I have been working with o365 reporting addon to extract email trace logs. This works fine but it misses out on one vital bit of information and that is the email attachment name/extensions. Seeking you help to configure splunk to able to pull this information over rest api from o365.
There are answers which points to usage of python script to make this possible , but would appreciate if a bit more clarity is given on that
Addon being used: TA-MSO365Reporting
The Microsoft Office 365 Reporting Add-on for Splunk uses the MessageTrace report contained in the Office 365 reporting web service. Here's a link to the MessageTrace report detail -> https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984...
Unfortunately, attachment data is not exposed by this report, so the add-on doesn't get it.
Thank you. I am looking for the email header values like attachment details and orginal sender in case of a spoofed email. Any way to achieve this just with outlook and splunk integration?