All Apps and Add-ons
Highlighted

Logging office365 email attachment name into Splunk using rest api

Explorer

Hello,

I have been working with o365 reporting addon to extract email trace logs. This works fine but it misses out on one vital bit of information and that is the email attachment name/extensions. Seeking you help to configure splunk to able to pull this information over rest api from o365.

There are answers which points to usage of python script to make this possible , but would appreciate if a bit more clarity is given on that

Addon being used: TA-MSO365Reporting

Regards
Sayanta B

Highlighted

Re: Logging office365 email attachment name into Splunk using rest api

Splunk Employee
Splunk Employee

The Microsoft Office 365 Reporting Add-on for Splunk uses the MessageTrace report contained in the Office 365 reporting web service. Here's a link to the MessageTrace report detail -> https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...

Unfortunately, attachment data is not exposed by this report, so the add-on doesn't get it.

0 Karma
Highlighted

Re: Logging office365 email attachment name into Splunk using rest api

Explorer

Thank you. I am looking for the email header values like attachment details and orginal sender in case of a spoofed email. Any way to achieve this just with outlook and splunk integration?

0 Karma
Highlighted

Re: Logging office365 email attachment name into Splunk using rest api

Explorer

Hi Sayantabasak, did you find a way to achieve this?

0 Karma
Highlighted

Re: Logging office365 email attachment name into Splunk using rest api

Explorer

I am also very interested if you came across any solution for this if you have found one 🙂

0 Karma