AnsweredAssumed Answered

Office 365 Log Collecting/Rules

Question asked by Ernie Castro on Mar 3, 2020
Latest reply on Jul 8, 2020 by Lawrence Khoo Kay Kheng

Like • Show 1 Like1
Comment • 4

I recently integrated Office 365 logs into NetWtiness. I installed all 5 parser packs and everything works fine.

I want to set up dashboards and enable some rules and would like to know a good baseline to start.

Has anyone made Office 365 dashboards? What do they display and what are some specific things to look for?

Are my current rules going to trigger from these cloud log sources even though the event types are different or do i need to implement a whole new set of rules for Office 365?

Any info from anyone collecting logs from Office 365 would be great, thank you!

2 people also have this question

Outcomes

4 Replies

Erica Chalfin Mar 3, 2020 10:03 AM
Mark Correct
Correct Answer
Ernie Castro,

I've moved your question to the RSA NetWitness Platform space where it will be seen by the product's support engineers, other customers and partners. Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Customer Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question. From there, scroll to RSA NetWitness Platform and click Ask A Question. That way your question will appear in the correct space.

Regards,
Erica
Like • Show 0 Likes0
Actions
Lawrence Khoo Kay Kheng Jul 7, 2020 10:54 PM
Mark Correct
Correct Answer
From where did you check the office365 logs in RSA and know that "everything works fine" ?
I am also currently working on office365 integration , but I can't seem to find any of the office365 logs.
My log collector's log say something about waiting for config on STDIN.
Like • Show 0 Likes0
Actions
- Ernie Castro @ Lawrence Khoo Kay Kheng on Jul 8, 2020 11:38 AM
  Mark Correct
  Correct Answer
  Lawrence, you've completed the setup per the implementation guide yet you don't see "msoffice365" as an event type? (Investigate ->Device Type -> show more -> msoffice365
  
  When you added the Event Source in your log collector, does the test pass??
  Log Collector -> Event Sources ->Event Categories -> Sources
  Like • Show 0 Likes0
  Actions
  - Lawrence Khoo Kay Kheng @ Ernie Castro on Jul 8, 2020 9:45 PM
    Mark Correct
    Correct Answer
    Hi Ernie, yes I followed the Microsoft_Office365 guide from RSA but I don't see msoffice365 as event type.
    Ya, the test pass when I added the event source.
    Are there any more steps that you did that are not stated within the guide?
    
    My log collector's log are spamming messages like "[office365audit.office365] [processing] [WorkUnit] [processing] 2020-07-09T08:01:14Z Office365auditCollector waiting for config on STDIN..."
    
    I am using netwitness 11.4 if that even matters.
    Like • Show 0 Likes0
    Actions

Office 365 Log Collecting/Rules

Outcomes

Related Content

Recommended Content