CmdID

CmdID / PowerShell / Cmdlets / Search

Search-UnifiedAuditLog

Use the Search-UnifiedAuditLog cmdlet to search the unified audit log. Exchange PowerShell reference

From the Exchange PowerShell reference 16 parameters Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

16 in the Exchange PowerShell reference
-EndDateThe EndDate parameter specifies the end date of the date range.
-StartDateThe StartDate parameter specifies the start date of the date range.
-FormattedThe Formatted switch causes attributes that are normally returned as integers (for example, RecordType and Operation) to be formatted as descriptive strings.
-FreeTextThe FreeText parameter filters the log entries by the specified text string.
-HighCompletenessThe HighCompleteness switch specifies completeness instead performance in the results.
-IPAddressesThe IPAddresses parameter filters the log entries by the specified IP addresses.
-LegacyFlow
-LongerRetentionEnabled
-ObjectIdsThe ObjectIds parameter filters the log entries by object ID.
-OperationsThe Operations parameter filters the log entries by operation.
-RecordTypeThe RecordType parameter filters the log entries by record type.
-ResultSizeThe ResultSize parameter specifies the maximum number of results to return.
-SessionCommandThe SessionCommand parameter specifies how much information is returned and how it's organized.
-SessionIdThe SessionId parameter specifies an ID string to identify a command (the cmdlet and its parameters) that's run multiple times to return paged data.
-SiteIdsThe SiteIds parameter filters the log entries by the SharePoint SiteId (GUID).
-UserIdsThe UserIds parameter filters the log entries by the account (UserPrincipalName) of the user who performed the action.