Monitoring Splunk

Office 365 Administrator Audit Logs - How can I index them via script?

cmaier
Explorer

Just curious if anyone out there has had any experience getting their Office 365 Administrator Audit Logs into Splunk. They are easily downloadable via the ECP, but I'm looking to script something through PowerShell and have it grab the logs automagically.

Tags (1)
0 Karma

janetlavell
Engager

Hi,

We have just build a tool to do that and then some more...
SkyFormation Extend (c) for Splunk extracts security events from multiple business cloud applications (e.g. Salesforce, Google App, ServiceNow, Office 365,AWS,...) and transforms them into a unified and actionable stream of events sent to your Splunk or other SIEM solution of your choice.

No more cloud applications integration or classification worries, and all in unified form for easiest correlations and investigation across cloud apps.

SkyFormation is a Java app you can install at on-premise on any machine you want, and it will take you 5 minutes to set it up.

Please have a look at:
https://splunkbase.splunk.com/app/2932/

Feel more then welcome to ask me any question at support@skyformation.com

Best
Janet
www.skyformation.com

wbfoxii
Communicator

I'll be watching this very closely. I'm in the same state.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...