o365 message trace - delay throttle 24 hrs, no bueno - help

[angelo]

"The new Office 365 message trace logs have a delay throttle of 24 hours. I believe I understand the reasons behind this decision. Real-time information is important for SOC (Security Operations Center), and having a 24-hour gap in real-time data is a critical issue. One potential solution is to implement two Office 365 add-ons: one configured with the recommended settings and the other with the minimum possible delay time. Does this proposal make sense to anyone, and are there any associated risks?" Thank you for the help. 

[emlin_charly]

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj98...

The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours.

[angelo]

@gcusello Thank you for the quick reply on this, appreciated. 

[gcusello · Accepted solution]

Hi @angelo,

I found this issue, but it's withour solution because the problem is in the Microsoft source: they don't want to send report data in real time or with a little delay.

It isn't possible to solve the issue also asking to Splunk PS (I did it).

If you ask to Microsoft they answer: "ask to Splunk"!

because Splunk is a compatitor for they cloud services.

Ciao.

Giuseppe