Comments (3)
chris-counteractive
commented on June 14, 2024
Great question - we definitely get ATP logs through the API subscriptions in the beat, though it looks like E3 doesn't support those events. Per the documentation:
"Office 365 Advanced Threat Protection (ATP) and Threat Investigation and Response events are available for Office 365 customers who have an Office 365 Advanced Threat Protection Plan 1, Office 365 Advanced Threat Protection Plan 2, or an E5 subscription"
As far as I can tell there's no technical limitation, the beat is checking the right API endpoints, so long as you subscribe to the right feeds (which are enabled by default in the beat config). If you find out differently, please let me know and I'll happily re-open the issue.
from o365beat.
CustosClarus
commented on June 14, 2024
Hi Chris,
Thanks for the kind message and apologies for the late reply, was busy due
to religious duties need to be performed in holy month of Ramadan.
The thing is with E3/ P2 EOL plan there is builtin-threat intelligence data
related to exchange security services (spoofing, malware, url) all those
events would be seen on azure dashboard in "security and compliance" but
not exported.
So, using remote PowerShell (exchange) and dumped those records with
cmdlets under "atp" sub-category. Once downloaded they
were ingested back to elastic-pipeline through beats/LS combination.
I think this is inherent design limitation where these events are not
pulled out or lies in scope of o365 api which your script manages or taps.
regards
Asad
…On Sun, May 17, 2020 at 2:16 AM Chris Hendricks ***@***.***> wrote:
Great question - we definitely get ATP logs through the API subscriptions
in the beat, though it looks like E3 doesn't support those events. Per the
documentation
<https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#office-365-advanced-threat-protection-and-threat-investigation-and-response-schema>
:
"Office 365 Advanced Threat Protection (ATP) and Threat Investigation and
Response events are available for Office 365 customers who have an Office
365 Advanced Threat Protection Plan 1, Office 365 Advanced Threat
Protection Plan 2, or an E5 subscription"
As far as I can tell there's no technical limitation, the beat is checking
the right API endpoints, so long as you subscribe to the right feeds (which
are enabled by default in the beat config). If you find out differently,
please let me know and I'll happily re-open the issue.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#46 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3KZGVGAA3P3ICCXUOYEB3RR37DJANCNFSM4M7FZIGQ>
.
from o365beat.
chris-counteractive
commented on June 14, 2024
Asad - thank you for the follow-up, this is helpful to know. As you suggest, these events are likely not part of the Office 365 Management Activities API, and thus outside the scope of the beat. If there were a non-powershell, API-driven way of getting the events you pulled I'd be happy to add that feature to the beat to check those endpoints as well. I'll keep an eye out. Thanks again!
from o365beat.
Related Issues (20)
- Exiting: error loading config file: yaml: line 2: did not find expected node content HOT 5
- Understanding Authentication Data HOT 4
- visualization not working HOT 5
- Client.Timeout for Exchange/General/Sharepoint HOT 6
- Docker Instructions HOT 3
- Parsing Extended Properties HOT 4
- Preventing Duplicate Events HOT 4
- Dashboard and visualizations not working - error with fields.keyword HOT 5
- Logstash connection errors HOT 7
- WARN beater/o365beat.go:249 start XX must be <=YY hrs ago, resetting HOT 3
- Live Realoding Credentials HOT 2
- Proxy support for the API requests HOT 1
- Certificate signed by unknown authority message HOT 2
- AzureActiveDirectory Logs not pulled HOT 3
- Log content changed recently?
- GCC High no available content locations: HOT 1
- Tenant ID not found
- Does O365beat support multiple Office 365 tenants scenario
- Log file is not getting created
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from o365beat.