Microsoft Office 365 Integration

[SaketBajoria]

Microsoft Office 365 is a Web-based version of Microsoft's Office suite of enterprise-grade productivity applications. Office 365 is delivered to users through the cloud and includes Exchange Online for email, SharePoint Online for collaboration, Lync Online for unified communications, and a suite of Office Web Apps (web-based versions of the traditional Microsoft Office suite of applications).

The Office 365 integration consumes activity logs using the Office 365 Management Activity API. The Office 365 Management Activity API aggregates actions and events into tenant-specific content blobs, which are classified by the type and source of the content they contain. Currently, the following content types are supported by this API:

• Audit.AzureActiveDirectory
• Audit.Exchange
• Audit.SharePoint
• Audit.General (includes all other workloads not included in the previous content types)
• DLP.All (DLP events only for all workloads)

Please note that only the Common schema and Exchange Mailbox schema is supported by default. All other schemas can be added manually as needed. 

Configuration Guide: Microsoft Office 365 

Collector Package on RSA Live: "MS Office 365 Log Collector Configuration"

Parser on RSA Live: CEF

[ChaseMoxley]

I have a question for the configuration parameter part of the guide. 

What should I put for the source address? There are multiple ip addresses related to O365 what should I enter in this field?  

[SaketBajoria]

Currently, O365 doesnt expose the source IP address in the events. You can manually check and provide O365 IP address or a dummy IP to associate it with O365. 

[ThomasJones1]

Couple questions... 1. Do the log collectors initiate the request for logs or is the log data control cycle managed by O365 (Push vs Pull)?  2. Does O365 cloud require Azure (I would think yes)?  3. Are Skype logs part of the Lync infrastructure or are they separate?  Please let us know.

Tom J

[AhteshamPatel]

1. Office365 exposes the logs for the last 7 days through office 365 management api ( if logging has been enabled on Security&Compliance --> Search and investigation --> Audit Log Search). Office365audit plugin queries this api periodically and pulls in the logs. So it is a pull approach.

2. My understanding is that azure active directory subscriptions comes automatically with o365 subscription. For the plugin to work we need to register an app in Azure Active Directory and provide it with the required permissions. So more specifically Azure Active Directory access is required.

3. I believe skype for business is part of Microsoft Teams. Based on Microsoft documentation office 365  management api provides logs for Microsoft Teams.

Office 365 Management Activity API schema | MSDN 

Office 365 Management Activity API reference | MSDN 

[YogeshChandra]

May I know which port number is required to pull the logs?

[AhteshamPatel]

Logs are pulled in using HTTP protocol. 

[AvdootKumbhar]

I am getting attached error while configuring the Office 365 logs. Please help.

[AhteshamPatel]

Resource_group values are one on of “Audit.Exchange”, “Audit.SharePoint”, “Audit.AzureActiveDirectory”, “Audit.General” or “DLP.All”.

In the first error you have not used the correct resource_group name.

[AvdootKumbhar]

Thanks Alot for the reply. Please check I made the changes but getting this error. Please assist.

[AhteshamPatel]

I guess. The application registration step in the event source setup has not been done correctly. Microsoft server is responding that the supplied credentials do not have the required permissions.

[Sebasing]

Hi, I am in versión 11.4.1.2 and when I try to enable the subscription I am getting the following errors:

[root@XXX office365audit]# python SubscribeLogCategory.py -h
ERROR:root:code for hash md5 was not found.
Traceback (most recent call last):
File "<frozen importlib._bootstrap>", line 888, in _find_spec
AttributeError: '_SixMetaPathImporter' object has no attribute 'find_spec'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/rh/rh-python36/root/usr/lib64/python3.6/hashlib.py", line 150, in __get_openssl_constructor
f(usedforsecurity=False)
ValueError: error:3207A06D:lib(50):B_HASH_init:cr new

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/rh/rh-python36/root/usr/lib64/python3.6/hashlib.py", line 274, in <module>
func = __get_hash(__func_name)
File "/opt/rh/rh-python36/root/usr/lib64/python3.6/hashlib.py", line 156, in __get_openssl_constructor
return __get_builtin_constructor(name)
File "/opt/rh/rh-python36/root/usr/lib64/python3.6/hashlib.py", line 136, in __get_builtin_constructor
raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type md5

What should I do?

Thanks.

[PALLAA]

Configuration Guide: Microsoft Office 365