Office 365 Security & Compliance Logs into Splunk

[anandhalagarasa]

Hi Team,

We have a requirement to ingest Office 365 Security & Compliance data into Splunk Cloud. So kindly let us know do we have any Add-on or app to ingest those logs into Splunk Cloud.

If yes, then kindly provide the app or add-on information so that we will configure the same into Splunk Cloud.

And also if you have any document for it then kindly share it.

[woodcock]

This will help a bunch:
http://bit.ly/Splunk_Azure_Permissions

[burakcinar]

Hi ,
did you try this add-on Microsoft Graph Security API ? it has nice features for ingest all security alerts.

link;
https://splunkbase.splunk.com/app/4564/

[anandhalagarasa]

Can anyone help on my query.

[lmethwani_splun]

MS Office 365 is configured via Azure portal right?

[lmethwani_splun]

You can configure the app and add-on

App https://splunkbase.splunk.com/app/3786/
Add on to pull the logs via Microsoft management APIs: https://splunkbase.splunk.com/app/4055/

Please make sure to install the required apps/TAs mentioned in Details section.
Ref Doc for configuring the add-on: https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD