Microsoft 365 Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

Microsoft's 365 provides cloud-based office apps like Word, Excel, and others. Microsoft 365 Spotlight for Illuminate works with the Microsoft 365 Log Events Enterprise Plugin to process Microsoft 365 logs by providing normalization and enrichment of common events. The Spotlight comes ready to use with several pre-built dashboard views including Microsoft 365 Overview and tabs for Exchange, Azure Active Directory, and other Microsoft 365 applications.

Supported Version(s)

• The current Microsoft 365 version supported by Microsoft and the Microsoft 365 Log Events Enterprise Plugin.

Requirements

• A configured Azure / Microsoft 365 tenant and API keys

• A configured Microsoft 365 input

Stream Configuration

This technology pack includes 1 stream:

• "Illuminate:O365 Messages"

Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 1 index set definition:

• "Microsoft Office365 Event Log Messages"

Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

Log Format Example

{"CreationTime":"2021-10-03T00:14:46","Id":"bee3fdad-4243-8f3b-f234-15c294843741","Operation":"SearchMtpStatus","OrganizationId":"bee3fdad-4243-8f3b-f234-15c294843742","RecordType":52,"UserKey":"NOT-FOUND","UserType":5,"Version":1,"Workload":"SecurityComplianceCenter","UserId":"NOT-FOUND","AadAppId":"bee3fdad-4243-8f3b-f234-15c294843740","DataType":"MtpStatus","DatabaseType":"DataInsights","RelativeUrl":"/DataInsights/DataInsightsService.svc/Find/MtpStatus?tenantid=bee3fdad-4243-8f3b-f234-15c294843743","ResultCount":"1"}

What is Provided

• Parsing rules to extract Microsoft 365 logs into schema-compatible fields.

• GIM event type categorization and enforcement fields for supported Microsoft 365 events.

Log Collection

Configuring an Microsoft 365 Input

1. On the Select Input drop-down menu, select the System menu and then choose Inputs.

2. Select Office 365 Log Events from the Select Input drop-down menu.

3. Click Launch New Input.

4. Assign a node or select Global mode.

5. Set the Title, Directory (tenant) ID, Application (client) ID, Client Secret, and Subscription Type to correct values for your Microsoft 365 tenant.

6. Click Verify Connection & Proceed.

7. Specify the desired Content Types. Options include: AZURE_ACTIVE_DIRECTORY, SHAREPOINT, EXCHANGE, GENERAL, and DLP_ALL.

8. Set the polling interval. (Recommended to start with a polling interval of 3 minutes for the System Log API used by the Microsoft 365 Log Events plugin.)

9. This step is optional: Select Store Full Message. (This option consumes additional ingestion volume and storage requirements but may be required for compliance or other reasons.)

10. Save the input settings.

11. If the input does not start automatically, select Start Input to begin retrieving and processing messages from the configured Microsoft 365 tenant.

GIM Categorization

GIM categorization is provided for the following messages: