Microsoft Exchange Online Message Trace

Version	1.25.0 (View all)
Compatible Kibana version(s)	8.13.0 or higher
Supported Serverless project types What’s this?	Security Observability
Subscription level What’s this?	Basic
Level of support What’s this?	Elastic

This integration is for Microsoft Exchange Online Message Trace logs. It includes the following datasets for receiving logs over the Microsoft Exchange Online Message Trace API or read from a file:

log dataset: supports Microsoft Exchange Online Message Trace logs.

Basic Auth Deprecation notification

edit

The basic authentication configuration fields have been removed from this integration as Microsoft has deprecated and disabled basic authentication for Exchange Online. See the deprecation notification for details.

Office 365 Account Requirements

edit

At a minimum, your Office 365 service account should include a role with Message Tracking and View‑Only Recipients permissions, assigned to the Office 365 user account that will be used for the integration. Assign these permissions using the Exchange admin center.

Logs

edit

Logs are either gathered via the rest API or via a logfile. Log Documentation

Microsoft Exchange Online Message Trace API

edit

The log dataset collects the Microsoft Exchange Online Message Trace logs. To search for ingested logs in Elasticsearch you need to query using datastream.dataset: microsoft_exchange_online_message_trace.log. This integration will poll the Microsoft Exchange Online Message Trace legacy API (https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace) to pull Message Trace logs and ingest them via the ingest pipelines.

Configuring with OAuth2

edit

In order to continue using the Microsoft Exchange Online Message Trace you will need to enable and configure OAuth2 authentication via your service app.

[discrete] === Service App Configuration
1. In the Azure portal, create a Microsoft Entra App (service app) Registration. For details please refer to the official Microsoft Documentation.
2. In most cases under the Redirect URI section, you would want to configure the value Web for the app type and http://localhost for the Redirect URI, unless there are some specific requirements on your end.
3. Assign the application at least one Microsoft Entra (Azure AD) role that will enable it to access the Reporting Web Service:
  - Security Reader
  - Global Reader
4. The App Registration should contain the following API permissions: Office 365 Exchange Online > ReportingWebService.Read.All (application). See Specify the permissions your app requires to access the Reporting Web Service.
[discrete] === Configuring OAuth2 Credentials

Once you have your service app registered and configured, you can now configure your OAuth2 credentials as follows:-
1. Generate a client secret for your registered service app. Copy and store the client secret value with you as this will be required for your OAuth2 credentials.
2. Fill in the following fields with the appropriate values from your configured service app:-
  - Client ID: The client_id of your service app to pass in the OAuth request parameter.
  - Client secret: The client_secret of your service app that you generated earlier, to pass in the OAuth request parameter.
  - Tenant ID: The Directory ID (tenant identifier) of your service app in your Microsoft Entra ID(Azure Active Directory).
    
    With these values now configured, the OAuth2 configuration for the integration should be ideally complete. For more details, please check the official doc for Getting Started with Reporting Web Service.

NOTE

edit

For configuring Local Domains you can check your Microsoft Admin Exchange Center for the domains available in your organization. They are usually under the sections https://admin.exchange.microsoft.com//accepteddomains[Accepted Domains] and https://admin.exchange.microsoft.com//remotedomains[Remote Domains].
The default Polling Interval and Initial Interval values are configured to 1h, you can however change these to your required values. The look-back value of Initial Interval should not exceed 200 hours as this might cause unexpected errors with the API.
The default Additional Look-back Time value is configured for 1h. This is intended to capture events that may not have been initially present due to eventual consistency. This value does not need to exceed 24h.
- NOTE: The larger this value is, the less likely events will be missed, however, this will cause the integration to take longer to pull all events, making newer events take longer to become present.
The default value of Batch Size is set to 1000. This means for every request Httpjson will paginate with a value of 1000 results per page. The maximum page size supported by the Message Trace API is 2000. The API will return an empty value array when there are no more logs to pull and the pagination will terminate with an error that can be ignored.

Logfile collection

edit

Disclaimer: With basic authentication support now disabled, the PowerShell script provided below will not work as is. However, you can see the guides here on how to connect to PowerShell using different authentication techniques using the EXO V2 and V3 modules. With a combination of the script below and the alternate authentication methods mentioned in the guide, you can possibly perform the logfile collection as usual.

