Skip to main content

Office 365

The product family of productivity and collaboration cloud based softwares owned by Microsoft.

Office 365

Overview

Office 365 is a subscription-based service that provides a comprehensive suite of productivity apps, combined with intelligent cloud services for collaboration, communication, file storage, security and management.

This Pack Includes

Data Normalization and Querying Capabilities

  • Data modeling rules to normalize Microsoft Office 365 logs that are ingested via the Office 365 integration into Cortex XSIAM.

  • Querying ingested logs in XQL Search using the datasets below:

    • General → msft_o365_general_raw
    • Exchange Online → msft_o365_exchange_online_raw
    • SharePoint Online → msft_o365_sharepoint_online_raw
    • DLP → msft_o365_dlp_raw

Supported Log Category

  • Audit

Supported Timestamp Formats

The ingestion is made using the CreationTime field for UTC (+00:00) in the following formats:

  • yyyy-mm-ddThh:mm:ss
  • yyyy-mm-ddThh:mm:ss.ms
  • yyyy-mm-ddThh:mm:ssZ
  • yyyy-mm-ddThh:mm:ss.msZ
  • yyyy-mm-dd hh:mm:ss UTC
  • yyyy-mm-dd hh:mm:ss.ms UTC

For the msft_o365_emails_raw dataset, ingestion is being made with the createdDateTime field.

Enable Data Collection

Native O365 Collector

Configure Cortex XSIAM Office 365 Native Collector on your Cortex XSIAM tenant:

  1. On the left panel, click Settings → Data Sources
  2. At the top-right corner, click Add Data Source
  3. Search for Office 365 and click Connect.

To create or configure the Office 365 collector, use the information described here.

To ingest email logs and data from Microsoft Office 365, use the Microsoft 365 email collector.
The Microsoft 365 collector ingests data into the following datasets:

  • msft_o365_emails_raw
  • msft_o365_users_raw
  • msft_o365_groups_raw
  • msft_o365_devices_raw
  • msft_o365_mailboxes_raw
  • msft_o365_rules_raw
  • msft_o365_contacts_raw

For more detailed configuration instructions, follow the guide under section Configure ingestion into Cortex XSIAM.

Pay Attention:
In order to normalize Azure AD (msft_azure_ad_raw) and Azure AD Audit (msft_azure_ad_audit_raw) logs, install the Microsoft Entra ID pack.

Office 365 collector

Office365_Collector_Settings

Microsoft 365 collector

Microsoft365_Collector_Settings

PUBLISHER

PLATFORMS

Cortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedJuly 23, 2024
Last ReleaseDecember 14, 2025
Network Security
Compliance
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.