> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Office 365 Integration

> Monitor security events from Microsoft Office 365 services

The Office 365 integration enables monitoring of security events from Microsoft 365 services. Events are collected from the Office 365 Management Activity API and displayed in the Wazuh Dashboard.

## Overview

The Office 365 integration collects security and compliance events from your Microsoft 365 environment, including Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory activities.

All events are tagged with `wazuh.integration.name: o365` for filtering and analysis.

Reference: `plugins/main/common/wazuh-modules.ts:85`

## Monitored Office 365 Services

The integration monitors activities from:

* **Exchange Online** - Email activities, mailbox access, message tracking
* **SharePoint Online** - Document access, sharing, and modifications
* **OneDrive for Business** - File operations and sharing activities
* **Azure Active Directory** - User authentication and authorization
* **Microsoft Teams** - Meeting and channel activities
* **Power BI** - Dashboard and report access
* **Dynamics 365** - CRM activities
* **Yammer** - Social network activities
* **Sway** - Presentation activities
* **Microsoft Stream** - Video portal activities

## Key Features

* Real-time event collection from Office 365 Management API
* Multi-tenant support
* Comprehensive activity logging
* User behavior analytics
* Data loss prevention (DLP) event monitoring
* Compliance event tracking
* Pre-built dashboards and visualizations

## Data Source Configuration

The Office 365 data source uses the following configuration:

```typescript theme={null}
const OFFICE_365_GROUP_KEY = 'wazuh.integration.name';
const OFFICE_365_GROUP_VALUE = 'o365';
```

Reference: `plugins/main/public/components/common/data-source/pattern/events/office-365/office-365-data-source.ts:5`

## Event Fields

Office 365 events include fields such as:

* `data.office365.UserType` - Type of user (Regular, Admin, System, etc.)
* `data.office365.AuditLogScope` - Online or OnPremise
* `event.type` - Event action type
* `data.office365.Operation` - Specific operation performed
* `data.office365.Workload` - Office 365 service (Exchange, SharePoint, etc.)
* `data.office365.UserId` - User who performed the action
* `data.office365.ClientIP` - Client IP address
* `data.office365.ResultStatus` - Success or failure status

References:

* `plugins/main/public/components/overview/office/panel/config/helpers/helper-value-suggestion.ts:34`
* `plugins/main/public/components/overview/office/panel/config/visualizations.ts:69`

### User Type Values

Based on Microsoft documentation, `UserType` can be:

* Regular (0) - Regular user
* Reserved (1) - Reserved
* Admin (2) - Administrator
* DcAdmin (3) - Microsoft datacenter operator
* System (4) - System account
* Application (5) - Application
* ServicePrincipal (6) - Service principal
* CustomPolicy (7) - Custom policy
* SystemPolicy (8) - System policy

Reference: `plugins/main/public/components/overview/office/panel/config/helpers/helper-value-suggestion.ts:14`

## Setup and Configuration

### Prerequisites

* Office 365 subscription with appropriate license
* Global Administrator or Security Administrator role
* Azure AD application registration
* Wazuh manager with Office 365 module enabled

### Configuration Steps

1. **Register Azure AD Application**

   * Sign in to Azure Portal
   * Navigate to Azure Active Directory > App registrations
   * Click "New registration"
   * Provide name (e.g., "Wazuh Office 365 Integration")
   * Select "Accounts in this organizational directory only"
   * Register the application

2. **Configure API Permissions**

   Add the following Office 365 Management API permissions:

   * `ActivityFeed.Read` - Read activity data
   * `ActivityFeed.ReadDlp` - Read DLP policy events
   * `ServiceHealth.Read` - Read service health information

3. **Create Client Secret**

   * In the app registration, go to Certificates & secrets
   * Click "New client secret"
   * Add description and set expiration
   * Copy the secret value (save it securely)

4. **Note Required Information**

   Collect the following:

   * Application (client) ID
   * Directory (tenant) ID
   * Client secret value

5. **Enable Office 365 Audit Logging**

   ```powershell theme={null}
   # Connect to Exchange Online
   Connect-ExchangeOnline

   # Enable audit logging
   Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
   ```

6. **Configure Wazuh Manager**

   Edit `/var/ossec/etc/ossec.conf`:

   ```xml theme={null}
   <wodle name="office365">
     <disabled>no</disabled>
     <interval>10m</interval>
     <curl_max_size>1M</curl_max_size>
     <only_future_events>yes</only_future_events>
     <api_auth>
       <tenant_id>your-tenant-id</tenant_id>
       <client_id>your-client-id</client_id>
       <client_secret>your-client-secret</client_secret>
     </api_auth>
     <subscriptions>
       <subscription>Audit.AzureActiveDirectory</subscription>
       <subscription>Audit.Exchange</subscription>
       <subscription>Audit.SharePoint</subscription>
       <subscription>Audit.General</subscription>
     </subscriptions>
   </wodle>
   ```

7. **Verify Configuration**

   * Restart Wazuh manager
   * Check `/var/ossec/logs/ossec.log` for connection success
   * Verify events appear in the dashboard

## Dashboard Visualizations

The Office 365 integration includes visualizations:

