Skip to main content

Office 365 Rule Pack

Dashboards Deployment for Security Monitoring Based on the Elastic Stack

Written by Andrew Vdovin

Overview

This guide describes how to deploy Dashboards for security monitoring for Office 365 Rule Pack based on the Elastic Stack.

After the successful integration of Office 365 logs into your Elastic Stack environment, first of all, you need to understand your Office 365 scope, as well as sort out a huge amount of collected information in a clear and manageable way. SOC Prime Platform allows analyzing data and presenting it in a user-friendly way using data visualization tools, more specifically:

  • List or number of users

  • Hosting particular events by type

  • Geo-distribution

  • Daily and weekly periodic peaks

  • Failure codes distribution

Downloading Security Monitoring for Office365 SaaS Platform Rule Pack from the SOC Prime Platform

  1. Log in to the SOC Prime Platform with your user credentials.

  2. Go to Content > Advanced Search.

  3. In the search bar, enter Security Monitoring for Office365 SaaS Platform Rule Pack and select the corresponding option from the suggestions.

  4. Click the Security Monitoring for Office365 SaaS Platform Rule Pack item to drill down to it.

  5. Check the Description & Log Source Requirements section to make sure that the following requirements are met:

    • Logs are in place

    • Index patterns are created

    • Elastic Stack Vision is in line with recommendations

  6. Download the content by clicking the Download button.

    In this case, you can download 4 Dashboards that are included in Security Monitoring for Office365 SaaS Platform Rule Pack.

Deploying Dashboards for Office365 from the SOC Prime Platform to Your Kibana Instance

Once downloaded, you will get the entire Content Pack including Kibana Dashboards, Elasticsearch Watchers, Logstash Configs, and Python Scripts.

  1. Log in to the Kibana instance using your credentials, so you can import the downloaded content.

  2. Click Import, and then select the downloaded dashboard_and_visualization.ndjson file to import it to Kibana.

Note:

Choose the index pattern where logs are stored.

You should see 4 Static Dashboards created, like the following:

You can use them for any kind of filtering across all your stored data, cross-check the information from different visualizations, and combine it.

In case there are missing fields, you can edit any visualization as per your index field templates.

1

2

3

4

Content Rating & Reviewing

We encourage security practitioners to leave a review on the recently explored threat detection content so we can make your experience with the SOC Prime Platform even better and increase the content quality.

To share your feedback on the downloaded content:

  1. Click the Write Review button if the review panel is hidden.

  2. Choose how to provide your feedback.

    1. Rate content using the star rating system

    2. Write your review on the content quality

  3. For an anonymous review, select the corresponding checkbox.

  4. Click the Submit button.

Troubleshooting

If you have encountered any issues and need assistance, contact us in the live chat available on any page of the SOC Prime Platform:

  1. Click the chat icon in the lower right corner of the screen.

  2. Select the Messages tab and click Send us a message.

  3. Describe your issue or question mentioning the name of the content item they are related to.

Did this answer your question?