Adapt the information in my logs to the CIM model so that the data models work

[jo54]

For example, one field of the email data model is "recipient" and it comes from the tag=email.

However, my email information comes from the Microsoft O365 integration, where the recipient information is given in a field called "ExchangeDetails.Recipients{}".

As far as I have been able to understand, I have to modify the "email" tag, in "Event Types" to look in "index=o365 Workload=Exchange" for email related logs. And after that, I have to create an alias so that "ExchangeDetails.Recipients{}" is equivalent to "recipient" as indicated in the data model.

Is that correct?

Thank you for your assistance

[venkatasri]

Hi @jo54 

You are correct change the event_type with MS 365 email logs for tag=email and alias it to receipient should work fine.