### Overview Dashboard

* **Stats** - Total events and event types
* **Top Event Actions** - Most frequent operations
* **Events Over Time** - Activity timeline
* **Top Users** - Most active users
* **Top Operations** - Most common operations
* **Workload Distribution** - Events by Office 365 service

Reference: `plugins/main/public/components/overview/office/panel/config/visualizations.ts:1`

### Filtering Events

Filter Office 365 events using:

```kuery theme={null}
wazuh.integration.name: "o365"
```

Additional filters:

* By user: `data.office365.UserId: "user@domain.com"`
* By operation: `data.office365.Operation: "FileAccessed"`
* By workload: `data.office365.Workload: "SharePoint"`
* By user type: `data.office365.UserType: "2"` (Admin)
* By status: `data.office365.ResultStatus: "Failed"`

## Use Cases

### Security Monitoring

* **Unauthorized Access Detection**
  * Monitor failed login attempts
  * Track access from unusual locations
  * Identify compromised accounts

* **Privileged Activity Tracking**
  * Monitor administrator actions
  * Track permission changes
  * Audit role assignments

* **Data Access Monitoring**
  * Track sensitive file access
  * Monitor external sharing activities
  * Detect unusual download patterns

### Compliance and Auditing

* **Regulatory Compliance**
  * GDPR data access logging
  * HIPAA audit trail requirements
  * SOX financial record access
  * PCI DSS access control monitoring

* **Data Loss Prevention**
  * DLP policy violation tracking
  * Sensitive information sharing detection
  * External file sharing monitoring

* **Retention and eDiscovery**
  * Email retention compliance
  * Legal hold monitoring
  * Document retention tracking

### Insider Threat Detection

* Mass file downloads
* Unusual access patterns
* After-hours activity
* Access to restricted resources
* Permission escalation attempts

### Operational Monitoring

* User adoption tracking
* Service usage analytics
* Performance issue detection
* License utilization monitoring

## Common Security Events

### Authentication Events

* UserLoggedIn
* UserLoginFailed
* UserPasswordChanged
* UserPasswordReset
* UserAccountEnabled
* UserAccountDisabled

### File and Document Events

* FileAccessed
* FileDownloaded
* FileModified
* FileDeleted
* FileMoved
* FileCopied
* FileShared
* FileSharedWithGuest

### Email Events

* Send (email sent)
* SendAs (send as another user)
* SendOnBehalf (send on behalf of)
* MailboxLogin
* MessageDelivered
* MessageReceived

### Administrative Events

* Add-RoleGroupMember
* Remove-RoleGroupMember
* Set-Mailbox
* New-InboundConnector
* Set-AdminAuditLogConfig

## Troubleshooting

### No Events Appearing

* Verify Azure AD app registration is complete
* Check API permissions are granted and consented
* Ensure Office 365 audit logging is enabled
* Verify client secret is valid and not expired
* Check tenant ID and client ID are correct
* Review Wazuh logs for authentication errors

### Missing Events from Specific Services

* Verify subscription is configured for that service
* Check service audit logging is enabled
* Ensure appropriate license is assigned
* Verify API permissions include required scopes

### Authentication Failures

* Check client secret hasn't expired
* Verify tenant ID is correct
* Ensure admin consent was granted
* Check network connectivity to Office 365 API

### Performance Issues

* Adjust polling interval to reduce API calls
* Limit subscriptions to required services only
* Increase `curl_max_size` if events are large
* Monitor API throttling limits

## Security Best Practices

1. **Secure Credentials** - Store client secrets securely
2. **Regular Key Rotation** - Rotate client secrets periodically
3. **Principle of Least Privilege** - Grant minimum API permissions
4. **Monitor the Monitor** - Track integration access patterns
5. **Enable MFA** - Require MFA for admin accounts
6. **Regular Audits** - Review collected events regularly
7. **Alert Configuration** - Set up alerts for critical events
8. **Retention Policies** - Configure appropriate log retention

## Advanced Configuration

### Filtering Specific Events

Modify configuration to focus on specific operations:

```xml theme={null}
<wodle name="office365">
  <only_future_events>yes</only_future_events>
  <api_auth>
    <!-- auth config -->
  </api_auth>
  <subscriptions>
    <subscription>Audit.AzureActiveDirectory</subscription>
  </subscriptions>
</wodle>
```

### Multi-Tenant Monitoring

Monitor multiple Office 365 tenants:

```xml theme={null}
<wodle name="office365">
  <disabled>no</disabled>
  <interval>10m</interval>
  <api_auth>
    <tenant_id>tenant-1-id</tenant_id>
    <client_id>client-1-id</client_id>
    <client_secret>client-1-secret</client_secret>
  </api_auth>
  <!-- subscriptions -->
</wodle>

<wodle name="office365">
  <disabled>no</disabled>
  <interval>10m</interval>
  <api_auth>
    <tenant_id>tenant-2-id</tenant_id>
    <client_id>client-2-id</client_id>
    <client_secret>client-2-secret</client_secret>
  </api_auth>
  <!-- subscriptions -->
</wodle>
```

## Related Resources

* [Cloud Integrations Overview](/cloud/overview)
* [Microsoft Graph API Integration](/cloud/microsoft-graph)
* [AWS Integration](/cloud/amazon-web-services)
* [Compliance Modules](/compliance/overview)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.