search

counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

GCC High - Endpoint Used Returning no data #25

Closed cyanitol closed 4 years ago

cyanitol commented 4 years ago

I don't see an option in the settings to change the endpoint API URLs. When attempting to use this for GCC high environments it will not work and returns empty data due to the wrong endpoint being targeted for the API.

Endpoint Mapping information can be found here: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory/fundamentals/whats-new-microsoft-365-government.md

https://docs.microsoft.com/en-us/office365/enterprise/office-365-u-s-government-gcc-high-endpoints

chris-counteractive commented 4 years ago

Great idea, this should be a straightforward enhancement. We don't have a GCC high instance to test on and the docs don't cover whether there are any differences when using those endpoints - would you be able to let me know if it works once I get you a build that lets you customize those endpoints? Should be soon.

The relevant code is here, I'll look to add config variables that default to the "normal" (read, commercial) endpoints, but can be updated for other environments like so:

o365beat:
  login_url: login.microsoftonline.us  # default is https://login.microsoftonline.com/
  resource_url: manage.office365.us    # default is https://manage.office.com/
  # rest of your config ...
cyanitol commented 4 years ago

Awesome. I made some modifications to the endpoints for testing the other day, and it has been working excellent. Diff attached. diff.txt

chris-counteractive commented 4 years ago

Gotta love open source, thanks for testing that, and thanks for reaching out so others can benefit from it. I'll work a configurable option into a new build soon, thanks again.

chris-counteractive commented 4 years ago

The beat pulls the login url and resource urls from the config file as of https://github.com/counteractive/o365beat/commit/dcdf24e4a3d4ff9fac69c3abc1c7a67e33847752, I'll update the documentation and wrap it all into the next release, and that should do it for this one. Thanks again for the issue.

chris-counteractive commented 4 years ago

Released in v1.5.0.