Prevent Splunk alerts from going to quarantine on O365 Exchange Online

[dkr3500]

All of my Splunk alerts and reports are getting quarantined by Microsoft's spam filter, the reason being: "Quarantine reason:
Phish". The alerts are simply sent from "splunk" with no email address associated with it, so I can't even add it to "Safe Senders/Recipients".

[richgalloway · Accepted solution]

You can change your Splunk email settings to have alerts and reports come from an email address.

[dkr3500]

Yes, that did work. On the SH, I went to Settings > Server settings > Email settings > edited the Send emails as field to a proper email address.

As an FYI, you may have to edit savedsearches.conf, specifically the line: "action.email.from = "