Ingesting O365 logs but having issues with specific mappings

What it's saying is that it expects an object in the o365.audit.Parameters field, as that is what is mapped. But it's only receiving a single item, which it can't then place into an object.

You'd need to look at the event in question a little closer, if you can, and figure out what it's missing.

1 Like