topic Re: Office 365 JSON-to-flatfile converter as EDL feeder in General Topics

Office 365 JSON-to-flatfile converter as EDL feeder

Ivan.Gladushko — Tue, 28 Apr 2020 04:45:53 GMT

Hi PAN Community,

How's everything going? I hope everyone is well and safe.

I know there are plenty of MineMeld fans out there but just in case MineMeld deployment is an overkill for your organization and Office 365 security is a burning item in your task list, I thought I'd share a simple and elegant solution that has been running in my setup for over a year now.

o365-json-to-flatfile-converter is a Python-based script that feeds my PAN FWs' External Dynamic Lists and a Splunk instance. The generated flatfiles are in a universal format, so they can be used with other security solutions and appliances like Cisco, Forcepoint, RSA, etc. For more details please see README.

URL: https://github.com/ivang-coder/o365-json-to-flatfile-converter.git

Dear moderators, in case this post is in the wrong location, please move it to the right one or advise the right way of posting.

Cheers,

IvanG

Re: Office 365 JSON-to-flatfile converter as EDL feeder

jdelio — Thu, 30 Apr 2020 17:11:57 GMT

@Ivan.Gladushko

Thanks for posting this.. Things like this is what makes the LIVEcommunity a GREAT place to be. We are here for each other.

Little Tips and Tricks like this can really help when people are looking for help, so thanks.

I just suggest tagging with different "key words" like EDL or EBL to help others find this.

Thanks again!! Keep it up!

Re: Office 365 JSON-to-flatfile converter as EDL feeder

Ivan.Gladushko — Thu, 30 Apr 2020 23:01:33 GMT

Hi Jdelio, thanks for your suggestions and the tags that you've added.

Cheers,