SIEM – Undocumented Features

Scripting

Searching the Office 365 Unified Audit Log for Specific Activities, Sites, and Users

Posted on January 18, 2019
by Aaron Guilmette

Last week, I was working with a large government customer in a consolidated tenant (read: all agencies in a single, centrally-managed tenant). One of the questions that was presented was how to search and filter the audit log for entries relating to the following categories:

Files shared by an agency or department’s users
Files accessed in an agency’s SharePoint site collection

To that end, I based together this script. … [ Continue reading ]

Configuration

Connecting Splunk to Office 365 – Part 2: Microsoft Office 365 Reporting Add-On for Splunk

Posted on May 6, 2018October 3, 2018
by Aaron Guilmette

In Part 1 of this blog series, I went through the setup of the Splunk Add-On for Microsoft Cloud Services, which you can use to extract, query, and analyze data provided by the Office 365 Management Activity API. … [ Continue reading ]

Configuration

Connecting Splunk to Office 365 – Part 1: Add-On for Microsoft Cloud Services

Posted on May 4, 2018October 3, 2018
by Aaron Guilmette

I’ve had a number of customers ask me about configuring their monitoring systems to Office 365. So, rather than repeating the same information and re-issuing the same links (most of which contain outdated information), I’m going to put together a series on how to connect a few systems to Office 365. … [ Continue reading ]