topic Re: Cortex Xdr o365 compliance email in Cortex XDR Discussions

Cortex Xdr o365 compliance email

RajeshPremSingh — Wed, 31 Jan 2024 13:19:36 GMT

we integrated o365 API with cortex we have concern

what it will do it will do anything?

what is the use compliance mail it block spam or malicious attachment

Re: Cortex Xdr o365 compliance email

aspatil — Wed, 31 Jan 2024 14:44:56 GMT

Hello @RajeshPremSingh ,

Thank you for reaching out to our Live Community.

Integrating O365 API with Cortex XDR means, you will be ingesting logs from O365 to Cortex.Cortex XDR can ingest the following logs and data from Microsoft Office 365 Management Activity API and Microsoft Graph API using the Office 365 data collector. Cortex XDR as a tool, will not take any action.

efore you can collect Microsoft Office 365 emails, you need to setup a compliance email account, and then configure an Email Flow Rule. This rule ensures to Blind carbon copy (Bcc) every message sent to, from, and within the organization to a defined compliance mailbox. After the Office 365 data collector ingests the emails, they are deleted from the compliance mailbox to prevent email from building up over time (nothing touches the actual users’ mailboxes).

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Microsoft-Office-365

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Cortex Xdr o365 compliance email

RajeshPremSingh — Sat, 03 Feb 2024 08:33:05 GMT

Sry this thing i can read from document i need more info what the thing can do and how to create compliance mail

Re: Cortex Xdr o365 compliance email

PoojalaSreenadh — Sun, 14 Apr 2024 01:04:18 GMT

Hi @aspatil ,

Once ingesting the o365 email logs to cortex XDR, is it can be doing any action? for example detecting URLs, attachments, or recipients' domains.

if it is malicious is cortex block the URL, attachment or Domain?

Re: Cortex Xdr o365 compliance email

Dopamine09 — Tue, 28 May 2024 02:43:19 GMT

How can we ensure that the emails are deleted from the compliance mailbox after Office 365 data collector ingests the emails?
Is there a suggested email flow rule that specify a timeline like every hour cleanup?