Office 365 Email Tracking not detected by app Data Source Check

[alastor]

ms:o365:reporting:messagetrace isn't in the queries as a way to find email tracking details. Can we get an app update to cover that for email related detection?

Currently it appears to be looking for these: "sourcetype=cisco:esa* OR sourcetype=*:MessageTracking OR tag=email"

[David · Accepted solution]

Fixed in my dev environment! It will be published as 2.3.2, along with a few small bug fixes and a few minor enhancements to the bookmark page, targeting next week. (Hit me up on Splunk Usergroups Slack if you want early access!)

[alastor]

additionally, for Office 365 data collection for message traces, the data is delayed by at least 1440 minutes because, and this is from the app input configuration text, "Microsoft may delay trace events up to 24 hours. Specify how close to "now" a query may run (smaller values may introduce data loss for large volumes). See the README.md file for more information."

https://apps.splunk.com/apps/id/TA-MS_O365_Reporting

This means the -4 hours search default will likely not turn up results for Office 365 users.