Microsoft 365 App for Splunk
Overview
Details
Splunk Add-on for Microsoft Office 365 - https://splunkbase.splunk.com/app/4055/
Microsoft 365 Reporting Add-on for Splunk - https://splunkbase.splunk.com/app/3720/
Microsoft Teams Add-on for Splunk - https://splunkbase.splunk.com/app/4994/
Dashboards:
- Azure Active Directory
- User Audit dashboard
- Exchange
- SharePoint
- OneDrive
- Microsoft Teams
- Power BI
- Full step-by-step data onboarding guide
It is anticipated that future versions may include additional dashboards and data from other Microsoft 365 services.
This app only supports data collected using the Splunk Add-on for Microsoft Office 365
If you are still using a legacy version of the Microsoft Cloud Services Add-on to ingest M365 data, it's recommended you use the dedicated O365 Add-on to ensure accuracy of results: https://splunkbase.splunk.com/app/4055/
Requirements:
This version leverages additional visualisations that do not ship with Splunk Enterprise. For the best experience, please also install the following visualisations:
Sankey Diagram: https://splunkbase.splunk.com/app/3112/
Timeline: https://splunkbase.splunk.com/app/3120
Semicircle Donut: https://splunkbase.splunk.com/app/4378
Note: These are not explicitly required, however certain panels will need to be modified to leverage the standard visualisations.
To provide feedback or enhancement requests please contact me: ry@splunk.com and/or submit a question on Splunk Answers: http://answers.splunk.com/answers/app/3786
Use of this app is permitted subject to your obligations, including data privacy obligations, under your agreement with Splunk and Splunk's Privacy Policy. https://www.splunk.com/en_us/legal/privacy/privacy-policy.html
Release Notes
Version 3.2.1
Added support for SSAI for Splunk Cloud SHC.
Version 3.2.0
New dashboards!
Exchange Message Trace:
- Overview
- Audit
- Health
Microsoft Teams call records:
- Call Overview
- Call QoS
- Call Search
- Call Detail
* Teams call record data collected using the Microsoft Teams Add-on for Splunk: https://splunkbase.splunk.com/app/4994/
Version 3.1.4
Bug Fixes:
- Fixed time pickers that were set with static dates. (Teams Overview, etc).
- Updated searches that referenced "user" field with "UserId" instead
Version 3.1.1
v3.1.1
New Dashboards:
M365 Usage & Adoption
Microsoft Teams Overview
Microsoft Teams Security Monitoring
Microsoft Teams Activity Audit
Bug Fixes:
- Fixed time pickers that were set with static dates
- Included default entry "index=*" in `m365_default_index`
- Updated `SharePoint_ObjectSite` macro with better condition match
Version 3.0.1
v3.0.1 removes dashboard support for M365 management data ingested using the Microsoft Cloud Services Add-on.
If your sourcetype is "ms:o365:management", you must migrate your inputs to the official Splunk Add-on for Microsoft Office 365: https://splunkbase.splunk.com/app/4055/
Updates:
- New Security & Compliance Center dashboard
- Full step-by-step onboarding guide for configuring an Azure App Registration and the O365 Add-on
- User Audit search
- Dark mode default for all dashboards
- Updated searches to include default index macro. Edit the m365_default_index macro to include your M365 index.
Requirements:
This version uses additional visualisations that do not ship with Splunk Enterprise. For the best experience, install the following visualisations:
Sankey Diagram: https://splunkbase.splunk.com/app/3112/
Timeline: https://splunkbase.splunk.com/app/3120
Semicircle Donut: https://splunkbase.splunk.com/app/4378
Note: These are not explicitly required, however certain panels will need updating.