Category: SIEM

Searching the Office 365 Unified Audit Log for Specific Activities, Sites, and Users
Scripting

Searching the Office 365 Unified Audit Log for Specific Activities, Sites, and Users

Last week, I was working with a large government customer in a consolidated tenant (read: all agencies in a single, centrally-managed tenant).  One of the questions that was presented was how to search and filter the audit log for entries relating to the following categories:

  • Files shared by an agency or department’s users
  • Files accessed in an agency’s SharePoint site collection

To that end, I based together this script. … [ Continue reading ]

Connecting Splunk to Office 365 - Part 1: Add-On for Microsoft Cloud Services
Configuration

Connecting Splunk to Office 365 – Part 1: Add-On for Microsoft Cloud Services

I’ve had a number of customers ask me about configuring their monitoring systems to Office 365.  So, rather than repeating the same information and re-issuing the same links (most of which contain outdated information), I’m going to put together a series on how to connect a few systems to Office 365. … [ Continue reading ]