azger.blogg.se

Click to give permission to Sumo Logic to collect Microsoft 365 logs. If you are not parsing all sources in the hosted collector with the same parser, click +Add Field and add a field named _parser with value /Parsers/System/Microsoft/Office 365.If you have not configured the Hosted Collector to forward all sources in the collector to CSE, click the +Add Field link, and add a field whose name is _siemForward and value is true.To configure Microsoft office 365 audit source, see Configure a Microsoft Office 365 Audit source.It’s also possible to configure individual sources to forward to CSE, as described in the following section. If all sources in this collector will be Microsoft 365 sources, add an additional field with key _parser and value /Parsers/System/Microsoft/Office 365.This will cause the collector to forward all of the logs collected by all of the sources on the collector to CSE. If you are planning that all the sources you add to this collector will forward log messages to CSE, click the +Add Field link, and add a field whose name is _siemForward and value is true.To create a new hosted collector, see Configure a Hosted Collector.Otherwise, create a new collector as described in Configure a hosted collector below, and then create the Microsoft 365 Audit Source on the collector. If you’re going to use an existing collector, jump to Configure Microsoft 365 Audit Source below. You can configure the source on an existing Hosted Collector or create a new collector. In this step, you configure an Microsoft 365 Audit Source to collect Microsoft 365 log messages. Note that the permissions this role grants are only necessary to complete the configuration of the Microsoft 365 Audit Source, not for actual ingestion of logs. To ensure you have the appropriate Microsoft permissions when configuring the source, that page suggests using Microsoft's Global Administrator role. Step 1: Configure Microsoft 365 ​īefore configuring a Sumo Logic collector and source, ensure that the requirements described in the Microsoft Office 365 Audit Source topic have been met. This topic has instructions for collecting Microsoft 365 audit logs and sending them to Sumo Logic to be ingested by CSE. Microsoft 365 Audit (Office 365 Audit) - Cloud SIEM