The following sample Powershell script may be used to get the logs and put them into a JSON file that can then be consumed by the logfile input:

Prerequisites:

Install the Exchange Online Management module by running the following command:

Install-Module -Name ExchangeOnlineManagement

Import the Exchange Online Management module by running the following command:

Import-Module -Name ExchangeOnlineManagement

This script would have to be triggered at a certain interval, in accordance with the look-back interval specified. In this example script, the look back would be 24 hours, so the interval would need to be daily. According to the Documentation, it is only possible to get up to 1k pages. If this should be an issue, try reducing the $looback or increasing $pageSize.

# Username and Password
$username = "USERNAME@DOMAIN.TLD"
$password = "PASSWORD"
# Lookback in Hours
$lookback = "-24"
# Page Size, should be no problem with 1k
$pageSize = "1000"
# Output of the json file
# This would then be ingested via the integration
$output_location = "C:\temp\messageTrace.json"

$password = ConvertTo-SecureString $password -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential ($username, $password)
$startDate = (Get-Date).AddHours($lookback)
$endDate = Get-Date

Connect-ExchangeOnline -Credential $Credential
$paginate = 1
$page = 1
$output = @()
while ($paginate -eq 1)
{
    $messageTrace = Get-MessageTrace -PageSize $pageSize -StartDate $startDate -EndDate $endDate -Page $page
    $page
    if (!$messageTrace)
    {
        $paginate = 0
    }
    else
    {
        $page++
        $output = $output + $messageTrace
    }
}
if (Test-Path $output_location)
{
    Remove-Item $output_location
}
foreach ($event in $output)
{
    $event.StartDate = [Xml.XmlConvert]::ToString(($event.StartDate), [Xml.XmlDateTimeSerializationMode]::Utc)
    $event.EndDate = [Xml.XmlConvert]::ToString(($event.EndDate), [Xml.XmlDateTimeSerializationMode]::Utc)
    $event.Received = [Xml.XmlConvert]::ToString(($event.Received), [Xml.XmlDateTimeSerializationMode]::Utc)
    $event = $event | ConvertTo-Json -Compress
    Add-Content $output_location $event -Encoding UTF8
}

Example

An example event for log looks as following:

