in this video we send office 365 log data to Splunk hello everyone I'm Travis
and this is Ciraltos in this video we're going to install and configure the
Splunk add-on for Microsoft Office 365 to collect log data then install another
add-on to visualize that data before we get started please take a second to
subscribe click the like button and click the bell icon to get notifications
of new content this helps my channel a lot and it's 100 percent painless also
follow me on Twitter if you're so inclined Microsoft has a lot of native
options for reviewing and alerting on log data in Azure and o365
there's the azure Security Center Azure sentinel log analytics and insight
this is all fine for an azure centric organization but many organizations
already have a logging platform in place it may want to send oh three sixty five
data to that instead of splitting the log data between two applications in
this video we're going to configure Splunk to collect log data from Azure AD
and O365 I'm going to demonstrate Azure activity and login data I'll also
show you how to collect logs from other services such as teams exchange and
SharePoint I have to admit my Splunk skills are not that great the goal of
this video is getting data into Splunk what you do with it once it's there is
up to you however I will install an add-on at the end of the video that
provides a dashboard view of that data I'm starting out with a fresh install of
Splunk and an azure ad tenon this is a test tenant and the data will be kind of
limited but it will get what we need for this video we're going to start by
adding the application to Azure ad and Azure ad application is not what you
would traditionally consider an application
it's the representation of an application that uses Azure ad it's kind
of like a service account in Windows I'm oversimplifying it a little bit but you
get the point the application needs access to the office 365 management API
to read log data we'll set that up after the applications created the next
step is to gather the client ID the application ID and give the application
a password this is needed for the Splunk add-on to authenticate to Azure a/b to
pull the logs once that's finished we go over to Splunk and add the add-on for
Microsoft Office 365 and configure the tenant and log collection in that add-on
after that we wrap up by adding the Microsoft 365 app to Splunk to visualize
the data one more thing quick before we move on
towards the end I show the dashboard the add-on crates for my test tenon there
isn't a lot of data display because there's just not a lot of data in that
tenant if you have some impressive data after setting up logging to Splunk I
would love to see what it looks like if you can share tweet an image and tag me
so I can see it let's get started in the azure portal to set up the application
ok everyone let's get started I am in Splunk and this is a brand new install I
downloaded and installed the trial version I think it's the free version or
I think I get Enterprise for a few days and then it switches to free anyway the
first thing I'm going to do is go to apps and find more apps and I'm gonna
search for Microsoft Office 365
so this Splunk add-on for Microsoft Office 365 that's what we want I'll
click install and it's gonna have me enter my username and password so it's
gonna install the add-on this will take a couple minutes ok it's asking for a
restart Saul restart it now and wait for this to come back its back I'll login
again now you can see a Splunk add-on for Microsoft Office 365 is showing as
an app and there's nothing in here so the first thing we have to do is
configure it and if we go to tenant we need to add our office 365 tenant so if
we go to add tenant it's asking for some information namely
we need a tenant ID a client ID and a client secret so let's hop over to the
office 365 portal and get that set up Here I am at the a 365 portal but you
know what before we do this let's make sure that login is enabled Here I am at
the office portal I signed into portal dothis comm and from there I'm gonna go
to admin you do need to be a global admin to do this if you don't see the
admin button there it's either go to all apps or just make sure that you're
signed in as a global admin I'm gonna go to show all security and search and
under search audit log search now if you don't have audited abled you'll see a
button up here that indicates you need to turn it on
I do have audited enabled I know that so I don't have the button but if you don't
turn on audit logging here you won't get any logs going to Splunk because logging
won't be enabled okay so that's set let's go back to here I'm at portal
eurocom and I'm in Azure Active Directory and I'm going to go to app
registration I'm gonna go new registration and I'm
going to give it a name I'll call this Blanc logs
we'll leave the account in this organization's directory only and under
the redirect URL it's really not important but you do have to have
something so I'm going to put in HTTP colon localhost and register so that
creates application and I probably mentioned
this already but an application isn't what you would normally think of and as
an application like word or notepad it's actually a the azure ad representation
of an application that will be interacting with the directory so it has
an identity and service permissions associated with that identity so next
I'm going to go to app permissions and this is what's going to give this
application the rights to interact with Azure ad and pull the logs I'm going to
add permission and look for office 365 management api's go to application
permissions and I'm just going to select all of them
notice there's a couple here where it's doubled I'm not quite sure why this is
