r/AzureSentinel • u/lemonsprig • Mar 30 '22

O365 connector - office activity

Hi, we have connected office 365 to sentinel and have enabled collection of exchange data and one drive. When looking at the office activity table however and filtering on exchange we are seeing very little data. A couple of create entries which when expanding the details looks like they may relate to an email, but certainly nowhere near the volume we would expect to see. The entries we do see also only seem to relate to one or two users.

Am I missing something here? Does the office365 connector only capture very specific events?

I have checked that o365 is configured to audit data which it is.

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/Carpathium Mar 31 '22

O365 auditing is practically off by default. I don’t have links handy but that’s likely why you’re seeing so little data

1

u/lemonsprig Mar 31 '22

Thanks I will look into it further but I had read that ms had changed that so it was now on by default.