All Apps and Add-ons

Logging office365 email attachment name into Splunk using rest api

sayantabasak
Explorer

Hello,

I have been working with o365 reporting addon to extract email trace logs. This works fine but it misses out on one vital bit of information and that is the email attachment name/extensions. Seeking you help to configure splunk to able to pull this information over rest api from o365.

There are answers which points to usage of python script to make this possible , but would appreciate if a bit more clarity is given on that

Addon being used: TA-MS_O365_Reporting

Regards
Sayanta B

jconger
Splunk Employee
Splunk Employee

The Microsoft Office 365 Reporting Add-on for Splunk uses the MessageTrace report contained in the Office 365 reporting web service. Here's a link to the MessageTrace report detail -> https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...

Unfortunately, attachment data is not exposed by this report, so the add-on doesn't get it.

0 Karma

sayantabasak
Explorer

Thank you. I am looking for the email header values like attachment details and orginal sender in case of a spoofed email. Any way to achieve this just with outlook and splunk integration?

0 Karma

andrewzuehlke
Explorer

I am also very interested if you came across any solution for this if you have found one 🙂

0 Karma

lznger88_2
Path Finder

Hi Sayantabasak, did you find a way to achieve this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...