Getting Data In

o365 message trace - delay throttle 24 hrs, no bueno - help

angelo
Engager

"The new Office 365 message trace logs have a delay throttle of 24 hours. I believe I understand the reasons behind this decision. Real-time information is important for SOC (Security Operations Center), and having a 24-hour gap in real-time data is a critical issue. One potential solution is to implement two Office 365 add-ons: one configured with the recommended settings and the other with the minimum possible delay time. Does this proposal make sense to anyone, and are there any associated risks?" Thank you for the help. 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @angelo,

I found this issue, but it's withour solution because the problem is in the Microsoft source: they don't want to send report data in real time or with a little delay.

It isn't possible to solve the issue also asking to Splunk PS (I did it).

If you ask to Microsoft they answer: "ask to Splunk"!

because Splunk is a compatitor for they cloud services.

Ciao.

Giuseppe

View solution in original post

emlin_charly
Loves-to-Learn

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj98...

 

The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours.

0 Karma

angelo
Engager

@gcusello Thank you for the quick reply on this, appreciated. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @angelo,

I found this issue, but it's withour solution because the problem is in the Microsoft source: they don't want to send report data in real time or with a little delay.

It isn't possible to solve the issue also asking to Splunk PS (I did it).

If you ask to Microsoft they answer: "ask to Splunk"!

because Splunk is a compatitor for they cloud services.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...