{"id":41292,"date":"2021-05-17T12:18:45","date_gmt":"2021-05-17T12:18:45","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=41292"},"modified":"2021-05-17T12:18:46","modified_gmt":"2021-05-17T12:18:46","slug":"purpose-and-value-of-advanced-auditing","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/","title":{"rendered":"Purpose and value of Advanced Auditing"},"content":{"rendered":"\n<p><strong><a href=\"https:\/\/www.testpreptraining.ai\/tutorial\/exam-sc-900-microsoft-security-compliance-and-identity-fundamentals\/\" target=\"_blank\" rel=\"noreferrer noopener\">Go back to Tutorial<\/a><\/strong><\/p>\n\n\n\n<p>In this tutorial, we will get to learn the purpose and value of Advanced Auditing.<\/p>\n\n\n\n<p>Advanced Audit helps organizations to conduct forensic and compliance investigations by increasing audit log retention that&#8217;s required to conduct an investigation. Audit log retention provides access to crucial events that help determine the scope of the compromise, and faster access to Office 365 Management Activity API. However, these capabilities differentiate Advanced Audit from the core audit functionality from the previous unit. And, this requires a Microsoft 365 E5 license, or a Microsoft 365 E3 or Office 365 E3 license with a Microsoft 365 E5 Compliance, or Microsoft 365 E5 eDiscovery and Audit add-on license.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"long-term-retention-of-audit-logs\"><strong>Long-term retention of audit logs<\/strong><\/h4>\n\n\n\n<p>Advanced Audit keeps all Exchange, SharePoint, and Azure Active Directory audit records for one year. Keeping audit records for longer periods can help with ongoing forensic or compliance investigations. However, Microsoft now has the capability to keep audit logs for 10 years. The 10-year retention of audit logs helps support long-running investigations and respond to regulatory, legal, and internal obligations.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"access-to-crucial-events-for-investigations\"><strong>Access to crucial events for investigations<\/strong><\/h4>\n\n\n\n<p>Advanced Auditing helps organizations to conduct forensic and compliance investigations by providing access to crucial events. This can be when mail items access, and when and what a user search in Exchange Online and SharePoint Online. These crucial events can help admins and users investigate possible breaches and determine the scope of compromise. Advanced Auditing provides the following crucial events:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Firstly, <strong>MailItemsAccessed<\/strong>. The MailItemsAccessed event is a mailbox auditing action that triggers when mail data is accessed by mail protocols and mail clients.<\/li><li>Secondly, <strong>Send<\/strong>. The Send event is also a mailbox auditing action and triggers when a user does one of the following actions:<ul><li>Sends an email message<\/li><li>Then, Replies to an email message<\/li><li>Forwards an email message<\/li><\/ul><\/li><\/ul>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><a href=\"https:\/\/www.testpreptraining.ai\/exam-sc-900-microsoft-security-compliance-identity-fundamentals-free-practice-test\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2021\/05\/sc-900-tests.png\" alt=\"Practice tests Advanced Auditing\"\/><\/a><\/figure><\/div>\n\n\n\n<ul class=\"wp-block-list\"><li>Then, <strong>SearchQueryInitiatedExchange<\/strong>. The SearchQueryInitiatedExchange event triggers when a person uses the Search bar in Outlook on the web (OWA) to search for items in a mailbox. However, Investigators can use the SearchQueryInitiatedExchange event to determine if an attacker may have compromised an account.<\/li><li>Lastly, <strong>SearchQueryInitiatedSharePoint<\/strong>. Similar to searching for mailbox items, the SearchQueryInitiatedSharePoint event triggers when a person searches for items in the SharePoint home site for your organization. Investigators can use the SearchQueryInitiatedSharePoint event to determine if an attacker tried to find sensitive information in SharePoint. <\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"high-bandwidth-access-to-office-365-management-activity-api\"><strong>High-bandwidth access to Office 365 Management Activity API<\/strong><\/h4>\n\n\n\n<p>Organizations that access auditing logs through the Office 365 Management Activity API previously restrict by throttling limits at the publisher level. This means that for a publisher pulling data on behalf of multiple customers, the limit share by all those customers.<\/p>\n\n\n\n<p>With the release of Advanced Audit, Microsoft is moving from a publisher-level limit to a tenant-level limit. The result is that each organization will get its own fully allocated bandwidth quota to access its auditing data. