Logging office365 email attachment name into Splunk using rest api

[sayantabasak]

Hello,

I have been working with o365 reporting addon to extract email trace logs. This works fine but it misses out on one vital bit of information and that is the email attachment name/extensions. Seeking you help to configure splunk to able to pull this information over rest api from o365.

There are answers which points to usage of python script to make this possible , but would appreciate if a bit more clarity is given on that

Addon being used: TA-MS_O365_Reporting

Regards
Sayanta B

[jconger]

The Microsoft Office 365 Reporting Add-on for Splunk uses the MessageTrace report contained in the Office 365 reporting web service. Here's a link to the MessageTrace report detail -> https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...

Unfortunately, attachment data is not exposed by this report, so the add-on doesn't get it.

[sayantabasak]

Thank you. I am looking for the email header values like attachment details and orginal sender in case of a spoofed email. Any way to achieve this just with outlook and splunk integration?

[andrewzuehlke]

I am also very interested if you came across any solution for this if you have found one 🙂

[lznger88_2]

Hi Sayantabasak, did you find a way to achieve this?