topic Re: How do I pull in logs containing Office 365 email header info into Splunk? in Splunk Search

How do I pull in logs containing Office 365 email header info into Splunk?

Deb — Wed, 03 Nov 2021 21:48:58 GMT

Hello, I use Splunk to look at Office 365 email....but I don't see header info relating to TLS which we are looking for data on. How do I pull this info into Splunk? Is it in a different log?

Thanks

Re: How do I pull in logs containing Office 365 email header info into Splunk?

Roy_9 — Thu, 04 Nov 2021 02:32:22 GMT

Are you using Microsoft O365 Email Add-on for Splunk for these logs?

Try exploring the above package by downloading from splunkbase.

Re: How do I pull in logs containing Office 365 email header info into Splunk?

Deb — Thu, 04 Nov 2021 14:15:20 GMT

Thank you....I'm guessing this is the only way to do it? Add-on is required? I see it does offer the ability to look at Auth info as well which we are interested in. Thanks for the reply. I'll look into it!! 🙂

Re: How do I pull in logs containing Office 365 email header info into Splunk?

Roy_9 — Thu, 04 Nov 2021 16:24:26 GMT

Sure, no problem

Happy Splunking