O365_Unified_Auditlog_parser

1.2

O365 auditlog (Unified log) parser.

Applies to logs downloaded from https://protection.office.com/ - Search & investigation - Audit log search - Download - .csv

Downloaded log has 4 colums:
CreationDate | UserIds | Operations | Auditdata
Problem: the most important one (Auditdata) is string mess where data is delimited with ; , and [] and you can't really import it to excel to filter reasonably for examing.
Also problem: different services log more or less data so no fixed amount of columns

This parser will modify the Auditdata column, creates a table and exports the parsered csv file (to be imported to excel).
More comments inside the script.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name O365_Unified_Auditlog_parser -RequiredVersion 1.2

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More