Auditing and Reporting for Office 365
•Als PPTX, PDF herunterladen•
0 gefällt mir•931 views
As organizations move to Office 365, sometimes the finer details of the service can get over looked. To be able to manage your Office 365 tenant, you need to understand what auditing and reporting capabilities are built into Office 365, as well as what functionality is missing. A complete understanding of the features and functionality in place to protect your systems is essential to identifying threats, and planning a reaction. Drawing on his personal experiences assisting clients with migrations, Nathan O’Bryan (MCSM: Messaging, MVP: Office Servers and Services) will dive into the auditing and reporting features and functionality that are included with Office 365. He will cover how to properly implement protection for your systems in addition to real world tips and practical lessons learned for protecting your data in the cloud.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Andere mochten auch (12)
Mehr von ENow Software
Mehr von ENow Software (6)
KĂĽrzlich hochgeladen
KĂĽrzlich hochgeladen (20)
Auditing and Reporting for Office 365
- 1. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Auditing and Reporting for Office 365
- 2. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T @enowconsulting Find us! ENow Software ENowSoftware ENowSoftware.com Some of ENow’s Loyal Customers • Microsoft Silver ISV & Messaging Microsoft Partner • Focused on building software solutions that simplify the life of IT administrators • Software architected by MVPs with >15 years experience in high-end Microsoft consulting and management • Customers in over 60 countries ENow Software About ENow
- 3. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T
- 4. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T About the speaker – Nathan O’Bryan MVP: Office Servers and Services MCSM: Messaging Consultant @ SPS http://www.spscom.com @MCSMLab http://www.mcsmlab.com
- 5. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Introduction • Auditing and reporting is important to any organization • Office 365 is a collection of different resources, all developed separately • Microsoft is working toward a unified auditing and reporting system, but they are not there yet
- 6. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Auditing and Reporting • In Office 365, auditing and reporting is broken into two groups • Exchange • Everything else • “Everything else” is far behind Exchange for auditing and reporting features • All auditing and reporting in Office 365 requires Exchange in your tenant • Microsoft is working on bringing “everything else” up to the auditing and reporting standards of Exchange
- 7. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Mailbox Auditing • Mailbox auditing is about figuring out who did what and when they did it • First introduced in Exchange 2007 SP2 • 3 types of mailbox auditing • Owner • Delegates • Administrator • Mailbox auditing is not on by default
- 8. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 1 – Enable Mailbox Auditing • Verify mailbox auditing is on for a mailbox • Verify mailbox auditing is on for multiple mailboxes • Turn mailbox auditing on • Verify what actions are being audited
- 9. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Mailbox actions logged Action Description Admin Delegate Owner Copy An item is copied to another folder. Yes No No Create An item is created in the Calendar, Contacts, Notes, or Tasks folder in the mailbox; for example, a new meeting request is created. Note that message or folder creation isn't audited. Yes* Yes* Yes FolderBind A mailbox folder is accessed. Yes* Yes No HardDelete An item is deleted permanently from the Recoverable Items folder. Yes* Yes* Yes MailboxLogin The user signed in to their mailbox. No No Yes MessageBind An item is accessed in the reading pane or opened. Yes No No Move An item is moved to another folder. Yes* Yes Yes MoveToDeletedItems An item is moved to the Deleted Items folder. Yes* Yes Yes SendAs A message is sent using Send As permissions. Yes* Yes* No SendOnBehalf A message is sent using Send on Behalf permissions. Yes* Yes No SoftDelete An item is deleted from the Deleted Items folder. Yes* Yes* Yes Update An item's properties are updated. Yes* Yes* Yes * Audited by default if auditing is enabled for a mailbox.
