Configuring Office 365 Reporting Web Service Connectors

This connector allows Stellar Cyber to ingest logs from Office 365 Reporting Web Service and add the records to the data lake. It integrates with the Microsoft Reporting Web Service to query Message Trace data.

Stellar Cyber connectors with the Collect function (collectors) may skip collecting some data when the ingestion volume is large, which potentially can lead to data loss. This can happen when the processing capacity of the collector is exceeded.

Connector Overview: Office 365 Reporting Web Service

Adding an Office 365 Reporting Web Service Connector

To add an Office 365 Reporting Web Service connector:

1. Obtain credentials
2. Add the connector in Stellar Cyber
3. Test the connector
4. Verify ingestion

Obtaining Office 365 Reporting Web Service Credentials

Before you configure the connector in Stellar Cyber, you must obtain the following Office 365 Reporting Web Service credentials:

• Authentication Endpoint—The authentication endpoint, which you can select from the dropdown menu.

• Directory ID—The tenant from which to request permission, also known as the Tenant ID.

• Application ID—The ID that the app registration portal assigned when the app was registered, also known as the Client ID.

• API Access Key—The API access key or client secret that you generated for your app in the app registration portal, also known as the Client Secret.

For details, see Registering the Application and Obtaining Permissions.

Registering the Application

Follow the guidance in the Microsoft documentation to get started with Reporting Web Service.

To register the application in Microsoft Entra ID (formerly Azure Active Directory) and obtain the Tenant ID, Client ID, and Client Secret:

1. Log in as an administrative user to the Azure Management Portal at https://portal.azure.com and sign in with the credentials for the tenant subscribed to Office 365.

2. From Azure services, select Microsoft Entra ID.

   

3. In the navigation pane, select App registrations.

   

4. Click New registration.

   

5. In Register an application, enter a Name.

6. Choose a supported account type. For Single tenant, select Accounts in this organizational directory only.

7. For Redirect URI (optional), select Web, and enter http://localhost as the Web URL.

8. Click Register.

   

9. Copy the Application (client) ID and Directory (tenant) ID. You will use them to configure the connector in Stellar Cyber.

10. In the navigation pane, click Certificates & secrets.

    

11. Click New client secret.

12. In Add a client secret, enter a Description and choose an expiration.

13. Click Add.

    

14. Copy the Value. You will use this as the API Access Key to configure the connector in Stellar Cyber.

    Store the value in a safe location. It cannot be retrieved later.

Obtaining Permissions

First, assign the Security Reader role to the created application.

1. Log in to the Microsoft Entra ID admin center.

2. Navigate to Identity > Roles & admins > Roles & admins.

   

3. Search or scroll for the Security Reader role in the Administrative roles and select it.

4. Click Add assignments and select the users or groups you want to assign to this role.

5. Click Add to assign the role.

Next, add API permissions for your application.

1. In the navigation pane, select API Permissions.

   

2. Click Add a permission.

3. In Request API permissions, select the APIs my organization uses tab.

4. Search or scroll for Office 365 Exchange Online, and select it.

Next, select Application Permissions:

1. Select Application Permissions to allow the application to run as a background service without a signed-in user.

   

2. Search for and select ReportingWebService.Read.All.

3. Click Add permissions.

Then, grant admin consent.

1. After adding permissions, there is a banner at the top of the API Permissions page that says the permissions require admin consent.

2. In the API permissions window, go to the Grant admin consent section.

3. If you are the Office 365 super admin, grant the permissions. Select the checkmark to Grant admin consent for <tenant name>.

   

4. Confirm the consent by clicking Yes.

Finally, verify the permissions.