but these two are the same as well as these two and it's going to give us an
error but it'll still work I'm going to add permissions so we added the
permission but we still need to grant admin consent so I'm going to do that
here and it's gonna warn me and I'm gonna click yes here you can see those
two show an error but it's fine so that application now has rights to
read that so if you remember we needed a couple pieces of information to continue
so I'm going to go up to overview so I need this application ID and I need this
directory ID so what I can do is I know this is blurred out for you but there's
a little copy thing here so I'm gonna copy the application ID I'll just paste
it someplace else and I'll grab the tenant ID or the
directory ID and the other thing I needed was a secret so just like a user
account needs a username and password basically the client ID is like the user
name the directory ID or the tenant is what Azure a B 10 and it's trying to
pull from and we're gonna go to certificates and secrets and I'm gonna
create a new client secret I'll give it a description of Splunk and you can set
it for however long you want it I'm just gonna leave it a year if you do have a
time just keep in mind that once that time expires this password will no
longer work so I'm gonna add now here's the key part to this once I click out of
the screen we won't be able to see this value anymore so I'm gonna copy to
clipboard and I'm gonna paste it someplace if you have a password say for
password management of some sort you might want to put it in there you can
create a new one if you lose this but you cannot get access to this value
again okay so that's how you set up an
application ID and give it rights to the Microsoft Office 365 management API so
let's go back into Splunk and i'm going to give it a name
of my tenant and I'm going to select worldwide and it's going to ask for the
tenant ID client and secret so I'm going to paste those in and add okay so that
did it now let's go to inputs is now that we have the tenant connected we
still have to tell it what logs to pull so I'm going to go to add inputs will do
management activity and I'm going to select my tenant name will select the
content type of audit Azure active directory and I'm going to set it to the
index of main and we'll call this audit Azure ad I'm going to add another will
do exchange again going to the index of main and I'll call it audit exchange go
back to management activity let's see what else we have I'm not going to do
SharePoint or DLP I'm not using SharePoint so there won't be any traffic
and I'm not using DLP either but go ahead and add them if that's in your
environment I'm going to do audit general ad oops there we go select index
main I'm going to go to service status select the tenant and I'll do current
status same index
I'll do it again this time historical status and one more with service message
and AD next I'm gonna run a query against this to see if we have any data
yet just skip that okay so this is good it's returning some information I just
want to point out I did filter out user login because that was cluttering up the
return and also the team session started that was also showing me a lot of
information I didn't need which may not even be in there in this instance
because I didn't set up SharePoint logging but what I want to show is that
we do have a user login failure so that shows we're logging Azure Active
Directory login information and also a service principle was removed which
again shows that it's not just logging user login activity but also Azure ad
management activity those are the two core logs important to logging for Azure
ad is the login information and the in the azure ad activity ok so
unfortunately that's about as deep as I can get into Splunk but I do want to
show a couple other things here so if we go back to Splunk enterprise and i'm
gonna find more apps I'm gonna search for Microsoft 365 so here is the
Microsoft 365 app for Splunk this creates a dashboard with all the data
we're collecting so I'm going to install it'll ask me for a my username and
password again and before I move on I want to go over and open up another page
if we go to the details for that add-on what I want to show here if we scroll
down a little bit there's a requirement for these three other add-ons I'll leave
a link to this in the car but it says that it will work but you
just won't get the full view of what it's doing so I'm going to add these as
well so I'm gonna do a Sand Key diagram
we'll install that one
next is timeline again I'll log in and install and the third one is semicircle
donut and I'll install and let's do done we'll come back up here let's go back to
the home page and see what we got so here's my Microsoft 365 app for
Splunk if I go in we should be able to see some visualizations of the data so
here we go we've got a nice dashboard you can see I've got some login failures
we've got some workload status if I go to a sure ad and login activity I'm
going to switch this to the last week today here's got a little bit more
information you can see primary login is in the Midwest and I've also got one in
France and then one and I forgot where that was but anyway that's you can use a
VPN and make it look like you're logging in from all over the place so there's
other options up here security and compliance I really don't have much else
to show on this but I think you get the idea this is how you both install the
add-ons for both the logging as well as the visualization as well as set up the
azure ad application that allows you to pull the logs from the Microsoft 365
management API I hope this information helps you send log data from 365 and
Azure to Splunk please don't forget to subscribe like and click the bell icon
for new Khan tenth thanks for watching