- 10. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 2 – Configuring Mailbox Auditing • Set what actions are audited • Set audit log age limit • Determine size of mailbox audit log • Delete mailbox audit log entries
- 11. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 3 – Searching Mailbox Audit Log • Search mailbox audit log • Search for limited results • Search for specific actions on specific dates • Start mailbox audit log report • Search for external access • Show running audit log searches
- 12. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Auditing across Office 365 applications • Recently Microsoft has added more auditing and reporting around SharePoint Online and OneDrive • Office 365 compliance center • Search-UnifiedAuditLog • AzureActiveDirectory • AzureActiveDirectoryAccountLogon • ExchangeAdmin • ExchangeItem • ExchangeItemGroup • SharePoint • SharePointFileOperation
- 13. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Audit Storage Architecture
- 14. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 4 – Search Unified Audit Log • Search unified audit log • Convert audit data from JSON format • Search for SharePoint file operations • Search for Azure AD operations • Search for Azure AD account login operations
- 15. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Reporting web service Office 365 Reporting web service reference page Office 365 reporting-related Windows PowerShell cmdlets CsActiveUser* reports Get-CsAVConferenceTimeReport CsAVConferenceTime* reports Get-CsActiveUserReport CsConference* reports Get-CsConferenceReport CsP2PAVTime* reports Get-CsP2PAVTimeReport CsP2PSession* reports Get-CsP2PSessionReport ConnectionbyClientType* reports Get-ConnectionByClientTypeReport ConnectionbyClientTypeDetail* reports Get-ConnectionByClientTypeDetailReport GroupActivity* reports Get-GroupActivityReport MailboxActivity* reports Get-MailboxActivityReport MailboxUsage report Get-MailboxUsageReport MailboxUsageDetail report Get-MailboxUsageDetailReport MailDetail report Get-MailDetailReport MailDetailDlpPolicy report Get-MailDetailDlpPolicyReport MailDetailMalware report Get-MailDetailMalwareReport MailDetailSpam report Get-MailDetailSpamReport MailDetailTransportRule report Get-MailDetailTransportRuleReport MailFilterList report Get-MailFilterListReport MailTraffic report Get-MailTrafficReport MailTrafficPolicy report Get-MailTrafficPolicyReport MailTrafficSummary reports Get-MailTrafficSummaryReport MailTrafficTop report Get-MailTrafficTopReport MessageTrace report Get-MessageTrace MessageTraceDetail report Get-MessageTraceDetail MxRecordReport report Get-MxRecordReport OutboundConnectorReport report Get-OutboundConnectorReport ServiceDeliveryReport report Get-ServiceDeliveryReport StaleMailbox report Get-StaleMailboxReport StaleMailboxDetail report Get-StaleMailboxDetailReport
- 16. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 5 – Reporting Web Service • Mx record report • Outbound connector report • Mail traffic summary report • Stale mailbox detail report • Connection by client type report • Av conference time report
- 17. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Security & Compliance Center • Intended to be single portal for all Security & Compliance administration needs • Work in progress
- 18. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 6 – Security & Compliance Center • Separate PowerShell connection • Available commands • Reports • Compliance Search
- 19. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Accessing GUI Mailbox Audit Reports • EAC > Compliance Management > Auditing • Office 365 Compliance Center
- 20. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Demo 7 – Office 365 GUI reports
- 21. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Summary • PowerShell is the best native way to get information out of Office 365 auditing and reporting • Office 365 canned reports are not currently very flexible • PowerShell reports may not be acceptable for management
- 22. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Q&A
- 23. A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T Thank You www.enowsoftware.com
Hinweis der Redaktion
- https://technet.microsoft.com/en-us/library/ff459237(v=exchg.160).aspx
- # DEMO 1 Get-Mailbox Nathan | Format-List Audit* Get-Mailbox | Format-Table Name, AuditEnabled -AutoSize Get-Mailbox | Where-Object {$_.AuditEnabled -Eq "True"} | Format-Table Name, AuditEnabled -AutoSize Get-Mailbox | Where-Object {$_.AuditEnabled -Ne "True"} | Format-Table Name, AuditEnabled -AutoSize Set-Mailbox –Identity Joe –AuditEnabled $True Get-Mailbox | Format-Table Name, AuditEnabled -AutoSize Get-Mailbox Nathan | Select -ExpandProperty AuditAdmin Get-Mailbox Nathan | Select -ExpandProperty AuditOwner Get-Mailbox Nathan | Select -ExpandProperty AuditDelegate # End DEMO 1
