Report stream audit events

Connect-ExchangeOnline -SkipLoadingCmdletHelp

param(
    [int] $LookbackDays = 30,
    [string] $StartDate = (Get-Date).AddDays(-$LookbackDays),
    [string] $EndDate = (Get-Date).AddDays(1); $StartDate = (Get-Date).AddDays(-$LookbackDays)
)
 
$Status = Get-ConnectionInformation -ErrorAction SilentlyContinue
If (!($Status)) {
  Connect-ExchangeOnline -SkipLoadingCmdletHelp
}
 
[array]$Operations = "FileUploaded", "FileModified", "FileAccessed"
Write-Host "Looking for Stream audit events..."
[array]$Records = (Search-UnifiedAuditLog -Operations $Operations -StartDate $StartDate -EndDate $EndDate `
  -Formatted -ResultSize 5000 -SessionCommand ReturnLargeSet)
If (!($Records)) {
    Write-Host "No audit records found - exiting!"; break
}
 
Write-Host "Processing events..."
$StreamEvents = [System.Collections.Generic.List[Object]]::new()
$Records = $Records | Sort-Object CreatedDateTime
ForEach ($Rec in $Records) {
   $AuditData = $Rec.AuditData | ConvertFrom-Json
   If (($AuditData.SourceFileExtension -in "mp4", "webm")) {
      $RecordingFileName = $AuditData.SourceFileName
      $DateLoc = $RecordingFileName.IndexOf("-202")
      $Topic = $null
      If ($DateLoc -eq -1) {$Topic = $RecordingFileName} Else
         {$Topic = $RecordingFileName.SubString(0,$DateLoc)}
      $DataLine = [PSCustomObject] @{
         Workload            = $AuditData.Workload
         Timestamp           = $Rec.CreationDate
         User                = $Rec.UserIds
         Recording           = $RecordingFileName
         Topic               = $Topic
         Site                = $AuditData.SiteURL
         FullURL             = $AuditData.ObjectId
         Folder              = $AuditData.SourceRelativeURL
         Operation           = $Rec.Operations }
    $StreamEvents.Add($DataLine)
   } #End If
} #End For
 
Write-Host ""
$StreamFileOperations = $StreamEvents | Sort-Object {$_.Timestamp -as [datetime]} | Where-Object { $_.User -ne "app@sharepoint" }
$StreamFileOperations | Group-Object User | Sort-Object Count -Descending | Format-Table Name, Count
$StreamFileOperations | Out-GridView