Office 365 Security Monitoring

Prerequisites

• Opsview Monitor Version 6.0.0 (released 07 September 2018) or newer. Check Opsview Release Notes for the latest version of Opsview Monitor.

Known Issues

• As of the time of development, an issue exists with Microsoft's Graph API HTTP 429 Too Many Requests responses. These are received when too many requests are made in a short period of time. The issue lies in that the Retry-After value in the header of the response is always 86 which inhibits us from using this value to know when to retry. As a result, the checks using this API will wait for 5 seconds before retrying, up to a maximum of 5 times.

Setup Office365 for Monitoring

To monitor your Office365 environment, you will need to retrieve the following credentials, which will allow Opsview Monitor access to the metrics for your Office365 Subscription:

• Tenant/Directory ID
• Client/Application ID
• Secret Key

Follow the steps below to retrieve this information.

Step 1: Find the Tenant ID

The Tenant/Directory ID can be found in the Azure Active Directory under the Properties section from the Azure dashboard.

Step 2: Find the Client/Application ID for your application

You need to create and register your application if you haven't already. Use the following documentation from Microsoft: Create an Azure Active Directory application

The Client/Application ID can be found in Azure Active Directory under the App registrations section from the Azure dashboard.

Step 3: Generate the Secret Key for your application

You will need to create a Secret Key for your application, once this has been created its value will be hidden so save the value during creation.

To create the Secret Key, select your application from the list, select the Settings within your application and then select the Keys option.

There you can create a new key by adding the description and expiration period and the value will be generated.

Step 4: Add Required Permissions

The appropriate permissions for the APIs used by these Office365 Host-Templates need to be added in Azure. From the same settings menu as above, go to Required Permissions under API ACCESS. Click Add, select the API and then choose the permissions for that API based on the table below.

API	Application Permissions	Delegated Permissions
Microsoft Graph

• Read all usage reports
• Read your organization’s security events

|

• Read all usage reports
• Read your organization’s security events

| | Office 365 Management APIs |

• Read activity data for your organization
• Read service health information for your organization

|

• Read activity data for your organization
• Read service health information for your organization

|

Setup and Configuration

Step 1: Add the Host Template

Add the Application - Office365 - Security Host Template to your Opsview Monitor host. If the resource you're monitoring has no hostname or public IP, then open the Advanced settings pane and change Host Check Command to Always assumed to be UP.

For more information, refer to Opsview Knowledge Center - Adding Host Templates to Hosts.

Step 2: Add and configure variables required for this host

| Variable | Description | |:------------- |:------------------ | | OFFICE365_CREDENTIALS | Used in authenticating services with Office 365. Override the Client ID, Secret Key and Tenant ID with your credentials. |

For more information, refer to Opsview Knowledge Center - Adding Variables to Hosts.

Step 3: Apply changes and the system will now be monitored

v2.2.1-opsview-6

ODI-3679 Fix missing metrics when missing data

v2.2-opsview-6

ODI-2929

• Add missing security level context,
• Fix exit code for broad exceptions

v2.1-opsview-6

ODI-2293 v2.1-opsview-6

Improve datetime retrieval

v2.0-opsview-6

ODI-38 v2.0-opsview-6

Initial release of Opspack to work with Opsview Monitor 6.0