search

counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

GCC High no available content locations: #57

Open mgovolt opened 3 years ago

mgovolt commented 3 years ago

I get o365beat[17747]: 2021-05-20T01:17:13.009Z#011DEBUG#011[api]#011beater/o365beat.go:336#011got these available content locations: [] When attempting to connect to GCC High using these values: login_url: 'https://login.microsoftonline.us' resource_url: 'https://manage.office365.us'

That is what was in the instructions. Is there something else to do for GCC High? Do content locations have different names?

mgovolt commented 3 years ago

Actually, let me amend this. I am getting audit.Exchange events. However this is a new GCC High environment and the only real activity is in Azure AD, but it is not seeing any Audit.AzureActiveDirectory events. Content Types are set at: content_types: