Use these search tokens below to search in the Events tab under Monitor.
Example
Show events that have name as UserLoggedIn
name:"UserLoggedIn"
Example
Show all connectors of the type OFFICE365
connector.type:OFFICE365
Example
Show results with name O365Connector1
connector.name:O365Connector1
Example
Show all events of the category ServicePrincipal
category:"ServicePrincipal"
Example
Show all events of the service type AzureActiveDirectory
serviceType:"AzureActiveDirectory"
Example
Show all events of the results Success
actionDetail.result:"Success"
Example
Show all events that have actor ID 98e0c33e-7acc-46d3-82ba-dd313ef4434f
actor.id:"98e0c33e-7acc-46d3-82ba-dd313ef4434f"
Example
Show all events attended by user having email address testprod@qualyssscmsdev.com
actor.email:"testprod@qualyssscmsdev.com"
Example
Show all events of the actor type User
actor.type:"User"
Example
Show all events that have origin IP 40.79.154.194
origin.ip:"40.79.154.194"
Example
Show all events that have origin user agents as EvoSTS
origin.userAgent:"EvoSTS"
actionDetail.modifiedResources.resourceId
Example
Show all events that have resource ID as 05e394a6-3d79-483b-abf2-5f39c5787196
actionDetail.modifiedResources.resourceId:"05e394a6-3d79-483b-abf2-5f39c5787196"
actionDetail.modifiedResources.resourceName
Example
Show all events that have resource name as Microsoft Graph
actionDetail.modifiedResources.resourceName:"Microsoft Graph"
Example
Show all connectors of the sub-category Application
subCategory:Application
Example
Show all connectors of severity High
severity:High