The office365 wodle uses the Microsoft 365 Management Activity API to pull unified audit logs (Exchange, SharePoint, Teams, Entra ID, DLP) into Wazuh. You need an Azure AD app with Office365ManagementActivity permissions.
1. Register the app and grant permissions
In Entra ID create an App Registration, add a client secret, then grant Office 365 Management APIs -> ActivityFeed.Read and ServiceHealth.Read with admin consent.
2. Enable unified audit logging
Connect-ExchangeOnline
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true3. Configure the wodle
<wodle name="office365">
<disabled>no</disabled>
<interval>10m</interval>
<curl_max_size>1M</curl_max_size>
<only_future_events>yes</only_future_events>
<api_auth>
<tenant_id>TENANT_ID</tenant_id>
<client_id>CLIENT_ID</client_id>
<client_secret>CLIENT_SECRET</client_secret>
</api_auth>
<subscriptions>
<subscription>Audit.AzureActiveDirectory</subscription>
<subscription>Audit.Exchange</subscription>
<subscription>Audit.SharePoint</subscription>
<subscription>Audit.General</subscription>
</subscriptions>
</wodle>4. Restart the manager
systemctl restart wazuh-managerNote: Built-in office365 rules decode mailbox access, OAuth consent grants, sharing policy changes and impossible-travel logins.
We build Microsoft 365 detection packs (BEC, OAuth abuse, mailbox exfil), contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhMicrosoft 365O365Cloud