Cribl

Source

Office 365 Management Activity

Retrieve events from Office 365 and Azure AD activity logs

You can use the Microsoft Office 365 Management Activity API to retrieve information about user, admin, system, and policy actions and events from Office 365 and Azure Active Directory audit and activity logs. This information can be fed to monitoring, analysis, and data visualization solutions that offer organizations greater visibility into actions taken on their content.

How to get data flowing

This is a built-in integration through the Cribl Stream’sOffice 365 Activity Source.

  • Configure Stream to receive data from the Office 365 Management Activity API via Sources > Office 365 Activity.

  • Specify the Office 365 Azure Tenant ID, App ID, Client Secret, subscription plan, and content types and poll intervals, along with optional parameters.

  • Stream will start receiving Office 365 data as it becomes available.

View Documentation

Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. Customers use Cribl’s suite of products to collect, process, route, and analyze all IT and security data, delivering the flexibility, choice, and control required to adapt to their ever-changing needs.

We offer free training, certifications, and a free tier across our products. Our community Slack features Cribl engineers, partners, and customers who can answer your questions as you get started and continue to build and evolve. We also offer a variety of hands-on-Sandboxes for those interested in how companies globally leverage our products for their data challenges.