Splunk Add-on for Microsoft Office 365

Overview

Details

The Splunk Add-on for Microsoft Office 365 allows a Splunk software administrator to pull service status, service messages, and management activity logs from the Office 365 Management API. You can collect:

* Audit logs for Azure Active Directory, Sharepoint Online, and Exchange Online, supported by the Office 365 Management API.
* Historical and current service status, and service messages for the corresponding Microsoft Office 365 Management API.
* Data Loss Prevention on Microsoft Office 365 Management API.

After the Splunk platform indexes the events, you can then directly analyze the data or use it as a contextual data feed to correlate with other data in the Splunk platform

Release Notes for this add-on are available at https://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes

Note: If you are running this add-on with Debian or Ubuntu Linux Server, you must set the option start_by_shell = false in each stanza of inputs.conf. See http://docs.splunk.com/Documentation/AddOns/released/MSO365/Troubleshooting

Release Notes

Version 4.5.1

Feb. 20, 2024

Version 4.5.0

Jan. 25, 2024

Version 4.4.0

Dec. 19, 2023

Version 4.3.0

April 20, 2023

Version 4.1.1

Jan. 24, 2023

Version 4.2.1

Dec. 23, 2022

Version 4.2.0

Oct. 22, 2022

Version 4.1.0

Aug. 2, 2022

Version 4.0.0

May 19, 2022

For more information on this release please visit:

https://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes

Version 3.0.0

Feb. 11, 2022

Version 3.0.0 of the Splunk Add-on for Microsoft Office 365 has the following new features.

Changed from using the Service Communications API (now deprecated by Microsoft) to using the new Microsoft Graph API for Service Health & Communication events. This new API changes the structure how data is ingested by the Splunk software. The following source types have had to be updated:

   Retired source types:
      o365:service:status 
      o365:service:message
   New source types:
      o365:service:healthIssue
      o365:service:updateMessage

To learn about the type of data these new source types represent coming through the Graph API, see the Overview for accessing service health and communications in Microsoft Graph topic in the Microsoft's Graph API documentation.

Enhanced the Add Input menu for ease of use. This menu includes the new Microsoft Graph API for Service Health & Communic
Added API request throttling when making too many requests to the Microsoft APIs.

90,167

Downloads

Share Subscribe

Version

Built by

Splunk Inc.

Support

Splunk Supported Questions on Splunk Answers File a case Flag as inappropriate

App Contents: Inputs