All Apps and Add-ons

Need help with Splunk Add-on for Microsoft Office 365

SS1
Explorer

Hi,

We are working on setting up splunk 0365 addon. It looks like our tenant is used by multiple groups/domains, how do we filter to extract only specific group/domain of events to be indexed into splunk. I assume we have to filter out the data in step 2 or 3 from below steps but no idea around o365 side of things

  1. Add the Splunk Add-on for Microsoft Office 365
  2. Turn on Office 365 Audit Logging
  3. Create the Application in Azure AD
  4. Configure the Splunk Add-on for Microsoft Office 365
  5. Verify Logging
  6. Add the Microsoft 365 App for Splunk Add-on

https://docs.splunk.com/Documentation/AddOns/released/MSO365/About

 

 

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on