gravwell/o365 repository overview

The Gravwell O365 ingester is designed to pull logs from the Microsoft Office 365 API and ingest them into the Gravwell system. The ingester can process all supported log types. In order to configure the ingester, you will need to register a new application within the Azure Active Directory management portal; this will generate a set of keys which can be used to access the logs. You will need the following information:

Additional information on how to configure O365 can be found on in the ingester documentation⁠ page.

Refer to Gravwell's Docker guide⁠ for information on how to deploy ingester containers.

Note: Because this is a Linux application, we strongly recommend running under Docker on a Linux host. Performance may suffer on other operating systems. MacOS users on ARM64 may experience stability issues due to the AMD64 to ARM64 translation layer.