Code

[SIEM] Office 365 module#16386

Code

Merged

adriansr merged 15 commits intoelastic:masterelastic/beats:masterfrom adriansr:feature_o365_moduleadriansr/beats:feature_o365_moduleCopy head branch name to clipboardMar 19, 2020

+34,857-3

Commits

Commits on Mar 18, 2020

• New module o365 for Office 365 log ingestion

  Show description for 8aa512b
  adriansr

  committed
  8aa512b

  Copy full SHA for 8aa512b

• address review comments

  adriansr

  committed
  4eb820a

  Copy full SHA for 4eb820a

• Set related.user

  adriansr

  committed
  ee4d2ac

  Copy full SHA for ee4d2ac

• Better mapping for Yammer event fields

  adriansr

  committed
  d1c4934

  Copy full SHA for d1c4934

• Revert changes to zeek golden file

  adriansr

  committed
  c969d6f

  Copy full SHA for c969d6f

• Convert numeric user.id to string

  Show description for 454ffeb
  adriansr

  committed
  454ffeb

  Copy full SHA for 454ffeb

• Support ip:port in client.address

  adriansr

  committed
  277c9a5

  Copy full SHA for 277c9a5

• Correct comment about ECS event.type

  adriansr

  committed
  c8a6b62

  Copy full SHA for c8a6b62

• Correct o365audit docs

  Show description for 02ea070
  adriansr

  committed
  02ea070

  Copy full SHA for 02ea070

• Append https scheme to endpoint URLs if needed

  Show description for 2712947
  adriansr

  committed
  2712947

  Copy full SHA for 2712947

• Added sample dashboard

  adriansr

  committed
  3adebc7

  Copy full SHA for 3adebc7

• Add dashboard screenshot to docs

  adriansr

  committed
  8181a9b

  Copy full SHA for 8181a9b

• Document setup process

  adriansr

  committed
  4a6ea69

  Copy full SHA for 4a6ea69

• Store dashboard in correct format

  adriansr

  committed
  3388089

  Copy full SHA for 3388089

Commits on Mar 19, 2020

• improve iam / group categorisation

  adriansr

  committed
  2196d35

  Copy full SHA for 2196d35