o365audit

Collect logs from Office 365 Audit

Type: o365audit

Sample YAML

sources:
  o365audit_example:
    type: o365audit
    client.id: ''
    tenant.id: ''
    secret.key: ''
    route_label: ''
  # optional:
  #   <key>: <value>

Fields Reference

Below are tables for Base and Optional sections. Columns: Key, Label, Type, Default, Required, Depends on, Enum / Notes.

Base

Key	Label	Type	Default	Required	Enum / Notes	Depends on
client.id	Client ID	string	“”	✅	The unique identifier assigned to your Azure AD application entry.	—
tenant.id	Tenant ID	string	“”	✅	The unique identifier for your Azure AD tenant.	—
secret.key	Secret Key	string	“”	✅	The credential created for your application entry. (Actual key is only shown once upon creation)	—
route_label	Event Routing Label	string	“”	—	The label to use in routing these events to a destination. Defaults to source name-type.	—

Optional

Key	Label	Type	Default	Required	Enum / Notes	Depends on
description	Description	string	“”	—	The description of the entry.	—
poll_schedule	Poll Schedule	string	10m	—	Poll for new audit logs every secs. The format can include a number appended with the unit, d (days), h (hours), m (minutes), s (seconds) or a combination, such as 1h30m.	—
hourstocollect	Hours to Collect	int	24	—	Look back this many hours for audit logs (max supported by Office API is 168). This should be greater than the poll schedule	—
audit.general	Audit General	bool	true	—	Collect Audit General logs.	—
audit.azureactivedirectory	Audit AzureActiveDirectory	bool	true	—	Collect Audit AzureActiveDirectory logs.	—
audit.exchange	Audit Exchange	bool	true	—	Collect Audit Exchange logs.	—
audit.sharepoint	Audit SharePoint	bool	true	—	Collect Audit SharePoint logs.	—
dlp.all	DLP All	bool	true	—	Collect DLP All logs.	—
maxthreads	Max Threads	int	10	—	Maximum number of simultaneous threads retrieving logs.	—