Splunk Enterprise

How to configure REST API endpoints to fetch data from Office 365 Admin Centre?


Hi All,

I am trying to configure REST API endpoints to fetch data from office 365 Admin Center. I am trying to do that via Splunk Add-On for Microsoft Office 365. (Please let me know if I am doing it wrong because I don't see any Splunk document that say how to configure REST endpoints to fetch Admin Center data).

So far I have got the tenant created and this is able to access the APIs.

My question is where do I configure the endpoints or what input type and content type should I select on Splunk Add-On for Microsoft Office 365  as I don't see an option to add the endpoints anywhere in the TA? Also, is there any other way to configure this?

Thanks in advance for your help and suggestions!! Apologies for not being able to share any screenshots due to security concerns.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...