Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suitable method to pull Office 365 Security and Compliance Threat Management Explorer [All emails] data using an API #206

Open
prashasth opened this issue Dec 7, 2020 · 0 comments

Comments

@prashasth
Copy link

I need to fetch all email data from the threat explorer view. Currently what I do is search the email in the filter and use the export email list

I get output in the format of a CSV file having data headers mentioned below with relevant data of the respective emails:
Email date (UTC),Recipients,Subject,Sender,Sender IP,Sender domain,Delivery action,Latest delivery location,Original delivery location,Internet message ID,Network message ID,Mail language,Original recipients,Additional actions,Threats,File threats,File hash,Threats / Detection technologies,Final system override,Tenant system override(s),User system override(s),Directionality,URLs,Sender tags,Recipient tags,Connector

Is there a way I can fetch these data using API? If yes, what is the exact API?

Office 365 -2

Office 365

Note: I have also tried Microsoft management activity API but I am super confused about which specific schema to be used here in this case. I see that there are 5 schemas: Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All

Also if it is Audit.General, which specific product schema are we referencing?

I am looking exactly at the data which gets the fetch all email data from the threat explorer which I currently use the export email list option.
Also, I do not see these in the schema responses as per this link Managmenet API schema:
"Email date (UTC),Recipients,Subject,Sender,Sender IP,Sender domain,Delivery action,Latest delivery locationOriginal recipients,Additional actions,Threats,File threats,File hash,Threats Detection technologies,Final system override,Tenant system override(s),User system override(s),Directionality"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant