Archive

Office 365 Security & Compliance Logs into Splunk

anandhalagarasa
Path Finder

Hi Team,

We have a requirement to ingest Office 365 Security & Compliance data into Splunk Cloud. So kindly let us know do we have any Add-on or app to ingest those logs into Splunk Cloud.

If yes, then kindly provide the app or add-on information so that we will configure the same into Splunk Cloud.

And also if you have any document for it then kindly share it.

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will help a bunch:
http://bit.ly/Splunk_Azure_Permissions

0 Karma

burakcinar
Path Finder

Hi ,
did you try this add-on Microsoft Graph Security API ? it has nice features for ingest all security alerts.

link;
https://splunkbase.splunk.com/app/4564/

0 Karma

anandhalagarasa
Path Finder

Can anyone help on my query.

0 Karma

lmethwani_splun
Splunk Employee
Splunk Employee

MS Office 365 is configured via Azure portal right?

0 Karma

lmethwani_splun
Splunk Employee
Splunk Employee

You can configure the app and add-on

App https://splunkbase.splunk.com/app/3786/
Add on to pull the logs via Microsoft management APIs: https://splunkbase.splunk.com/app/4055/

Please make sure to install the required apps/TAs mentioned in Details section.
Ref Doc for configuring the add-on: https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!