Cortex Xdr o365 compliance email

[RajeshPremSingh]

hi

 we integrated o365 API with cortex we have concern 

what it will do it will do anything?

what is the use compliance mail it block spam or malicious attachment 

[aspatil]

Hello @RajeshPremSingh ,

 Thank you for reaching out to our Live Community.

Integrating O365 API with Cortex XDR means, you will be ingesting logs from O365 to Cortex.Cortex XDR can ingest the following logs and data from Microsoft Office 365 Management Activity API and Microsoft Graph API using the Office 365 data collector. Cortex XDR as a tool, will not take any action.

efore you can collect Microsoft Office 365 emails, you need to setup a compliance email account, and then configure an Email Flow Rule. This rule ensures to Blind carbon copy (Bcc) every message sent to, from, and within the organization to a defined compliance mailbox. After the Office 365 data collector ingests the emails, they are deleted from the compliance mailbox to prevent email from building up over time (nothing touches the actual users’ mailboxes).

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[RajeshPremSingh]

Sry this thing i can read from document  i need more info what the thing can do  and how to create compliance mail

[PoojalaSreenadh]

Hi @aspatil ,

Once ingesting the o365 email logs to cortex XDR, is it can be doing any action? for example detecting URLs, attachments, or recipients' domains.

if it is malicious is cortex block the URL, attachment or Domain?

[Dopamine09]

How can we ensure that the emails are deleted from the compliance mailbox after Office 365 data collector ingests the emails?
Is there a suggested email flow rule that specify a timeline like every hour cleanup?