Skip to content

Instantly share code, notes, and snippets.

@zplume

zplume/FormatO365AuditLogs.ps1

Created June 9, 2017 09:29
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save zplume/5e27958a65ff0b63466297da278c1b81 to your computer and use it in GitHub Desktop.
Save zplume/5e27958a65ff0b63466297da278c1b81 to your computer and use it in GitHub Desktop.
Download ZIP
Converts the bizarre JSON-in-CSV format of O365 audit logs to a more useful CSV of the JSON data. Run the script from the directory containing the $inputFile or specify a full path rather than just a file name.
Raw
FormatO365AuditLogs.ps1
$inputFile = "AuditLog_2017-05-18_2017-05-27.csv"
$outputFile = "AuditLogData.csv"
Import-Csv -Path $inputFile | ForEach-Object { $_.AuditData } | ConvertFrom-Json | Export-Csv -Path $outputFile -NoTypeInformation
@layaute
Copy link

layaute commented Apr 27, 2022 •
edited

Thank you very much for this script zplume!

There is a bug beacuse there is json inside json and it print only the "first object":
"ExtendedProperties"":[{""Name"":""ResultStatusDetail"",""Value"":""Success""},{""Name"":""UserAgent"",""Value"":""Android/10-EAS-2.0""},{""Name"":""UserAuthenticationMethod"",""Value"":""16""},{""Name"":""RequestType"",""Value"":""OAuth2:Token""}]
Script Result is:
ExtendedProperties=System.Object[]

Found this function that can help: https://stackoverflow.com/questions/45829754/convert-nested-json-array-into-separate-columns-in-csv-file

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment