mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
75 lines
1.9 KiB
YAML
75 lines
1.9 KiB
YAML
name: Office 365 Reporting Message Trace
|
|
id: b637788e-fcf0-44fa-86ea-cab81193f939
|
|
version: 2
|
|
creation_date: '2025-02-28'
|
|
modification_date: '2026-05-13'
|
|
author: Steven Dick
|
|
description: Data source object for Office 365 Reporting Message Trace
|
|
source: o365
|
|
sourcetype: o365:reporting:messagetrace
|
|
separator: Organization
|
|
supported_TA:
|
|
- name: Splunk Microsoft Office 365 Add-on
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- FromIP
|
|
- Index
|
|
- MessageId
|
|
- MessageTraceId
|
|
- Organization
|
|
- Received
|
|
- RecipientAddress
|
|
- SenderAddress
|
|
- Size
|
|
- Status
|
|
- Subject
|
|
- ToIP
|
|
- _bkt
|
|
- _cd
|
|
- _eventtype_color
|
|
- _indextime
|
|
- _raw
|
|
- _serial
|
|
- _si
|
|
- _sourcetype
|
|
- _subsecond
|
|
- _time
|
|
- action
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- eventtype
|
|
- host
|
|
- index
|
|
- internal_message_id
|
|
- linecount
|
|
- message_id
|
|
- punct
|
|
- recipient
|
|
- recipient_count
|
|
- recipient_domain
|
|
- size
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- splunk_server_group
|
|
- src
|
|
- src_user
|
|
- src_user_domain
|
|
- status_code
|
|
- subject
|
|
- tag
|
|
- tag::action
|
|
- tag::eventtype
|
|
- timeendpos
|
|
- timestartpos
|
|
- vendor_product
|
|
example_log: '{"Organization": "attackrange.onmicrosoft.com", "MessageId": "<BY5PR08MB62304A5BB7F9EE555B4CEA26DC1C2@BY5PR08MB6230.namprd08.prod.outlook.com>", "Received": "2025-01-16T21:06:46.832439", "SenderAddress": "victim_2@attack_range.lan", "RecipientAddress": "attacker_outside@gmail.com", "Subject": "Accounts and Passwords", "Status": "Delivered", "ToIP": "2607:f8b0:400e:c0d::1a", "FromIP": "189.135.168.197", "Size": 33584, "MessageTraceId": "3567c8ef-cc17-4a3f-d166-08dd3161e4fc", "Index": 3035}'
|