Repository files navigation

A portable Python-only tool to process Microsoft Teams Audit Logs.

The original goal was to help spot network issues (connections lost) by looking at people making multiple successive connections to the same meeting with the same device.

usage: tala [--debug] [--help|-?] [--version]       [-o|--organizers] [-a|--attendees]       [-u|--users FILE]       [-d|--disconnect] [-i|--ip REGEX]       [--] [file ...]  ---------------  -------------------------------------------------  -o|--organizers  List meetings organizers  -a|--attendees   List meetings attendees  -d|--disconnect  List meetings disconnections  -i|--ip REGEX    Filter meeting disconnections by IP address regex  -u|--users FILE  create/update and use the FILE users database  --debug          Enable debug mode  --help|-?        Print usage and this help message and exit  --version        Print version and exit  --               Options processing terminator

You can use the command either as a filter (cat my_log_file | tala) or as a file processor (tala my_log_file).

You can either use it:

• to display an audit log in human readable format (no args)
• to produce a CSV file with the relevant meetings/organizers information (-o)
• to produce a CSV file with the relevant meetings/attendees information (-a)
• to produce/update/use a CSV file with UUID,EMAIL of organizers/attendees (-u FILE)
• to analyze suspected disconnection cases (-d)
  • you can restrict cases to the ones made from specific IP addresses (-i REGEX), as you normally don't care about people connecting from home rather than your internal enterprise network.
    • for example "^10\.5[78]\." for IPv4 addresses beginning with "10.57." or "10.58.".
  • you can use the CSV file with UUID,EMAIL to identify attendees encountering network issues (-u FILE)

Please note that the suspected disconnection cases are still crude so far, and contain false positives (for example, when you have multiple rather than successive connections to the same meeting, using different devices).

The audit data used to be truncated at 50.000 lines per extract file. If you have files with exactly 50.001 lines, try exporting data on a shorter time span.

NB: The fields can be in any order and there may be additional fields buttala expects at least the 4 mentioned above, with a comma-separator.

Can be either:

or:

In addition, when the meeting participant is added during the meeting, there's an "InviterInfo" record associated with one of the 2 previous types:

• Search the audit log for events in Microsoft Teams
• Search the audit log in the compliance center
• New High-Value Audit Records Capture Details of Microsoft Teams Meetings

Other interesting links:

• Microsoft Teams meeting attendance report
• Microsoft Teams analytics and reporting
• Use log files to monitor and troubleshoot Microsoft Teams
• Teams troubleshooting