{
    "@timestamp": "2022-10-21T17:25:30.600Z",
    "agent": {
        "ephemeral_id": "1928ec83-7c3a-4ad0-9066-63dae084a2e1",
        "id": "bd32c689-9c8b-44ea-ae34-b04c1bf3fd7d",
        "name": "elastic-agent-75168",
        "type": "filebeat",
        "version": "8.15.3"
    },
    "data_stream": {
        "dataset": "microsoft_exchange_online_message_trace.log",
        "namespace": "89156",
        "type": "logs"
    },
    "destination": {
        "domain": "contoso.com",
        "registered_domain": "contoso.com",
        "top_level_domain": "com",
        "user": {
            "domain": "contoso.com",
            "email": "linus@contoso.com",
            "id": "linus@contoso.com",
            "name": "linus"
        }
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "bd32c689-9c8b-44ea-ae34-b04c1bf3fd7d",
        "snapshot": false,
        "version": "8.15.3"
    },
    "email": {
        "attachments": {
            "file": {
                "size": 22704
            }
        },
        "delivery_timestamp": "2022-10-21T17:25:30.6006882Z",
        "from": {
            "address": [
                "noreply@azure.microsoft.com"
            ]
        },
        "local_id": "a6f62809-5cda-4454-0962-08dab38940d6",
        "message_id": "<GVAP278MB037518E76F4082DFE9B607B3DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM>",
        "subject": "testmail 1",
        "to": {
            "address": [
                "linus@contoso.com"
            ]
        }
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "email"
        ],
        "created": "2024-11-04T20:39:54.654Z",
        "dataset": "microsoft_exchange_online_message_trace.log",
        "end": "2022-10-22T09:40:10.000Z",
        "ingested": "2024-11-04T20:39:57Z",
        "original": "{\"EndDate\":\"2022-10-22T09:40:10Z\",\"FromIP\":\"40.107.23.81\",\"Index\":1,\"MessageId\":\"\\u003cGVAP278MB037518E76F4082DFE9B607B3DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM\\u003e\",\"MessageTraceId\":\"a6f62809-5cda-4454-0962-08dab38940d6\",\"Organization\":\"contoso.com\",\"Received\":\"2022-10-21T17:25:30.6006882Z\",\"RecipientAddress\":\"linus@contoso.com\",\"SenderAddress\":\"noreply@azure.microsoft.com\",\"Size\":22704,\"StartDate\":\"2022-10-21T09:40:10Z\",\"Status\":\"Delivered\",\"Subject\":\"testmail 1\",\"ToIP\":null}",
        "outcome": "success",
        "start": "2022-10-21T09:40:10.000Z",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "microsoft": {
        "online_message_trace": {
            "EndDate": "2022-10-22T09:40:10Z",
            "FromIP": "40.107.23.81",
            "Index": 1,
            "MessageId": "<GVAP278MB037518E76F4082DFE9B607B3DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM>",
            "MessageTraceId": "a6f62809-5cda-4454-0962-08dab38940d6",
            "Organization": "contoso.com",
            "Received": "2022-10-21T17:25:30.6006882Z",
            "RecipientAddress": "linus@contoso.com",
            "SenderAddress": "noreply@azure.microsoft.com",
            "Size": 22704,
            "StartDate": "2022-10-21T09:40:10Z",
            "Status": "Delivered",
            "Subject": "testmail 1"
        }
    },
    "related": {
        "user": [
            "linus@contoso.com",
            "noreply@azure.microsoft.com",
            "linus",
            "noreply"
        ]
    },
    "source": {
        "domain": "azure.microsoft.com",
        "ip": "40.107.23.81",
        "registered_domain": "microsoft.com",
        "subdomain": "azure",
        "top_level_domain": "com",
        "user": {
            "domain": "azure.microsoft.com",
            "email": "noreply@azure.microsoft.com",
            "id": "noreply@azure.microsoft.com",
            "name": "noreply"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.	date
data_stream.dataset	The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: * Must not contain `-` * No longer than 100 characters	constant_keyword
data_stream.namespace	A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: * Must not contain `-` * No longer than 100 characters	constant_keyword
data_stream.type	An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future.	constant_keyword
event.dataset	Event dataset	constant_keyword
input.type		keyword
log.offset		long
microsoft.online_message_trace.EndDate	This field is used to limit the report period. Use this field in a $filter query option to set the end date and time of the reporting period. If you supply EndDate in the $filter option, you must also supply StartDate. In this report, this field corresponds to the date and time of the last processing step recorded for the message.	date_nanos
microsoft.online_message_trace.FromIP	The IPv4 or IPv6 address that transmitted the message to the Office 365 email system.	keyword
microsoft.online_message_trace.Index		long
microsoft.online_message_trace.MessageId	The Internet MessageID header of the message, if one was supplied. This value can also be explicitly null.</p></td>	keyword
microsoft.online_message_trace.MessageTraceId	An identifier used to get the detailed message transfer trace information.</p></td>	keyword
microsoft.online_message_trace.Organization	The fully qualified domain name that was processing the email.</p></td>	keyword
microsoft.online_message_trace.Received	The date and time when the email was received by the Office 365 email system. This corresponds to the Date field of the first message trace detail entry.</p></td>	date_nanos
microsoft.online_message_trace.RecipientAddress	The SMTP email address of the user that the message was addressed to.</p></td>	keyword
microsoft.online_message_trace.SenderAddress	The SMTP email address of the user the message was purportedly from. Because sender addresses are commonly spoofed in spam email, they are not considered completely reliable.</p></td>	keyword
microsoft.online_message_trace.Size	The size of the message, in bytes.	long
microsoft.online_message_trace.StartDate	This field is used to limit the report period. Use this field in a $filter query option to set the start date and time of the reporting period. If you provide a StartDate in the $filter option, you must also specify an EndDate. In this report, this field corresponds to the date and time of the first processing step recorded for the message.</p></td>	date_nanos
microsoft.online_message_trace.Status	The status of the message in the Office 365 email system. This corresponds to the Detail field of the last processing step recorded for the message.</p></td>	keyword
microsoft.online_message_trace.Subject	The subject line of the message, if one was present for the message.</p></td>	keyword
microsoft.online_message_trace.ToIP	The IPv4 or IPv6 address that the Office 365 email system sent the message to.</p></td>	keyword

