Options to onboard Microsoft Message trace logs into XSIAM

[T.Sode]

As we have an option in Splunk to see the all the message tracking logs through Microsoft message trace app, do we have any similar app to integrate?

Cortex XSIAM 

[MarekKreul]

Hi, were you able to solve this in the mean time? We're facing a similar challenge.

[M.Harne]

Hi,

I am also facing this challenge while trying to integrate message trace logs. Have you found any resolution, such as using automation or integrating with the HTTP log collector?

[S.Basavarajappa]

We have raised a feature request....

[JamesAshley]

We just solved this with the Microsoft Defender XDR Streaming API -> Azure Event Hub, then ingesting the Azure Event Hub data.

Stream Microsoft Defender XDR events to your Storage account - Microsoft Defender XDR | Microsoft Le...

[M.Harne]

Hi Everyone,

I was able to solve this issue by creating a custom integration in Cortex XSIAM.

I have attached the integration file in zip extract the file and use YAML (.yml) format. To use it:

1. Navigate to XSIAM → Integrations & Automation.

2. Click + Add and select Import Custom Integration.

3. Drag and drop the attached .yml file.

4. Once the integration is created, search for it and configure the following parameters:

   • Tenant ID

   • Client ID

   • Client Secret

5. Save and enable the integration.

The integration will begin fetching Microsoft 365 Message Trace logs.

Prerequisite: Ensure that your Azure application has the required Microsoft Graph/Exchange Online API permissions to read Message Trace logs.

I hope this helps others facing the same issue. If you find it useful, please acknowledge or leave a comment. Thank you!

[JamesAshley]

If you have access to the XDR Streaming API, I would really suggest looking into it. You get an absolute ton of additional metadata over the traditional messagetrace logs.