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><a href=\"https:\/\/www.testpreptraining.ai\/exam-sc-900-microsoft-security-compliance-identity-fundamentals-practice-exam\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2021\/05\/sc-900-course.png\" alt=\"sc-900 online course\"\/><\/a><\/figure><\/div>\n\n\n\n<p><strong>Reference:<\/strong> <a href=\"https:\/\/docs.microsoft.com\/en-us\/learn\/modules\/describe-audit-capabilities-microsoft-365\/3-describe-purpose-value-advanced-auditing\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Documentation<\/a><\/p>\n\n\n\n<p><strong><a href=\"https:\/\/www.testpreptraining.ai\/tutorial\/exam-sc-900-microsoft-security-compliance-and-identity-fundamentals\/\" target=\"_blank\" rel=\"noreferrer noopener\">Go back to Tutorial<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Go back to Tutorial In this tutorial, we will get to learn the purpose and value of Advanced Auditing. Advanced Audit helps organizations to conduct forensic and compliance investigations by increasing audit log retention that&#8217;s required to conduct an investigation. Audit log retention provides access to crucial events that help determine the scope of the&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"categories":[],"tags":[],"class_list":["post-41292","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Purpose and value of Advanced Auditing - Testprep Training Tutorials<\/title>\n<meta name=\"description\" content=\"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Purpose and value of Advanced Auditing - Testprep Training Tutorials\" \/>\n<meta property=\"og:description\" content=\"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/\" \/>\n<meta property=\"og:site_name\" content=\"Testprep Training Tutorials\" \/>\n<meta property=\"article:modified_time\" content=\"2021-05-17T12:18:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2021\/05\/sc-900-tests.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/\",\"url\":\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/\",\"name\":\"Purpose and value of Advanced Auditing - Testprep Training Tutorials\",\"isPartOf\":{\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#website\"},\"datePublished\":\"2021-05-17T12:18:45+00:00\",\"dateModified\":\"2021-05-17T12:18:46+00:00\",\"description\":\"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!\",\"breadcrumb\":{\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.testpreptraining.ai\/tutorial\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Purpose and value of Advanced Auditing\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#website\",\"url\":\"https:\/\/www.testpreptraining.ai\/tutorial\/\",\"name\":\"Testprep Training Tutorials\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.testpreptraining.ai\/tutorial\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#organization\",\"name\":\"Testprep Training\",\"url\":\"https:\/\/www.testpreptraining.ai\/tutorial\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.testpreptraining.com\/tutorial\/wp-content\/uploads\/2020\/07\/tpt-logo-6.png\",\"contentUrl\":\"https:\/\/www.testpreptraining.com\/tutorial\/wp-content\/uploads\/2020\/07\/tpt-logo-6.png\",\"width\":583,\"height\":153,\"caption\":\"Testprep Training\"},\"image\":{\"@id\":\"https:\/\/www.testpreptraining.ai\/tutorial\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Purpose and value of Advanced Auditing - Testprep Training Tutorials","description":"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/","og_locale":"en_US","og_type":"article","og_title":"Purpose and value of Advanced Auditing - Testprep Training Tutorials","og_description":"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!","og_url":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/","og_site_name":"Testprep Training Tutorials","article_modified_time":"2021-05-17T12:18:46+00:00","og_image":[{"url":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-content\/uploads\/2021\/05\/sc-900-tests.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/","url":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/","name":"Purpose and value of Advanced Auditing - Testprep Training Tutorials","isPartOf":{"@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#website"},"datePublished":"2021-05-17T12:18:45+00:00","dateModified":"2021-05-17T12:18:46+00:00","description":"Upgrade your knowledge by learning and understanding the value of Advanced Auditing. Prepare and pass the Microsoft SC-900 Exam Now!","breadcrumb":{"@id":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.testpreptraining.ai\/tutorial\/purpose-and-value-of-advanced-auditing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.testpreptraining.ai\/tutorial\/"},{"@type":"ListItem","position":2,"name":"Purpose and value of Advanced Auditing"}]},{"@type":"WebSite","@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#website","url":"https:\/\/www.testpreptraining.ai\/tutorial\/","name":"Testprep Training Tutorials","description":"","publisher":{"@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.testpreptraining.ai\/tutorial\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#organization","name":"Testprep Training","url":"https:\/\/www.testpreptraining.ai\/tutorial\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#\/schema\/logo\/image\/","url":"https:\/\/www.testpreptraining.com\/tutorial\/wp-content\/uploads\/2020\/07\/tpt-logo-6.png","contentUrl":"https:\/\/www.testpreptraining.com\/tutorial\/wp-content\/uploads\/2020\/07\/tpt-logo-6.png","width":583,"height":153,"caption":"Testprep Training"},"image":{"@id":"https:\/\/www.testpreptraining.ai\/tutorial\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/pages\/41292","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/comments?post=41292"}],"version-history":[{"count":5,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/pages\/41292\/revisions"}],"predecessor-version":[{"id":41385,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/pages\/41292\/revisions\/41385"}],"wp:attachment":[{"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/media?parent=41292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/categories?post=41292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.testpreptraining.ai\/tutorial\/wp-json\/wp\/v2\/tags?post=41292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}