Downloading O365 logs to an on-prem log server

[rickjames]

Morning all,

 

As per the title, really; our security team are wondering if we can pull down O365 audit/security logs to a log server that is on-prem. I'm not sure if this is even feasible, but if anyone is aware of any solution/documentation that doesn't involve a third party product I'm all ears...

 

Cheers

[oododkodkdo]

Morning all,

 

As per the title, really; our security team are wondering if we can pull down O365 audit/security logs to a log server that is on-prem. I'm not sure if this is even feasible, but if anyone is aware of any solution/documentation that doesn't involve a third party product I'm all ears...

 

Cheers

 

This may help

 

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

[rickjames]

This may help

 

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

 

Not really, I'm afraid. I know how to search audit logs etc, just the part of automating the whole thing without it being too finicky

[HPlum78]

You can stream them in to storage or use Event Hubs to stream them in to another solution.

 

- - - Updated - - -

 

Here is a link that may help:-

https://docs.microsoft.com/en-gb/azure/azure-monitor/platform/activity-log-export