Hey @Wiessiet  I will try and screenshot this and work through it this evening and get back to you on here as I dont currently have access to the env I set it up on.   ... View more

re @Wiessiet I also looked at that for a while and found these 2 articles which helped me:  https://www.michev.info/blog/post/3180/exchange-api-permissions-missing https://www.michev.info/blog/post/4067/modern-authentication-oauth-support-for-the-reporting-web-service-in-office-365   In short, these are the steps: To get there, App Registrations -> Select our app -> API permissions Then Add a permission -> go to APIs my organization uses -> paste: Office 365 Exchange Online -> Click the Office 365 Exchange Online API section -> then Application permissions Paste the ReportingWebService.Read.All permissions and tick it + approve afterwards. It took me a while as well.  + the Global reader permission addition from Roles & admins -> Global Reader -> add assignments  -> paste the app name and  grant your app the role rights...  https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal ... View more

I never did, no, but I went forward with configuring this myself. I run a test environment for Splunk, so I was able to confirm that there didn't seem to be any adverse affects from running the sensor on my hosts. Since deploying it in production I've had zero issues and zero detections of any kind. I created a dedicated host group with tags to manage my Splunk environment separately (if necessary) but I haven't had to. I have pretty default linux sensor settings and it has been working fine. I'm happy to share any specific configurations I have in place if you need any guidance. ... View more

We are having the same issue with the message "There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and DA-ITSI-DATABASE" Have you managed to install Essentials Work? ... View more