Cribl

Source

Office 365

Monitor Office 365 and Azure AD audit and activity logs

The Office 365 Management Activity API is used to retrieve information about user, admin, system, and policy actions and events from Office 365 and Azure AD activity logs. You can use the actions and events from the Office 365 and Microsoft Azure Active Directory audit and activity logs to create solutions that provide monitoring, analysis, and data visualization. These solutions give organizations greater visibility into actions taken on their content. These actions and events are also available in the Office 365 Activity Reports.

How to get data flowing

This is a built-in integration between Cribl Stream and the Office 365 Management Activity API.

  • Find the integration in LogStream through Sources > Office 365 Activity.

  • Supply your Tenant ID, App ID and Client Secret.

  • Stream will fetch data on the scheduled interval you’ve configured

View Documentation

Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. Customers use Cribl’s suite of products to collect, process, route, and analyze all IT and security data, delivering the flexibility, choice, and control required to adapt to their ever-changing needs.

We offer free training, certifications, and a free tier across our products. Our community Slack features Cribl engineers, partners, and customers who can answer your questions as you get started and continue to build and evolve. We also offer a variety of hands-on-Sandboxes for those interested in how companies globally leverage our products for their data challenges.