CIM field change report

Learn about the CIM field changes between the latest version of the Splunk Add-on for Microsoft Office 365 and version 4.1.1.

Summary of changes

• Sourcetypes with changes: 3
• Total deleted fields: 1
• Total modified fields: 2
• Total new fields: 23

Detailed changes

o365:management:activity

Field	Deleted	Modified	New	Is CIM
action	❌	✅	❌	✅
reason	✅	✅	✅	✅
user	❌	❌	✅	✅
user_id	❌	❌	✅	✅

o365:metadata

Field	Deleted	Modified	New	Is CIM
user	❌	❌	✅	✅
user_id	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

o365:reporting:messagetrace

Field	Deleted	Modified	New	Is CIM
action	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
internal_message_id	❌	❌	✅	✅
message_id	❌	❌	✅	✅
recipient	❌	❌	✅	✅
recipient_count	❌	❌	✅	✅
recipient_domain	❌	❌	✅	✅
size	❌	❌	✅	✅
src	❌	❌	✅	✅
src_user	❌	❌	✅	✅
src_user_domain	❌	❌	✅	✅
status_code	❌	❌	✅	✅
subject	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