Getting Data In

o365 message trace - delay throttle 24 hrs, no bueno - help

angelo
Engager

"The new Office 365 message trace logs have a delay throttle of 24 hours. I believe I understand the reasons behind this decision. Real-time information is important for SOC (Security Operations Center), and having a 24-hour gap in real-time data is a critical issue. One potential solution is to implement two Office 365 add-ons: one configured with the recommended settings and the other with the minimum possible delay time. Does this proposal make sense to anyone, and are there any associated risks?" Thank you for the help. 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @angelo,

I found this issue, but it's withour solution because the problem is in the Microsoft source: they don't want to send report data in real time or with a little delay.

It isn't possible to solve the issue also asking to Splunk PS (I did it).

If you ask to Microsoft they answer: "ask to Splunk"!

because Splunk is a compatitor for they cloud services.

Ciao.

Giuseppe

View solution in original post

emlin_charly
Loves-to-Learn

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj98...

 

The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours.

0 Karma

angelo
Engager

@gcusello Thank you for the quick reply on this, appreciated. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @angelo,

I found this issue, but it's withour solution because the problem is in the Microsoft source: they don't want to send report data in real time or with a little delay.

It isn't possible to solve the issue also asking to Splunk PS (I did it).

If you ask to Microsoft they answer: "ask to Splunk"!

because Splunk is a compatitor for they cloud services.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...