CIM field change report

Learn about the CIM field changes between the latest version of the Splunk Add-on for Microsoft Office 365 and version 4.3.0.

Summary of changes

• Sourcetypes with changes: 3
• Total deleted fields: 3
• Total modified fields: 6
• Total new fields: 10

Detailed changes

o365:management:activity

Field	Deleted	Modified	New	Is CIM
action	❌	✅	❌	✅
reason	✅	✅	✅	✅
user	❌	❌	✅	✅
user_id	❌	❌	✅	✅

o365:metadata

Field	Deleted	Modified	New	Is CIM
user	❌	❌	✅	✅
user_id	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

o365:reporting:messagetrace

Field	Deleted	Modified	New	Is CIM
action	❌	✅	❌	✅
orig_recipient	✅	❌	❌	✅
orig_src	✅	❌	❌	✅
recipient_count	❌	❌	✅	✅
recipient_domain	❌	❌	✅	✅
src_user_domain	❌	❌	✅	✅
status_code	❌	❌	✅	✅
tag	❌	✅	❌	✅
tag::eventtype	❌	✅	❌	❌
vendor_product	❌	✅	❌	✅