Ingesting Exchange message trace reports

[b41s]

Hi all,

I'm in the process of ingesting Exchange logs into SecOps SIEM, the data feed to collect exchange audit logs via the Office 365 log type is successfully configured. However for the message trace reports, this log type is not within the default log types for third party APIs. So 3 questions:

1. Can people share any experiences ingesting exchange message trace reports?
2. Is there a way to configure a third party API custom feed of some sort ?
3. If it's not possible to set up a feed, what would be the best alternative way (e.g. bindplane file-based config) ?

Thanks in advance!
Exchange message trace report API documentation: MessageTrace report | Microsoft Learn

[kentphelps · Accepted solution]

You may want to try some kind of intermediary tool such as cribl:
https://docs.cribl.io/stream/sources-office365-msg-trace/
https://docs.cribl.io/stream/destinations-google_chronicle/

[b41s]

These are great resources @kentphelps , i'll accept it as a solution. Cheers.