O365 Malware report data to Sentinel

[Dean Gross]

Does anyone know how to get data from the O365 Security and Compliance center report dashboards into Sentinel? specifically the Malware Detection data

[#2 · Accepted solution]

@Dean Gross 

right now O365 connector gets Onedrive, Sharepoint and Exchange events only.  we plan to expand to other O365 events.

In the short term, you could use a logic app to pull the O365 API events into Log Analytics.

[#3]

@Nicholas DiCola (SECURITY JEDI) thanks for the suggestion, but I'm not seeing any events in the O365 APIs that are related to the malware reporting data. can you provide me some details about how this can be accomplished? 

[#4]

@Dean Gross 

Alerts are documented in the schema here. https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

Looks like audit log has two entries for ThreatIntelligence

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

One for Exchange ATP, and one for Onedrive/SP/Teams ATP