Where to mine all O365 endpoints?

[Oleksand1]

Hi dear community,

I just implemented MineMeld server and configured EDLs and test policies.

For the MineMeld I used "o365-api-any-any.txt" from https://paloaltonetworks.app.box.com/s/ywkh7rc2rj0kyl0qetr6m6ag3akxvvx6/folder/51988433336.

Does anybody know if it's enough for all O365 endpoints, or I'm missing something? i still see that some endpoints are missing (e.g. some MS Office activation servers; IP: 40.77.226.250, 40.69.153.67)

Thanks!

[lmori]

Hi @Oleksand1,

thanks for reporting, do you have the URL associated to those IPs?

luigi

[Oleksand1]

Hello @lmori

"Resolve Hostname" results in co2.sls.microsoft.com.

Thanks!

[lmori]

Hi @Oleksand1,

are you using both URL and IP in enabling policies? Both are needed.

In the microsoft endpoint list there is an endpoint for activation, but it is only specified as a URL:

activation.sls.microsoft.com