Data fields in Microsoft Office 365 Reporting Add-on for Splunk

[robar_ismail97]

Hi,

I have created an app in Azure given the permissions to the Office 365 management activity API and also created the Microsoft Office 365 Reporting Add-on in Splunk. The results when searching is not covering the fields i want. I want to get the subject of the email which Defender for O365 has triggered an alert on. Is the API sending the data? If yes, where is the fields stuck?

Br,

Robar