o365beat

o365beat copied to clipboard

There are 2 issues 1) /var/log/o365beat is not created even if manually created, there are no log files being created - the Azure AD data is not getting collected. it...

sriramb12

Hello, Does O365beat support multiple Office 365 tenants scenario, e.g 50,000 tenants? Thank you in advance Khaled

khaloud40

I get a Tenant not found when running the binary. The error given is: ``` res: &{400 Bad Request 400 HTTP/2.0 2 0 map[Cache-Control:[no-cache] Content-Length:[1695] Content-Type:[application/json; charset=utf-8] Date:[Thu, 17 Jun...

shad0wcrawl3r

GCC High no available content locations:

1

I get o365beat[17747]: 2021-05-20T01:17:13.009Z#011DEBUG#011[api]#011beater/o365beat.go:336#011got these available content locations: [] When attempting to connect to GCC High using these values: login_url: 'https://login.microsoftonline.us' resource_url: 'https://manage.office365.us' That is what was in the instructions....

mgovolt

AzureActiveDirectory Logs not pulled

3

I have been using o365beat to pull in logs successfully from 3 different tenants for the last couple of months. As of the 1st of November no AzureActiveDirectory logs have...

andy13th

Question about possibility of monitoring multiple tenant domains

14

For my current project I am required to pull logs from multiple tenant domains and output each to a separate index. My current solution is running an instance of o365beat...

ipninichuck

Has the contents of the Office 365 Audit logs changed recently? I noticed that since last month I'm no longer seeing location data e.g. origin country of login in logs...

GenCr

Certificate signed by unknown authority message

2

Hi - I am having an issue when attempting to run o365beat within a docker container if you could provide some assistance? At the point where it is running o365beat...

robm82

Reshadadada

WARN beater/o365beat.go:249 start XX must be <=YY hrs ago, resetting

3

Hi, could anyone please explain me what happens in such case? This is the scenario: Assume I'm asking all events prior to YY hours, let's say 24h and now are...

rob570