CODEWITHSUNDEEP
microsoft-teamskqlazure-sentinelmicrosoft365-defender
HarriS
HarriS

Reputation: 850

KQL CloudAppEvents: view when some mutes you on teams

What log can I check on defender or sentinel to see when a meeting particpant has muted another user?

CloudAppEvents
| where TimeGenerated > ago(30d)
// | where Application == "Microsoft Teams"
| mv-expand parse_json(RawEventData)
| evaluate bag_unpack(RawEventData,  OutputColumnPrefix='Entities_')

This is what i checked, but cannot find the right action type or operation? is there documentation for action types or operations?

Upvotes: 0

Views: 205

Answers (1)

LearnTech
LearnTech

Reputation: 11

Given the context provided, it appears that there isn't a dedicated log or operation within Microsoft Defender or Sentinel that explicitly records when a meeting participant mutes another user in Microsoft Teams. While the CloudAppEvents log can be utilized to track activities within Teams, it doesn't offer granular details regarding muting actions specifically.

Ref.

Search the audit log for events in Microsoft Teams

Microsoft Sentinel integration (Preview)

Upvotes: 0

Related Questions