Microsoft 365 App for Splunk
Overview
Details
https://splunkbase.splunk.com/app/4055/
Dashboards:
- Azure Active Directory
- User Audit dashboard
- Exchange
- SharePoint
- OneDrive
- Microsoft Teams
- Power BI
- Full step-by-step data onboarding guide
It is anticipated that future versions may include additional dashboards and data from other Microsoft 365 services.
v3.0.1 removes support for O365 management data ingested using the Microsoft Cloud Services Add-on.
O365 data should be ingested using the official Splunk Add-on for Microsoft Office 365: https://splunkbase.splunk.com/app/4055/
This app only supports the following sourcetype: o365:management:activity
Updates:
- Full step-by-step onboarding guide for configuring an Azure App Registration and the O365 Add-on
- Dark mode default for all dashboards
- New Security & Compliance Center dashboard
- Fixes to Service Status panels
- Minor changes to other dashboards
- Note: A bug was identified with the M365 user audit dashboard. The user dropdown search has a static date set. This will be resolved in 3.0.2. Change the search period to something more suitable for the dashboard to work.
Requirements:
This version leverages additional visualisations that do not ship with Splunk Enterprise. For the best experience, please also install the following visualisations:
Sankey Diagram: https://splunkbase.splunk.com/app/3112/
Timeline: https://splunkbase.splunk.com/app/3120
Semicircle Donut: https://splunkbase.splunk.com/app/4378
Note: These are not explicitly required, however certain panels will need to be modified to leverage the standard visualisations.
To provide feedback or enhancement requests please contact me: ry@splunk.com and/or submit a question on Splunk Answers: http://answers.splunk.com/answers/app/3786
Use of this app is permitted subject to your obligations, including data privacy obligations, under your agreement with Splunk and Splunk's Privacy Policy. https://www.splunk.com/en_us/legal/privacy/privacy-policy.html
Release Notes
Version 3.0.1
v3.0.1 removes dashboard support for M365 management data ingested using the Microsoft Cloud Services Add-on.
If your sourcetype is "ms:o365:management", you must migrate your inputs to the official Splunk Add-on for Microsoft Office 365: https://splunkbase.splunk.com/app/4055/
Updates:
- New Security & Compliance Center dashboard
- Full step-by-step onboarding guide for configuring an Azure App Registration and the O365 Add-on
- User Audit search
- Dark mode default for all dashboards
- Updated searches to include default index macro. Edit the m365_default_index macro to include your M365 index.
Requirements:
This version uses additional visualisations that do not ship with Splunk Enterprise. For the best experience, install the following visualisations:
Sankey Diagram: https://splunkbase.splunk.com/app/3112/
Timeline: https://splunkbase.splunk.com/app/3120
Semicircle Donut: https://splunkbase.splunk.com/app/4378
Note: These are not explicitly required, however certain panels will need updating.
Version 2.0.2
2.0.2
Fixed broken image links