Splunk Enterprise Security

Can we use the powershell/ APT for integration of Rights Management Service/ Office 365 (RMS) data to Splunk

MAMAOUI
Explorer

Hi All

I'm looking for informations or methods on integrating RMS (Rights Management service/Office365) into Splunk (Linux).
I'm not sure if we can use the APT (powershell) ....
I checked online - But not able to find any informations.

Thanks

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

I haven't tested this, but this Microsoft articles states that RMS logs are written to blob storage in W3C extended format:
https://docs.microsoft.com/en-us/information-protection/deploy-use/log-analyze-usage#how-to-access-a...

You should be able to use the blob input in the Splunk Add-on for Microsoft Cloud Services to read this data.

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

I haven't tested this, but this Microsoft articles states that RMS logs are written to blob storage in W3C extended format:
https://docs.microsoft.com/en-us/information-protection/deploy-use/log-analyze-usage#how-to-access-a...

You should be able to use the blob input in the Splunk Add-on for Microsoft Cloud Services to read this data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...