EWS for Office 365

This app ingests emails from a mailbox in addition to supporting various investigative and containment actions on an Office 365 serviceBuilt by Splunk LLC

Default Version 2.15.7

February 20, 2026

Compatibility

SOAR On-Prem, SOAR Cloud

Platform Version: 8.7, 8.6, 8.5, 8.4, 8.0, 7.2, 7.1, 7.0, 6.4, 6.3, 6.2

Rating

(0)

Support

Splunk Supported

Ranking

#5 in Email

This app ingests emails from a mailbox in addition to supporting various investigative and containment actions on an Office 365 service

Supported actions

test connectivity: Validate the asset configuration for connectivity
run query: Search emails
delete email: Delete emails
copy email: Copy an email to a folder
move email: Move an email to a folder
block sender: Add the sender email into the block list
unblock sender: Remove the sender email from the block list
get email: Get an email from the server
list addresses: Get the email addresses that make up a Distribution List
lookup email: Resolve an Alias name or email address, into mailboxes
update email: Update an email on the server
trace email: Get message trace from the server
on poll: Action handler for the ingest functionality