Comments on: Practical Graph: Using the Microsoft AuditLog Query Graph API (Preview) https://practical365.com/audit-log-query-api/ Practical Office 365 News, Tips, and Tutorials Thu, 11 Jul 2024 04:43:13 +0000 hourly 1 https://wordpress.org/?v=6.6.1 By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_296687'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_296687"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/audit-log-query-api/#comment-296687 Thu, 11 Jul 2024 04:43:13 +0000 https://practical365.com/?p=60675#comment-296687 In reply to Florin.

I guess Microsoft could plead that the AuditLogQuery API is in preview and therefore liable to break as they fine tune the code to make it GA. I see some other signs of instability with the results generated by the Search-UnifiedAuditLog cmdlet. Let’s hope that this period passes quickly and normal (good JSON) service is restored.

]]> By: Florin https://practical365.com/audit-log-query-api/#comment-296668 Wed, 10 Jul 2024 21:52:08 +0000 https://practical365.com/?p=60675#comment-296668 In reply to Tony Redmond.

Unfortunately I also get the same invalid JSON returned from Graph (which makes all methods that parse the response as JSON break – like Invoke-MgGraphRequest or Get-MgBetaSecurityAuditLogQueryRecord or Invoke-PnPGraphMethod ).
It looks like a there are multiple people reporting the same like on this posts:
https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/2689
https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/2677
https://learn.microsoft.com/en-us/answers/questions/1643751/im-receiving-incomplete-invalid-json-responses-for.
Even in Graph explorer it gives a warning malformed JSON body.

]]> By: Tony Redmond https://practical365.com/audit-log-query-api/#comment-292428 Wed, 17 Apr 2024 12:39:22 +0000 https://practical365.com/?p=60675#comment-292428 In reply to Julien.

Sounds like some bad data is in the AdministrativeUnits property in the AuditData payload for an audit record. I haven’t seen this before.

]]> By: Julien https://practical365.com/audit-log-query-api/#comment-292427 Wed, 17 Apr 2024 12:26:37 +0000 https://practical365.com/?p=60675#comment-292427 In reply to Tony Redmond.

Thanks, the body was indeed malformed…

Moving forward i’m now getting another error while fetching the records : Invoke-MgGraphRequest : Conversion from JSON failed with error: After parsing a value an unexpected character was encountered: {. Path ‘value[406].administrativeUnits’, line 1, position 1027566.

]]> By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_292354'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_292354"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/audit-log-query-api/#comment-292354 Tue, 16 Apr 2024 09:45:10 +0000 https://practical365.com/?p=60675#comment-292354 In reply to Tomas Valenta.

Very true… and if you look at the script, it uses Top=999 to minimize the number of Graph requests used to fetch data. When you’re retrieving potentially tens of thousands of audit records, this helps…

]]> By: Tomas Valenta https://practical365.com/audit-log-query-api/#comment-292352 Tue, 16 Apr 2024 09:22:36 +0000 https://practical365.com/?p=60675#comment-292352 Good article, thank you.
One small note on the pagination – It is also possible to change the page size specifying the $top parameter, for example:
$Uri = (“https://graph.microsoft.com/beta/security/auditLog/queries/{0}/records?`$top={1}” -f $SearchId, 500)
This will bring 500 records per page. Currently, Microsoft allows a maximum of 1000 records per page.
See this link for more details – https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#odata-system-query-options (not all OData parameters might be supported).

]]> By: Tony Redmond https://practical365.com/audit-log-query-api/#comment-292295 Mon, 15 Apr 2024 16:20:45 +0000 https://practical365.com/?p=60675#comment-292295 In reply to Julien.

I’ve seen quite a few internal server errors (500) in my testing. It could be just that (a server error) or it might be that the body used in the request is malformed in some way.

]]> By: Julien https://practical365.com/audit-log-query-api/#comment-292290 Mon, 15 Apr 2024 15:37:46 +0000 https://practical365.com/?p=60675#comment-292290 Hi Tony,

Very interesting article as always !

I’m getting the following error when posting the query to the audit log queries endpoint in order to create a new job (using Azure automation account), any idea ?

POST https://graph.microsoft.com/beta/security/auditLog/queries HTTP/1.1 500 Internal Server Error Transfer- XXXXXXXX – Code line: $NewSearch = Invoke-MgGraphRequest -Uri $Uri -Method $method -Body $body

]]>