{ "name": "o365", "title": "Microsoft Office 365", "version": "2.12.0", "release": "ga", "description": "Collect logs from Microsoft Office 365 with Elastic Agent.", "type": "integration", "download": "/epr/o365/o365-2.12.0.zip", "path": "/package/o365/2.12.0", "icons": [ { "src": "/img/logo-integrations-microsoft-365.svg", "path": "/package/o365/2.12.0/img/logo-integrations-microsoft-365.svg", "title": "Microsoft Office 365", "size": "216x216", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "productivity_security" ], "signature_path": "/epr/o365/o365-2.12.0.zip.sig", "format_version": "3.2.3", "readme": "/package/o365/2.12.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/filebeat-o365-audit.png", "path": "/package/o365/2.12.0/img/filebeat-o365-audit.png", "title": "Office 365 Dashboard", "size": "1924x1409", "type": "image/png" }, { "src": "/img/filebeat-o365-azure-permissions.png", "path": "/package/o365/2.12.0/img/filebeat-o365-azure-permissions.png", "title": "Azure Permissions", "size": "2660x1030", "type": "image/png" } ], "assets": [ "/package/o365/2.12.0/LICENSE.txt", "/package/o365/2.12.0/changelog.yml", "/package/o365/2.12.0/manifest.yml", "/package/o365/2.12.0/validation.yml", "/package/o365/2.12.0/docs/README.md", "/package/o365/2.12.0/img/filebeat-o365-audit.png", "/package/o365/2.12.0/img/filebeat-o365-azure-permissions.png", "/package/o365/2.12.0/img/logo-integrations-microsoft-365.svg", "/package/o365/2.12.0/kibana/tags.yml", "/package/o365/2.12.0/data_stream/audit/manifest.yml", "/package/o365/2.12.0/data_stream/audit/sample_event.json", "/package/o365/2.12.0/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json", "/package/o365/2.12.0/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json", "/package/o365/2.12.0/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json", "/package/o365/2.12.0/kibana/tag/o365-security-solution-default.json", "/package/o365/2.12.0/data_stream/audit/fields/agent.yml", "/package/o365/2.12.0/data_stream/audit/fields/base-fields.yml", "/package/o365/2.12.0/data_stream/audit/fields/beats.yml", "/package/o365/2.12.0/data_stream/audit/fields/fields.yml", "/package/o365/2.12.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/o365/2.12.0/data_stream/audit/agent/stream/o365audit.yml.hbs", "/package/o365/2.12.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "o365", "title": "Office 365 logs", "description": "Collect logs from Office 365", "inputs": [ { "type": "o365audit", "title": "Collect Office 365 audit logs - Deprecated. Please disable this and use the CEL input instead.", "description": "Collect audit logs from Office 365 via the Management Activity API using Filebeat's O365Audit Input" }, { "type": "cel", "title": "Collect Office 365 audit logs via Management Activity API using CEL Input", "description": "Collect audit logs from Office 365 via the Management Activity API using CEL Input" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "o365.audit", "title": "Microsoft Office 365 audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "Base URL of Office Management API", "multi": false, "required": false, "show_user": true, "default": "https://manage.office.com" }, { "name": "interval", "type": "text", "title": "Interval", "description": "How often the API is polled, supports seconds, minutes and hours.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "azure_tenant_id", "type": "text", "title": "Directory (tenant) ID", "description": "Directory (tenant) ID", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Application (client) ID", "description": "Client ID used for Oauth2 authentication", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client secret used for Oauth2 authentication", "multi": false, "required": true, "show_user": true }, { "name": "token_url", "type": "text", "title": "Oauth2 Token URL", "description": "The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Azure Tenant ID` will be used for oauth2 token generation. Default value - `https://login.microsoftonline.com`", "multi": false, "required": false, "show_user": true, "default": "https://login.microsoftonline.com" }, { "name": "token_scopes", "type": "text", "title": "Token Scopes", "description": "Scopes for OAuth2 token.", "multi": true, "required": true, "show_user": false, "default": [ "https://manage.office.com/.default" ] }, { "name": "content_types", "type": "text", "title": "Content Type", "description": "Comma seperated list of content types to fetch from Management API. \nSupported content types are - `Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All`.\n\nMore information can be found in the [documentation](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api).