SOLVED

Office 365 connect - ingest logs only from single domain

%3CLINGO-SUB%20id%3D%22lingo-sub-2142451%22%20slang%3D%22en-US%22%3EOffice%20365%20connect%20-%20ingest%20logs%20only%20from%20single%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2142451%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20filter%20Sentinel%20Office%20365%20connector%20so%20it%20would%20ingest%20events%20only%20regarding%20specific%20domain.%20There%20are%20multiple%20associated%20domains%20in%20Office%20365%20now.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3EP%C4%93teris%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2142731%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connect%20-%20ingest%20logs%20only%20from%20single%20domain%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2142731%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F440701%22%20target%3D%22_blank%22%3E%40peteris%3C%2FA%3E%26nbsp%3BIf%20all%20the%20domains%20are%20already%20part%20of%20Office365%2C%20then%20no.%26nbsp%3B%20The%20data%20connector%20just%20reads%20all%20the%20data%20from%20O365.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello,

 

Is it possible to filter Sentinel Office 365 connector so it would ingest events only regarding specific domain. There are multiple associated domains in Office 365 now.

 

Regards,

Pēteris

1 Reply
best response confirmed by peteris (Occasional Contributor)
Solution

@peteris If all the domains are already part of Office365, then no.  The data connector just reads all the data from O365.