SharePoint Audit Logging

SharePoint 2007, 2010 and 2013 have a built-in audit logging capability that allows you to track site collection user and administrative activity.

The Windows SharePoint Services 3.0 and SharePoint Foundation products also have this audit function but it is not exposed in the interface. Auditing in these “free” versions of SharePoint is only accessible programmatically such as through LOGbinder for SharePoint.

End-User Tracking

You can track end-user operations including the viewing of documents, document libraries, lists and list items. SharePoint can audit document check-in and check-out as well as updates to list items and documents.

Administrator Tracking

You can also audit important site collection level administration such as permission changes, role updates, group membership changes and changes to the audit policy itself. Some administrative changes such as farm administrator assignments, site collection creation and other farm level operations are not audited.

Next, how to:

• Control SharePoint auditing
• Access the SharePoint audit log
• Integrate with your SIEM/log management solution

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Audit Policy
•	Audit Log
•	LOGbinder SP
•	Webinars