topic Re: Office 365 Security & Compliance Logs into Splunk in Getting Data In

Office 365 Security & Compliance Logs into Splunk

anandhalagarasa — Mon, 26 Aug 2019 14:14:30 GMT

Hi Team,

We have a requirement to ingest Office 365 Security & Compliance data into Splunk Cloud. So kindly let us know do we have any Add-on or app to ingest those logs into Splunk Cloud.

If yes, then kindly provide the app or add-on information so that we will configure the same into Splunk Cloud.

And also if you have any document for it then kindly share it.

Re: Office 365 Security & Compliance Logs into Splunk

anandhalagarasa — Tue, 27 Aug 2019 05:48:09 GMT

Can anyone help on my query.

Re: Office 365 Security & Compliance Logs into Splunk

lmethwani_splun — Wed, 28 Aug 2019 12:06:12 GMT

MS Office 365 is configured via Azure portal right?

Re: Office 365 Security & Compliance Logs into Splunk

lmethwani_splun — Wed, 28 Aug 2019 12:14:18 GMT

You can configure the app and add-on

App https://splunkbase.splunk.com/app/3786/
Add on to pull the logs via Microsoft management APIs: https://splunkbase.splunk.com/app/4055/

Please make sure to install the required apps/TAs mentioned in Details section.
Ref Doc for configuring the add-on: https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Re: Office 365 Security & Compliance Logs into Splunk

burakcinar — Wed, 28 Aug 2019 12:52:50 GMT

Hi ,
did you try this add-on Microsoft Graph Security API ? it has nice features for ingest all security alerts.

link;
https://splunkbase.splunk.com/app/4564/

Re: Office 365 Security & Compliance Logs into Splunk

woodcock — Tue, 08 Oct 2019 14:08:07 GMT

This will help a bunch:
http://bit.ly/Splunk_Azure_Permissions