1. After granting admin consent, the status for the permissions will update to Granted for < tenant name>.

2. Ensure that the Application permission (ReportingWebService.Read.All) is correctly listed and granted.

   

Adding the Connector in Stellar Cyber

To add an Office 365 Reporting Web Service connector in Stellar Cyber:

1. Log in to Stellar Cyber.

2. Click System | INTEGRATIONS | Connectors. The Connector Overview appears.

   

3. Click Create and select Connector.

   

   The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

4. Choose SASE from the Category dropdown.

5. Choose Office 365 Reporting Web Service from the Type dropdown.

   

   The asterisk (*) indicates a required field.

6. For this connector, the supported Function is Collect, which is enabled already.

7. Enter a Name.

   Notes:

   • This field does not accept multibyte characters.
   • It is recommended that you follow a naming convention such as tenantname-connectortype.

8. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

9. Choose the device on which to run the connector.

   • Certain connectors can be run on either a Sensor or a Data Processor. The available devices are displayed in the Run On menu. If you want to associate your collector with a sensor, you must have configured that sensor prior to configuring the connector or you will not be able to select it during initial configuration. If you select Data Processor, you will need to associate the connector with a Data Analyzer profile as a separate step. That step is not required for a sensor, which is configured with only one possible profile.

   • If the device you're connecting to is on premises, we recommend you run on the local sensor. If you're connecting to a cloud service, we recommend you run on the DP.

10. (Optional) When the Function is Collect, you can apply Log Filters. For information, see Managing Log Filters.

11. Click Next. The Configuration tab appears.

    

    The asterisk (*) indicates a required field.

12. Enter the Authentication Endpoint you noted above in Obtaining Office 365 Reporting Web Service Credentials.

13. Enter the Directory ID you noted above.

14. Enter the Application ID you noted above.

15. Enter the API Access Key you noted above.

16. Choose the Interval (min). This is how often the logs are collected.

17. (Optional) Click Disable SSL Certificate Verification if you want to disable SSL certificate verification. Only disable SSL certificates if you have a reason to, otherwise, it is not a good security practice.

18. Choose the Content Type you would like to collect. The logs for Message Trace are supported.

19. Click Next. The final confirmation tab appears.

    

20. Click Submit.

    To pull data, a connector must be added to a Data Analyzer profile if it is running on the Data Processor.

21. If you are adding rather than editing a connector with the Collect function enabled and you specified for it to run on a Data Processor, a dialog box now prompts you to add the connector to the default Data Analyzer profile. Click Cancel to leave it out of the default profile or click OK to add it to the default profile.

    • This prompt only occurs during the initial create connector process when Collect is enabled.

    • Certain connectors can be run on either a Sensor or a Data Processor, and some are best run on one versus the other. In any case, when the connector is run on a Data Processor, that connector must be included in a Data Analyzer profile. If you leave it out of the default profile, you must add it to another profile. You need the Administrator Root scope to add the connector to the Data Analyzer profile. If you do not have privileges to configure Data Analyzer profiles, a dialog displays recommending you ask your administrator to add it for you.

    • The first time you add a Collect connector to a profile, it pulls data immediately and then not again until the scheduled interval has elapsed. If the connector configuration dialog did not offer an option to set a specific interval, it is run every five minutes. Exceptions to this default interval are the Proofpoint on Demand (pulls data every 1 hour) and Azure Event Hub (continuously pulls data) connectors. The intervals for each connector are listed in the Connector Types & Functions topic.

    The Connector Overview appears.

The new connector is immediately active.

Testing the Connector

In addition to testing for connectivity, the Test button for the Office 365 Reporting Web Service connector tests that the Authentication Endpoint, Directory ID, Application ID, and API Access Key are correct and data requests for the requested content type returns successful responses.

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates authentication and connectivity).

1. Click System | INTEGRATIONS | Connectors. The Connector Overview appears.

   

2. Locate the connector by name that you added, or modified, or that you want to test.

3. Click Test at the right side of that row. The test runs immediately.

   Note that you may run only one test at a time.

Verifying Ingestion

To verify ingestion:

1. Select Threat Hunting.

   The Interflow Search tab appears.

2. Change the Indices to Windows Events.

   The table immediately updates to show ingested Interflow records.