Microsoft Office 365
The IBM QRadar DSM for Microsoft Office 365 collects events from Microsoft Office 365 online services.
Specification | Value |
---|---|
Manufacturer | Microsoft |
DSM name | Microsoft Office 365 |
RPM file name | DSM-MicrosoftOffice365-QRadar_version-build_number.noarch.rpm |
Supported versions | N/A |
Protocol | Office 365 REST API |
Event format | JSON |
Recorded event types | Exchange Audit, SharePoint Audit, Azure Active Directory Audit |
Automatically discovered? | No |
Includes identity? | No |
Includes custom properties? | No |
More information | Microsoft website (https://www.microsoft.com) |
- If automatic updates are not enabled, download and install the most recent version of the
following RPMs from the IBM® Support Website onto your QRadar
Console.
- Protocol Common RPM
- Office 365 REST API Protocol RPM
- Microsoft Office 365 DSM RPM
- Configure a Microsoft Office 365 account in the Microsoft Azure portal.
- Add a Microsoft Office 365 log source on the QRadar
Console. For more information about
adding a log source, see the Adding a log source topic. The following table
describes the log source parameters that require specific values for Microsoft Office 365 event collection:
Table 2. Microsoft Office 365 log source parameters Parameter Value Log Source type Microsoft Office 365 Protocol Configuration Office 365 REST API Log Source Identifier A unique identifier for the log source.
The Log Source Identifier can be any valid value and does not need to reference a specific server. The Log Source Identifier can be the same value as the Log Source Name. If you configured multiple Microsoft Office 365 log sources, you might want to identify the first log source as MSOffice365-1, the second log source as MSOffice365-2, and the third log source as MSOffice365-3.
Client ID In your application configuration of Azure Active Directory, this parameter is under Client ID. Client Secret In your application configuration of Azure Active Directory, this parameter is under Value. Tenant ID Used for Azure AD authentication. Event Filter The type of audit events to retrieve from Microsoft Office.- Azure Active Directory
- Exchange
- SharePoint
- General
- DLP
Use Proxy For QRadar to access the Office 365 Management APIs, all traffic for the log source travels through configured proxies.
Configure the Proxy Server, Proxy Port, Proxy Username, and Proxy Password fields.
If the proxy does not require authentication, keep the Proxy Username and Proxy Password fields empty.
EPS Throttle The maximum number of events per second that QRadar ingests.
If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle.
Show Advanced Options Show optional advanced options for event collection. The Advanced Options values are in effect whether they are shown or not. Management Activity API URL Specify the Office 365 Management Activity API URL. Default is https://manage.office.com. Azure AD Sign-in URL Specify the Azure AD sign-in URL. Default is https://login.microsoftonline.com. - Test the connectivity to the Office365 log source. Follow the instructions in Testing log sources.