Changelog

edit

Changelog

Version	Details	Kibana version(s)
1.25.0	Enhancement (View pull request) Do not remove `event.original` in main ingest pipeline.	8.13.0 or higher
1.24.0	Enhancement (View pull request) Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".	8.13.0 or higher
1.23.1	Bug fix (View pull request) Improve document fingerprinting resolution.	8.13.0 or higher
1.23.0	Enhancement (View pull request) Add `event.category` and `event.type` to all events.	8.13.0 or higher
1.22.1	Bug fix (View pull request) Clarify configuration documentation.	8.13.0 or higher
1.22.0	Enhancement (View pull request) Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.	8.13.0 or higher
1.21.2	Bug fix (View pull request) Fix template to not fail without local domains.	8.12.0 or higher
1.21.1	Bug fix (View pull request) Fix sample event.	8.12.0 or higher
1.21.0	Enhancement (View pull request) Make `event.outcome` field conform to ECS field definition.	8.12.0 or higher
1.20.0	Enhancement (View pull request) Improve handling of empty responses.	8.12.0 or higher
1.19.0	Enhancement (View pull request) Set sensitive values as secret.	8.12.0 or higher
1.18.1	Enhancement (View pull request) Changed owners	8.7.1 or higher
1.18.0	Enhancement (View pull request) Add ability to configure addition look-back time. Bug fix (View pull request) Fix issue with cursor potentially causing data gaps.	8.7.1 or higher
1.17.2	Bug fix (View pull request) Fix exclude_files pattern.	8.7.1 or higher
1.17.1	Bug fix (View pull request) Updated httpjson template to fix a breaking issue due to an extra ] present. Updated tests parameters to suit the change.	8.7.1 or higher
1.17.0	Enhancement (View pull request) Updated httpjson template to parse data correctly, reworked the documentation and updated the default template values.	8.7.1 or higher
1.16.0	Enhancement (View pull request) Limit request tracer log count to five.	8.7.1 or higher
1.15.0	Enhancement (View pull request) ECS version updated to 8.11.0.	8.7.1 or higher
1.14.0	Enhancement (View pull request) Improve event.original check to avoid errors if set.	8.7.1 or higher
1.13.1	Bug fix (View pull request) Cleaned up documentation and fixed the default values for scope & login_url.	8.7.1 or higher
1.13.0	Enhancement (View pull request) ECS version updated to 8.10.0.	8.7.1 or higher
1.12.0	Enhancement (View pull request) The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added owner.type: elastic to package manifest.	8.7.1 or higher
1.11.0	Enhancement (View pull request) Add tags.yml file so that integration’s dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.	8.7.1 or higher
1.10.0	Enhancement (View pull request) Update package to ECS 8.9.0.	8.7.1 or higher
1.9.0	Enhancement (View pull request) Document duration units.	8.7.1 or higher
1.8.0	Enhancement (View pull request) Update package-spec to 2.9.0.	8.7.1 or higher
1.7.0	Enhancement (View pull request) Convert dashboards to Lens.	8.7.1 or higher
1.6.0	Enhancement (View pull request) Document valid duration units.	8.7.1 or higher
1.5.0	Enhancement (View pull request) Ensure event.kind is correctly set for pipeline errors.	8.7.1 or higher
1.4.0	Enhancement (View pull request) Update package to ECS 8.8.0.	8.7.1 or higher
1.3.0	Enhancement (View pull request) Add a new flag to enable request tracing	8.7.1 or higher
1.2.0	Enhancement (View pull request) Update package to ECS 8.7.0.	8.0.0 or higher
1.1.0	Enhancement (View pull request) Deprecated basic auth fields and added support for OAuth2.	8.0.0 or higher
1.0.0	Enhancement (View pull request) Release Microsoft Exchange Online Message Trace as GA.	8.0.0 or higher
0.4.1	Enhancement (View pull request) Added categories and/or subcategories.	—
0.4.0	Enhancement (View pull request) Added the ability to configure request.timeout Bug fix (View pull request) Add Missing event.created and event.start ECS mappings	—
0.3.0	Enhancement (View pull request) Retain original data in structured format. Enhancement (View pull request) Map fields to ECS.	—
0.2.0	Enhancement (View pull request) Update package to ECS 8.6.0.	—
0.1.0	Enhancement (View pull request) Update package to ECS 8.5.0.	—
0.0.1	Enhancement (View pull request) Initial draft of the package for Microsoft Exchange Online Message Trace logs	—

« Microsoft Entra ID Entity Analytics Microsoft Exchange Server »