# Ingest Logs

### Prerequisites

* **Logpoint version:** v7.5.0 or later
* **Microsoft 365 subscription** with:
  * a tenant admin account
  * a service user account
* **Outbound access** to the following URLs (allowlist these in your network):
  * `https://login.microsoftonline.com/{tenant_id}`
  * `https://login.microsoftonline.com`
  * `https://manage.office.com/api/v1.0/list/activity/feed/subscriptions`
  * `https://login.microsoftonline.com/{tenant_id}/oauth2/authorize`
  * `https://login.windows.net/`

### Install the integration

1. Download the **.pak** file from the [Service Desk](https://servicedesk.logpoint.com/hc/en-us/articles/360000800769-Office365).
2. Go to **Settings >> System Settings**.
3. Click **Applications**.
4. Click **Import**.
5. Upload the downloaded **.pak** file.
6. Verify the integration appears under **Settings >> System Settings >> Plugins**.

### Configure log ingestion

You can configure this integration using one of the following methods:

1. **Log source template** (recommended)
2. **Devices**

### Method 1: Configure using a log source template

Office365 provides a Microsoft365 log source template with pre-defined settings for:

* Source
* Connector
* Routing
* Normalization
* Enrichment

Some fields in the template must be configured manually.

#### Create a log source

1. Go to **Settings >> Log Sources**.
2. Click **+ Add Log Source**.
3. Click **+ Create New**.
4. Select **Microsoft365**.

#### Integration-specific configuration

The **Microsoft365** log source template has pre-defined settings, but you must configure some fields manually.

Configure the following template sections:

**Source**

1. Click **Source**.
2. Enter the log source **Name**.
3. Set **Fetch Interval (min)**.
4. Select **Charset**.
5. Select **Time Zone**.

<div data-with-frame="true"><figure><img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FDBPfUYnsmi68LCJHfvHh%2Fsource.png?alt=media&#x26;token=90a32b23-c3aa-42e4-b81d-a5f1014aa5cb" alt=""><figcaption></figcaption></figure></div>

**Connector**

1. Click **Connector**.
2. Enter **Client Secret, Subscription Id, Tenant ID,** and **Client ID** (obtained when configuring Microsoft Entra ID).

<div data-with-frame="true"><figure><img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FGhgu3TVsEJfBs2G04FRI%2Fconnector.png?alt=media&#x26;token=f6095821-00e7-4677-9399-a43b11291ad4" alt=""><figcaption></figcaption></figure></div>

**Routing**

1. Click **Routing**.
2. Click **+ Create Repo**.
3. Enter a **Repo name** and **Path** to store incoming logs.
4. Enter **Retention (Days)** to specify the number of days logs are kept in a repository before   \
   they are automatically deleted.
5. In **Availability**, select the **Remote logpoint** and **Retention (Days)**.
6. Click **Create Repo**.
7. In **Repo**, select the created repo to store logs.

**Create Routing Criteria**

* Click **+ Add row**.
* Enter **Key** and **Value** (criteria applied only to logs with this key/value).
* Select an **Operation**:
  * **Store raw message** — store incoming and normalized logs
  * **Discard raw message** — discard incoming, store normalized
  * **Discard entire event** — discard both incoming and normalized logs

To delete a routing criteria, click the **delete** icon under **Action**.

<div data-with-frame="true"><figure><img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FC7DQ9fnMs0YwDknTS70I%2Frouting.png?alt=media&#x26;token=7d4653f5-a3d4-4075-b245-9216f534feef" alt=""><figcaption></figcaption></figure></div>

**Normalization**\
Select a normalization policy that includes **Office365CompiledNormalizer**. (If you do not have a policy, create one using the compiled normalizer.)

<div data-with-frame="true"><figure><img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FVvd3Ah10uliVryHCji6c%2Fnormalizer.png?alt=media&#x26;token=32016e9e-facf-4139-87d5-0c69bd2d7bdf" alt=""><figcaption></figcaption></figure></div>

**Enrichment**\
In enrichment, select an enrichment policy for the incoming logs. Enrichment policies are used to add additional information to a log, such as user information, device type or geolocation, before analyzing it.

1. Click **Enrichment**.
2. Select an **Enrichment Policy**.
3. Click **Create Log Source** to save the configurations of Source, Connector, Routing, Normalization, and Enrichment.

<div data-with-frame="true"><figure><img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2Fww70fHe9Xajn7ozMWZPY%2Fenrichment.png?alt=media&#x26;token=c9f82179-f1d8-441d-91a2-0dfe2d0f3253" alt=""><figcaption></figcaption></figure></div>

### Method 2: Configure using devices

{% hint style="info" %}
When you run the Office365 fetcher for the first time, Logpoint creates subscriptions to the audit log sources in the API. After subscriptions are created, there can be a **12–24 hour delay** before logs start arriving.
{% endhint %}

#### Create a normalization policy (required)

1. Go to **Settings >> Configuration**.
2. Click **Normalization Policies**.
3. Click **Add**.
4. Enter a policy name.
5. Select **Office365CompiledNormalizer**.
6. Click **Submit**.

#### Create a processing policy

1. Go to **Settings >> Configuration**.
2. Click **Processing Policies**.
3. Click **Add**.
4. Enter a policy name.
5. Select the Office 365 normalization policy you created earlier.
6. Select your enrichment policy (if applicable).
7. Select your routing policy.
8. Click **Submit**.

#### Configure the Office365 fetcher

Before you configure the fetcher in Logpoint, configure Microsoft Entra ID (Azure portal) and collect the required values: **Client secret**, **Certificate thumbprint**, **Certificate file**, **Tenant ID**, **Client ID**, and **Subscription ID**.

1. Go to **Settings >> Configuration >> Devices**.
2. Under the **localhost** device, click **Add collectors/fetchers**.
3. Select **Office365 Fetcher**.
4. Click **Add**.
5. Select **Authentication** mode.
6. Enter **Subscription Id**.
7. If you selected **Public Client**, enter **Username**.
   1. If you selected **Public Client**, enter **Password**.

      ![](https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FEheysWu4FQRNDOt06YzX%2Fpublicclient.png?alt=media\&token=5509ca33-fb2a-4248-ba89-45fc39e8330a)
8. If you selected **Client Secret**, enter **Client Secret**.

   &#x20;     <img src="https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2FDTlDP6i8eSpMtwyxZkpa%2Fcliensecret.png?alt=media&#x26;token=a4a058ed-7db7-4730-ad14-83e12c46c5db" alt="" data-size="original">
9. If you selected **Certificate**, enter **Certificate Thumbprint**.
   1. If you selected **Certificate**, upload the **Certificate File** (`.pem`).

      ![](https://2820705887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQIySp8SrQkucJWBJQElK%2Fuploads%2F0pI1fM24B6y78w5EHbU2%2Fcertificate.png?alt=media\&token=d35d6010-9e58-40f5-a7a7-252b1db01822)
10. Enter **Fetch Interval (minutes)**.
11. Select the **Processing Policy** that uses the Office 365 normalization policy.
12. Enter **Tenant ID** (Directory/tenant ID).
13. Enter **Application ID** (Application/client ID).
14. If you use a proxy, select **Enable Proxy**.
15. If proxy is enabled, enter **IP/Port**.
16. If proxy is enabled, select **HTTP** or **HTTPS**.
17. Click **Test** to validate the configuration.
18. Click **Submit**.

### Verify ingestion

Use the following query to verify logs are ingested:

```logpoint
col_type = office365
```

Confirm that events appear in the expected repository after the fetch interval (and account for the first-time **12–24 hour** subscription delay).&#x20;
