Query Details

Share Point Downloads

Query

OfficeActivity
| where  RecordType == "SharePointFileOperation"
| where Operation == "FileDownloaded" or Operation == "FileSyncDownloadedFull"
| join kind= inner (
    Heartbeat
    | summarize arg_max(TimeGenerated, *) by ComputerIP
    | extend ClientIP = tostring(ComputerIP), Computer
) on ClientIP
| project TimeGenerated, ClientIP, Computer, Operation, OfficeWorkload, UserId, SourceFileName, OfficeObjectId
| sort by TimeGenerated desc

Explanation

This query retrieves information about file downloads in SharePoint and combines it with heartbeat data to get additional details. It then projects specific columns and sorts the results by the time the activity occurred.