\n", "multi": false, "required": true, "show_user": true, "default": "Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "Initial interval for the first API call. Default starts fetching events from 167h55m, i.e., 7 days ago. This value should not be more than this and will be cut to 167h55m if it is. Supports following suffixes - \"h\" (hour), \"m\" (minute), \"s\" (second), \"ms\" (millisecond), \"us\" (microsecond), and \"ns\" (nanosecond)", "multi": false, "required": true, "show_user": true, "default": "167h55m" }, { "name": "batch_interval", "type": "text", "title": "Batch Interval", "description": "Interval for each API request. The default fetches a single hour of events for each request. This value may not be more than 24h. Supports following suffixes - \"h\" (hour), \"m\" (minute), \"s\" (second), \"ms\" (millisecond), \"us\" (microsecond), and \"ns\" (nanosecond)", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "resource_ssl", "type": "yaml", "title": "Resource SSL Configuration", "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc, more examples found in the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config)", "multi": false, "required": false, "show_user": false }, { "name": "resource_timeout", "type": "text", "title": "Resource Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. Default is \"30\"s.", "multi": false, "required": false, "show_user": false, "default": "60s" }, { "name": "resource_proxy_url", "type": "text", "title": "Resource Proxy", "description": "This specifies proxy configuration in the form of `http[s]://:@:`.", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "The maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "The minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "The maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_redirect_forward_headers", "type": "bool", "title": "Resource Redirect Forward Headers", "description": "When set to true resource headers are forwarded in case of a redirect. Default is \"false\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_redirect_headers_ban_list", "type": "text", "title": "Resource Redirect Headers Ban List", "description": "When Redirect Forward Headers is set to true, all headers except the ones defined in this list will be forwarded. All headers are forwarded by default.", "multi": true, "required": false, "show_user": false }, { "name": "resource_redirect_max_redirects", "type": "text", "title": "Resource Redirect Max Redirects", "description": "The maximum number of redirects to follow for a resource. Default is \"10\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_rate_limit_limit", "type": "text", "title": "Resource Rate Limit", "description": "The value of the response that specifies the total limit.", "multi": false, "required": false, "show_user": false }, { "name": "resource_rate_limit_burst", "type": "text", "title": "Resource Rate Limit Burst", "description": "The maximum burst size. Burst is the maximum number of resource requests that can be made above the overall rate limit.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "o365-cel" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Office 365 audit logs via the Management Activity API using CEL Input", "description": "Collect audit logs from Office 365 via the Management Activity API via CEL Input", "enabled": true, "ingestion_method": "API" }, { "input": "o365audit", "vars": [ { "name": "application_id", "type": "text", "title": "Application (client) ID", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client secret (API key)", "multi": false, "required": false, "show_user": true }, { "name": "certificate", "type": "text", "title": "Path to certificate file", "multi": false, "required": false, "show_user": true }, { "name": "key", "type": "text", "title": "Path to private key file", "multi": false, "required": false, "show_user": true }, { "name": "key_passphrase", "type": "password", "title": "Private key passphrase", "multi": false, "required": false, "show_user": true }, { "name": "tenants", "type": "text", "title": "Directory (tenant) IDs", "multi": true, "required": true, "show_user": true, "default": [ "tenant-id" ] }, { "name": "tenant_names", "type": "text", "title": "Directory (tenant) domains mapping", "multi": true, "required": true, "show_user": true, "default": [ "tenant-id: domain-name" ] }, { "name": "content_type", "type": "text", "title": "Content types", "multi": true, "required": true, "show_user": true, "default": [ "Audit.AzureActiveDirectory", "Audit.Exchange", "Audit.SharePoint", "Audit.General", "DLP.All" ] }, { "name": "api", "type": "yaml", "title": "Advanced API settings", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "o365-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false, "default": "#- add_fields:\n# target: foo\n# fields:\n# bar: baz" } ], "template_path": "o365audit.yml.hbs", "title": "Collect Office 365 audit logs - Deprecated. Please disable this and use the CEL input instead.", "description": "Collect audit logs from Office 365 via the Management Activity API using Filebeat's O365Audit Input", "enabled": false, "ingestion_method": "API" } ], "package": "o365", "path": "audit" } ] }