because some sort of top secret corporate conspiracy? Or is it that management just decided to avoid the burden of publishing and maintaining an immature or lesser used API? After reading your comment that whole article seemed a little sensationalist
> just decided to avoid the burden of publishing and maintaining an immature or lesser used API
"Burden" is an understatement. Any API Microsoft documents becomes part of their ongoing commitment to eternal backward-compatibility. (Heck, even some things they never document at all still end up forced into that commitment, like the internal registry hives in Windows 95.)
So Microsoft do everything they can to only document what they're absolutely sure they have in a good, stable, "won't regret later that we didn't fix it some more before setting it in stone" state.
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#17> The tide turned on Friday, June 8. Out of the blue, an email popped onto the forensics community mailing list. It contained a single link, to an Anonymous video.
All that video said was "the API you seek is called Activities". Am I missing the joke, or is the name of the API literally the only thing that they needed to get this working?
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#18I'm not exactly sure why a new tool is needed. Everything necessary is found from the referenced Crowdstrike code at https://github.com/CrowdStrike/Forensics/tree/master/O365-Ou...
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#19This is similar to Azure activity logs - in that they do not provide you log access to "read" actions.. only write/delete ones. However, Azure actually DOES keep those read ops logged. Though I guess, it's not similar in that: Azure still doesn't have an API to fetch them.. not even an undocumented one.
If an API is undocumented, how can you know that it doesn't exist? It might very well exist for internal debugging purposes, just not at the URL you might expect. Or maybe it's at the expected URL but returns 404 to everyone whose access token isn't flagged as an employee in the appropriate department. As someone who relies very heavily on logs to debug issues in immature and/or fast-moving products, I would be surpr…
In the modern era, you should expect that the privacy policy contains the details of everything that's logged. You need to know that so you can tell your customers what is logged by your subs.
Re: Exposing the secret Office 365 detailed activity logs and forensics tool
#20I had to laugh at the line "still use shitty perl" in the video...