Starting with syslog-ng PE version 7.0.17, you can fetch logs from your Office 365 account using the Office 365 Management Activity API.

The syslog-ng PE application supports every content type of the Management Activity API using a corresponding source driver:

  • Audit.AzureActiveDirectory: office365-azure-active-directory()

  • Audit.Exchange: office365-exchange()

  • Audit.General: office365-general()

  • Audit.SharePoint: office365-sharepoint()

  • DLP.All: office365-dlp()

Limitations

  • In some cases, the logs will appear only 24-48 hours after successfully configuring syslog-ng PE and Office 365.

  • Due to the distributed nature of the Office 365 log management architecture, there is a synchronization interval in the Office 365 Management Activity API. During this interval, the messages returned to queries can be inconsistent. To avoid this synchronization window, syslog-ng PE does not fetch the logs in real-time, only 15 minutes after the message becomes available in the management API. This means that there is a 15-minute latency between the logs available in the Office 365 Management Activity API and syslog-ng PE.

Declaration
source s_office365 {
    office365-<content-type>(
        tenant_id('tenant-id')
        client_id('client-id')
        client_secret('client-secret')
    );
};
Example: Fetching Azure Active Directory logs from Office 365

The following example configuration fetches logs from and Audit.AzureActiveDirectory subscription using the office365-azure-active-directory() source driver.

@version: 7.0
@include "scl.conf"

source s_o365_ad {
    office365-azure-active-directory(
        tenant_id('tenant-id')
        client_id('client-id')
        client_secret('client-secret')
    );
};

destination d_file { file("/tmp/o365_ad_out.log"); };

log {
    source(s_o365_ad);
    destination(d_file);
    flags(flow-control);
};