Data fields in Microsoft Office 365 Reporting Add-on for Splunk

robar_ismail97 — Wed, 02 Feb 2022 14:21:25 GMT

Hi,

I have created an app in Azure given the permissions to the Office 365 management activity API and also created the Microsoft Office 365 Reporting Add-on in Splunk. The results when searching is not covering the fields i want. I want to get the subject of the email which Defender for O365 has triggered an alert on. Is the API sending the data? If yes, where is the fields stuck?

Br,

Robar

topic Data fields in Microsoft Office 365 Reporting Add-on for Splunk in Getting Data In

Data fields in Microsoft Office 365 Reporting Add-on for Splunk