I have a search query to display external files shares that are active (Sharepoint/Onedrive).
This is working and shows us when file shares to third parties are still active.
index=o365 file_path=* user=urn* OR TargetUserOrGroupType=Guest
| fillnull value="-"
| dedup UniqueSharingId TargetUserOrGroupName
| where NOT Operation=="RemovedFromSecureLink"
|stats latest(_time) by user Operation file_path file_name vendor_product TargetUserOrGroupName UniqueSharingId
The issue we have is if a user just deletes the file share folder (so no longer an active share) the dashboard still displays the share as active.
I need to append the following search and match to the unique sharing location to display if the file/folder has been deleted:
index=o365 Operation=FileDeleted
TIA
You can use a sub search to ignore the deleted files from results. Something like
index=o365 file_path=* user=urn* OR TargetUserOrGroupType=Guest NOT
[ search index=o365 Operation=FileDeleted
| table file_path,file_name ]
| fillnull value="-"
| dedup UniqueSharingId TargetUserOrGroupName
| where NOT Operation=="RemovedFromSecureLink"
| stats latest(_time) by user Operation file_path file_name vendor_product TargetUserOrGroupName UniqueSharingId