All Apps and Add-ons
Highlighted

O365 message tracking logs

New Member

The Security Essentials documentation (https://docs.splunksecurityessentials.com/data-onboarding-guides/office-365/) states that "The Office365 Reporting Add-on lets you collect Exchange message-tracking logs by querying the Office 365 Reporting web service API and indexing the results.".

Based on my testing and the comments made here in Splunk Answers related to the add-on, it is no longer supported and no longer works to support pulling down message trace logs. Is there a newer recommended way for pulling down these logs?

0 Karma
Highlighted

Re: O365 message tracking logs

Engager

We are in the same boat, O365 no longer supports basic authentication for O365 to get those log files.

Having looked at some possible solutions we might write our own TA to get this again working. An alternate solution is to sue a powershell script to dump the log files hourly to a share and import from there.

Happy to share more when interested.

 

-Marc

 

Tags (1)
0 Karma
Highlighted

Re: O365 message tracking logs

Builder

Would love to  hear more about your proposed solution @marcluescher 

We have thought about taking the powershell route too but havent spent much time on it to be honest.