Skip to main content
Sumo Logic

Microsoft 365 Audit (Office 365 Audit)

Configure collection of Microsoft 365 log messages to be parsed by CSE's system parser for Microsoft 365.

Step 1: Configure Microsoft 365

Before configuring a Sumo Logic collector and source, ensure that all prerequisites have been met.

Step 2: Configure CIP collection

In this step, you configure an Microsoft 365 Audit Source to collect Microsoft 365 log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to Configure Microsoft 365 Audit Source below. Otherwise, create a new collector as described in Configure a hosted collector below, and then create the Microsoft 365 Audit Source on the collector.

Configure a Hosted Collector

  1. In Sumo Logic CIP, select Manage Data > Collection > Collection.
  2. Click Add Collector.
  3. Click Hosted Collector.
  4. The Add Hosted Collector popup appears.
    add-hosted-collector.png
  5. Name. Provide a Name for the Collector.
  6. Description. (Optional)
  7. Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called _sourceCategory
  8. Fields
    1. If you are planning that all the sources you add to this collector will forward log messages to CSE, click the +Add Field link, and add a field whose name is _siemForward and value is true. This will cause the collector to forward all of the logs collected by all of the sources on the collector to CSE.
    2. If all sources in this collector will be Microsoft 365 sources, add an additional field with key _parser and value /Parsers/System/Microsoft/Office 365.

Configure Office 365 Audit Source

  1. In the Sumo Logic web app, select Manage Data > Collection > Collection
  2. Navigate to the Hosted Collector where you want to create the source.
  3. Click Add Source next to  the Hosted Collector.
  4. Select Office 365 Audit. 
  5. The page refreshes.
    office-365-audit-source.png
  6. Name. Enter a name for the source. 
  7. Description. (Optional) 
  8. O365 Region. Region corresponding with your Microsoft 365 subscription.
  9. Content Type. Select the O365 content type you wish to collect using this source. Steps may be repeated for each O365 content type you want to collect from.
  10. Source Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called _sourceCategory.
  11. Fields.
    1. If you have not configured the Hosted Collector to forward all sources in the collector to CSE, click the +Add Field link, and add a field whose name is _siemForward and value is true.
    2. If you are not parsing all sources in the hosted collector with the same parser, click +Add Field and add a field named _parser with value /Parsers/System/Microsoft/Office 365.
  12. Sign in with Office 365. Click to give permission to Sumo Logic to collect Microsoft 365 logs.
  13. Click Save.

Step 3: Verify ingestion

In this step, you verify that your logs are successfully making it into CSE. 

  1. Click the gear icon, and select Log Mappings under Incoming Data.
    log-mappings-link.png
  2. On the Log Mappings page search for Office 365 and check under Record Volume.
    office-365-audit-record-volume.png
  3. For a more granular look at the incoming records, you can also use CIP to search for Office 365 security records.
    office-365-audit-search.png