Use Communication Compliance with SIEM solutions

Microsoft Purview Communication Compliance is an insider risk solution that helps you minimize communication risks by helping you detect, capture, and act on potentially inappropriate messages in your organization. Security information and event management (SIEM) solutions such as Microsoft Sentinel or Splunk are commonly used to aggregate and track threats within an organization.

A common need for organizations is to integrate Communication Compliance alerts and their SIEM solutions. With this integration, organizations can view Communication Compliance alerts in their SIEM solution and then remediate alerts within the Communication Compliance workflow and user experience.

For example, an employee sends an offensive message to another employee and the offensive message is detected by a Communication Compliance policy for potentially inappropriate content. Communication Compliance solution logs events such as policy matches for inappropriate content in Microsoft 365 Audit (also known as "unified audit log") and imports them into the SIEM solution. You can associate SIEM alerts that were created from Microsoft 365 Audit events with the corresponding Communication Compliance alerts. Investigators receive notifications of these alerts in their SIEM solution, and they can investigate and remediate the corresponding alerts in the Communication Compliance dashboard.

Communication Compliance alerts in Microsoft 365 Audit

Microsoft 365 Audit captures all Communication Compliance policy matches. The following examples show the details available for selected Communication Compliance policy match activities:

Example of audit log entry for an Inappropriate Content policy template match:

RunspaceId: 5c7bc9b0-7672-4091-a112-0635bd5f7732
RecordType: ComplianceSupervisionExchange
CreationDate: 7/7/2022 5:30:11 AM
UserIds: user1@contoso.onmicrosoft.com
Operations: SupervisionRuleMatch
AuditData: {"CreationTime":"2022-07-07T05:30:11","Id":"44e98a7e-57fd-4f89-79b8-08d941084a35","Operation":"SupervisionRuleMatch","OrganizationId":"338397e6\-697e-4dbe-a66b-2ea3497ef15c","RecordType":68,"ResultStatus":"{\\"ItemClass\\":\\"IPM.Note\\",\\"CcsiResults\\":\\"\\"}","UserKey":"SupervisionStoreDeliveryAgent","UserType":0,"Version":1,"Workload":"Exchange","ObjectId":"\<HE1P190MB04600526C0524C75E5750C5AC61A9@HE1P190MB0460.EURP190.PROD.OUTLOOK.COM\>","UserId":"user1@contoso.onmicrosoft.com","IsPolicyHit":true,"SRPolicyMatchDetails":{"SRPolicyId":"00aa00aa-bb11-cc22-dd33-44ee44ee44ee","SRPolicyName":"Adult images","SRRuleMatchDetails":\[\]}}
ResultIndex: 24
ResultCount: 48
Identity: 44e98a7e-57fd-4f89-79b8-08d941084a35
IsValid: True
ObjectState: Unchanged

Example of a Microsoft 365 audit log entry for a policy with custom keyword match (custom sensitive information type):

RunspaceId: 5c7bc9b0-7672-4091-a112-0635bd5f7732
RecordType: ComplianceSupervisionExchange
CreationDate: 7/6/2022 9:50:12 PM
UserIds: user2@contoso.onmicrosoft.com
Operations: SupervisionRuleMatch
AuditData: {"CreationTime":"2022-07-06T21:50:12","Id":"5c61aae5-26fc-4c8e-0791-08d940c8086f","Operation":"SupervisionRuleMatch","OrganizationId":"338397e6\-697e-4dbe-a66b-2ea3497ef15c","RecordType":68,"ResultStatus":"{\\"ItemClass\\":\\"IPM.Note\\",\\"CcsiResults\\":\\"public\\"}","UserKey":"SupervisionStoreDeliveryAgent","UserType":0,"Version":1,"Workload":"Exchange","ObjectId":"\<20210706174831.24375086.807067@sailthru.com\>","UserId":"user2@contoso.onmicrosoft.com","IsPolicyHit":true,"SRPolicyMatchDetails":{"SRPolicyId":"11bb11bb-cc22-dd33-ee44-55ff55ff55ff","SRPolicyName":"Insiders","SRRuleMatchDetails":\[{"SRCategoryName":"New insiders lexicon"}\]}}
ResultIndex: 46
ResultCount: 48
Identity: 5c61aae5-26fc-4c8e-0791-08d940c8086f
IsValid: True
ObjectState: Unchanged

Configure Communication Compliance and Microsoft Sentinel integration

When you use Microsoft Sentinel to aggregate Communication Compliance policy matches, Microsoft Sentinel uses Microsoft 365 Audit as the data source. To integrate Communication Compliance alerts with Microsoft Sentinel, complete the following steps:

1. Onboard to Microsoft Sentinel. As part of the onboarding process, you configure your data sources.

2. Configure the Microsoft Sentinel Microsoft Office 365 data connector and under connector configuration, select Exchange.

3. Configure search query to retrieve Communication Compliance alerts. For example:

   | OfficeActivity | where OfficeWorkload == "Exchange" and Operation == "SupervisionRuleMatch" | sort by TimeGenerated

   To filter for a specific user, use the following query format:

   | OfficeActivity | where OfficeWorkload == "Exchange" and Operation == "SupervisionRuleMatch" and UserId == "User1@Contoso.com" | sort by TimeGenerated

For more information about the Microsoft 365 Audit logs for Office 365 that Microsoft Sentinel collects, see Azure Monitor Logs reference.

Configure Communication Compliance and Splunk integration

To integrate Communication Compliance alerts with Splunk, complete the following steps:

1. Install the Splunk Add-on for Microsoft Office 365

2. Configure an integration application in Microsoft Entra ID for the Splunk Add-on for Microsoft Office 365

3. Configure search queries in your Splunk solution. Use the following search example to identify all Communication Compliance alerts:

   index=* sourcetype="o365:management:activity" Workload=Exchange Operation=SupervisionRuleMatch

To filter results for a specific Communication Compliance policy, use the SRPolicyMatchDetails.SRPolicyName parameter.

For example, the following search example returns alerts for matches to a Communication Compliance policy named Inappropriate content:

index=* sourcetype='o365:management:activity' Workload=Exchange Operation=SupervisionRuleMatch SRPolicyMatchDetails.SRPolicyName=<Inappropriate content>

The following table shows sample search results for different policy types:

Configure Communication Compliance with other SIEM solutions

To retrieve Communication Compliance policy matches from Microsoft 365 Audit, use PowerShell or the Office 365 Management API.

When you use PowerShell, you can use either of these parameters with the Search-UnifiedAuditLog cmdlet to filter audit log events for Communication Compliance activities.

The following examples show how to search for Communication Compliance matches.

Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -Operations SupervisionRuleMatch | ft CreationDate,UserIds,AuditData

The following is a sample search using the RecordsType parameter and the ComplianceSupervisionExchange value:

Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate -RecordType ComplianceSuperVisionExchange | ft CreationDate,UserIds,AuditData

Additional SIEM integration resources

• Communication Compliance auditing
• Microsoft Purview Audit (Premium)
• Office 365 Management Activity API reference