Kaspersky Next XDR Expert
1.2
Managing Kaspersky Unified Monitoring and Analysis Platform  >  User guide  >  KUMA resources  >  Connectors  >  Connector settings  >  Connector, office365 type
Connector, office365 type

Connectors of the office365 type are used for receiving Microsoft 365 (Office 365) data via the API.

Available settings for a connector of the office365 type are described in the following tables.

Basic settings tab

Setting

Description

Name

Unique name of the resource. The maximum length of the name is 128 Unicode characters.

Required setting.

Tenant

The name of the tenant that owns the resource.

Required setting.

Type

Connector type: office365.

Required setting.

Tags

Tags for resource search.

Optional setting.

Office365 content types

Content types that you want to receive in KUMA. The following content types are available, providing information about actions and events in Microsoft 365, grouped by information source:

  • Audit.General
  • Audit.AzureActiveDirectory
  • Audit.Exchange
  • Audit.Sharepoint
  • DLP.All

You can find detailed information about the properties of the available content types and related events in the schema on the Microsoft website.

Required setting. You can select one or more content types.

Office365 tenant ID

Unique ID that you get after registering an account with Microsoft 365. If you do not have one, contact your administrator or Microsoft.

Required setting.

Office365 client ID

Unique ID that you get after registering an account with Microsoft 365. If you do not have one, contact your administrator or Microsoft.

Required setting.

Authorization

Authorization method for connecting to Microsoft 365. The following authorization methods are available:

  • PFX. Using a PFX secret.
  • Token. Using a 'token' secret.

For more information, see the section on secrets.

Office365 credentials

The field becomes available after selecting the authorization method. You can select one of the available authorization secrets or create a new secret of the selected type.

Required setting.

Description

Description of the resource. The maximum length of the description is 4000 Unicode characters.

Advanced settings tab

Setting

Description

Debug

Ths switch enables resource logging. The toggle switch is turned off by default.

Character encoding

Character encoding. The default is UTF-8.

Authentication host

The URL that is used for connection and authorization.

By default, a connection is made to https://login.microsoftonline.com.

Resource host

URL from which the events are to be received.

The default address is https://manage.office.com.

Retrospective analysis interval, hours

The period for which all new events are requested, in hours. To avoid losing some events, it is important to set overlapping event reception intervals, because some types of Microsoft 365 content may be sent with a delay. In this case, previously received events are not duplicated.

By default, all new events for the last 12 hours are requested.

Request timeout, sec

Time to wait for a response to a request to get new events, in seconds. The default response timeout is 30 seconds.

Repeat interval, sec

The time in seconds after which a failed request to get new events must be repeated.

By default, a request to get new events is repeated 10 seconds after getting an error or no response within the specified timeout.

Clear interval, sec

How often obsolete data is deleted, in seconds.

The minimum value is 300 seconds. By default, obsolete data is deleted every 1800 seconds.

Poll interval, min

How often requests for new events are sent, in minutes.

By default, requests are sent every 10 minutes.

Proxy server

Proxy settings, if necessary to connect to Microsoft 365.

You can select one of the available proxy servers or create a new proxy server.
Article ID: 295203, Last review: Apr 14, 2025
Page top