Forum Discussion
Log analytics API
Hey - i have built up a collection of saved searches in Azure log analytics, mainly searching the SecurityAlerts, SignInLogs and OfficeActivity tables. When i get a security alert notification from Microsoft, I run my searches then export to CSV to search for indicators of compromise bla bla. This is great, somewhat quick and easy..
But is there a programmatic way of doing this?
Using the Security Graph API i can see the signIn resource type, so thats great, but i do not see exchange mailbox audit log resource, so i cannot see how to retrieve audit logs via an API..
Can i query the Log Analytics data directly through an API or is there another way to access this data programatically?
I looked at using the Azure Cloud Console, but even this didn't seem to be able to access the data..
There is the Log Analytocs API https://docs.microsoft.com/en-us/rest/api/loganalytics/ and the https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-collector-api
When you get a Security Alert you could call a playbook (Logic App) to work with that data, even if its only to create that CSV file.
Azure Sentinel has a new connector to O365 (not look too closely myself at this particular connector and data, but Exchange is mentioned).
Thanks
1 Reply
There is the Log Analytocs API https://docs.microsoft.com/en-us/rest/api/loganalytics/ and the https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-collector-api
When you get a Security Alert you could call a playbook (Logic App) to work with that data, even if its only to create that CSV file.
Azure Sentinel has a new connector to O365 (not look too closely myself at this particular connector and data, but Exchange is mentioned).
Thanks