Exchange admin audit logs

[nuwan]

Can splunk read exchange 2010 sp1 admin audit logs. I beleive exchange admin logs goes to a configured email. Does splunk exchange app reads the exchange admin logs
Thank you in advance

[ahall_splunk]

Yes. Download the Splunk App for Microsoft Exchange - the TA-Exchange-2010-* technology add-ons that are included read the Admin Audit Logs from each server.

[nuwan]

Thank you.

[micnuw2]

I am also curious as it seems this issue isnt getting fixed. The short answer my Splunk team got from their Splunk rep was that the account that is forwarding to the Exchange app indexes needs to be in the same domain with organizational management role in Exchange XD. Im sorry but the expectation that an Exchange team using this app would give full open ended access to a service account just to forward admin audit logs is insane.

[tomasmoser]

Hi,

I am curious when below bug will be fixed. It is related to Exchange 2016 admin audit log extraction.

2016-12-30 EXC-2052

read-audit-logs_2010_2013.ps1 failure. The search command search-adminauditlog used in read-audit-logs_2010_2013, does not work in PowerShell for the 2016 Exchange Server product. The MSExchange:2013:AdminAudit sourcetype will not display in Splunk platform searches.