Getting Data In

Onboarding local MS Exchange Server with audit and activity data like O365?

ojay
Path Finder

Hi all,

i have already integrated O365 using the O365 management API and collecting the user, admin, system, and policy actions and events for O365

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

I want to collect similar data from a local exchange server now but I don't know the logs. 

The Splunk Add-on for Microsoft Exchange collects the following data using scripted inputs:

  • Senderbase/reputation data. , Topology and Health information and Mailbox Server health and usage information

Is there even similar data on a local MS exchange? and is that data no possible to be collected with a UF?

Any help to direct me in the right direction would help.

Best,

N.

Labels (3)
0 Karma

aokur_splunk
Splunk Employee
Splunk Employee

Older question - but this still came up as a hit on my search results while trying to help another customer, so this might be useful here.

You have to run (or let the splunk agent run and manage) the monitors and scripts responsible for monitoring exchange related logs. To start - I would locally (like to your laptop) download the Add-On, https://splunkbase.splunk.com/app/3225

From there, explore the inputs.conf configurations available in the subdirectories. These define what is to be collected. If you notice, there are a ton of inputs available. These are set to OFF by default. Let's take a look at one of them under \TA-Windows-Exchange-IIS\default\inputs.conf

####Exchange Server Version 2010 - Start####

[monitor://C:\Program Files\Microsoft\Exchange Server\V14\Logging\Ews]
whitelist=\.log$|\.LOG$
sourcetype=MSWindows:2010EWS:IIS
queue=parsingQueue
index=msexchange
disabled=true
initCrcLength=8192

The monitor stanza is defining the location of the path - so in this case, the files are stored in that file path (...\logging\EWS). The whitelist/allowist statement specifies that all files in that directory ending in .log or .LOG are to be allowed. The 'disabled' statement is currently set to false, as per the default. 

To get this working, copy this stanza to a /local/inputs.conf directory, change disabled to '=false' and deploy to the machine that is running exchange. You will need a a UF, or Heavy Forwarder or some other way to getting data to splunk indexers.

Use a similar process for the many other inputs you have available.  Do not turn on all inputs unless you really need them and have done capacity planning as it can be a lot of volume. 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...