How do I pull in logs containing Office 365 email header info into Splunk?

[Deb]

Hello, I use Splunk to look at Office 365 email....but I don't see header info relating to TLS which we are looking for data on.  How do I pull this info into Splunk?  Is it in a different log?  

Thanks

[Roy_9]

Are you using Microsoft O365 Email Add-on for Splunk for these logs?

Try exploring the above package by downloading from splunkbase.

 

[Deb]

Thank you....I'm guessing this is the only way to do it?  Add-on is required?  I see it does offer the ability to look at Auth info as well which we are interested in.  Thanks for the reply.  I'll look into it!!  🙂

[Roy_9 · Accepted solution]

Sure, no problem

Happy Splunking