- https://technet.microsoft.com/en-us/library/ff459237(v=exchg.160).aspx#actions
- # DEMO 2 Set-Mailbox –Identity Joe -AuditAdmin None –AuditDelegate None -AuditOwner None Get-Mailbox Joe | Format-List Audit* Set-Mailbox -Identity Joe -AuditDelegate Create, FolderBind, HardDelete, Move, MoveToDeletedItems, SendAs, SendOnBehalf, SoftDelete, Update Set-Mailbox –Identity Joe –AuditEnabled $False Get-Mailbox Joe | Format-List Audit* Set-Mailbox Joe -AuditLogAgeLimit 24855.03:14:07 Get-Mailbox Joe | Format-List Audit* Get-MailboxFolderStatistics Nathan | Where-Object {$_.Name -eq "Audits"} | Format-Table Name, ItemsInFolder, FolderSize -AutoSize Set-Mailbox Joe -AuditLogAgeLimit 00:00:00 Start-ManagedFolderAssistant Joe Get-MailboxFolderStatistics Joe | Where-Object {$_.Name -eq "Audits"} | Format-Table Name, ItemsInFolder, FolderSize -AutoSize # End DEMO 2
- # DEMO 3 Search-MailboxAuditLog Nathan -ShowDetails Search-MailboxAuditLog Nathan -ShowDetails -ResultSize 10 | Format-Table Operation, OperationResult, LogonType, LastAccessed -AutoSize Search-MailboxAuditLog Nathan -ShowDetails -StartDate 04/10/2016 -EndDate 04/12/2016 | Where-Object {$_.Operation -Eq "MoveToDeletedItems" -Or $_.Operation -Eq "HardDelete" -Or $_.Operation -Eq "SoftDelete"-And $_.FolderPathName -Eq "\Inbox"} | Format-Table Operation, OperationResult, LogonType, LastAccessed, FolderPathName, SourceItemSubjectsList -AutoSize New-MailboxAuditLogSearch -Name "Demo Search Mailbox" -Mailboxes Nathan -ShowDetails -LogonTypes Delegate -StartDate 4/6/2016 -EndDate 4/7/2016 -StatusMailRecipients Nathan@MCSMLab.com Get-AuditLogSearch Get-AdminAuditLogConfig Search-AdminAuditLog -Cmdlets Set-* | Format-Table CmdletName, Caller, RunDate, Succeeded -AutoSize Search-AdminAuditLog –StartDate 04/01/2016 –EndDate 04/10/2016 –ExternalAccess $True | Out-GridView Search-AdminAuditLog –StartDate 04/01/2016 –EndDate 04/10/2016 –ExternalAccess $True | Sort CmdletName | Group CmdletName | Format-Table Count, Name New-AdminAuditLogSearch -Name "Demo Search Admin" -StartDate 1/1/2016 -EndDate 4/7/2016 -Cmdlets Set-Mailbox -Parameters UseDatabaseQuotaDefaults, ProhibitSendReceiveQuota -StatusMailRecipients Nathan@MCSMLab.com Get-AuditLogSearch # End DEMO 3
- # DEMO 4 Search-UnifiedAuditLog -StartDate 4/1/2016 -EndDate 4/10/2016 -RecordType SharePointFileOperation -ResultSize 1 $Output = Search-UnifiedAuditLog -StartDate 4/1/2016 -EndDate 4/10/2016 -RecordType SharePointFileOperation -ResultSize 1 $Results = ConvertFrom-Json -InputObject $Output.AuditData $Results Search-UnifiedAuditLog -StartDate 4/1/2016 -EndDate 4/10/2016 -RecordType SharePointFileOperation -ObjectIds "5-4 Auditing and Reporting for Office 365.pptx" | Where-Object {$_.Operations -Eq "FileModified"} | Format-Table UserIds, Operations, CreationDate -AutoSize Search-UnifiedAuditLog -StartDate 4/1/2016 -EndDate 4/10/2016 -RecordType AzureActiveDirectory | Format-Table CreationDate, Operations, UserIds -AutoSize Search-UnifiedAuditLog -StartDate 4/1/2016 -EndDate 4/10/2016 -RecordType AzureActiveDirectoryAccountLogon | Format-Table CreationDate, Operations, UserIds -AutoSize # End DEMO 4
- https://msdn.microsoft.com/en-us/library/office/jj984326.aspx
- # DEMO 5 Get-MxRecordReport -Domain mcsmlab.com Get-OutboundConnectorReport -Domain mcsmlab.com Get-MessageTrace -SenderAddress nathan@mcsmlab.com -StartDate 04/1/2016 -EndDate 04/6/2016 Get-MailTrafficSummaryReport -Category TopMailSender -StartDate 01/1/2016 -EndDate 01/30/2016 Get-MailTrafficSummaryReport -Category TopSpamRecipient -StartDate 01/1/2016 -EndDate 01/30/2016 Get-StaleMailboxDetailReport Get-ConnectionByClientTypeDetailReport -StartDate 04/1/2016 -EndDate 04/10/2016 Get-CsConferenceReport -ReportType Monthly -StartDate 01/01/2016 -EndDate 01/31/2016 Get-CsAVConferenceTimeReport -ReportType Monthly -StartDate 01/01/2016 -EndDate 01/31/2016 # End DEMO 5
- # Connect SCC PS [CmdLetBinding()]param([Parameter(Position=0,Mandatory=$false)][Switch]$ProxyEnabled) if($ProxyEnabled){$Session = New-Pssession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential (Get-Credential) -Authentication Basic -AllowRedirection -sessionOption (New-PsSessionOption -ProxyAccessType IEConfig -ProxyAuthentication basic)} else{$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Authentication Basic -AllowRedirection -Credential (get-credential)} Import-PSSession $session –AllowClobber -DisableNameChecking #Demo 6 Get-Command -Module tmp_vjigxxwl.faa Get-DeviceConfigurationPolicy | Format-Table Name, CreatedBy, DistributionStatusget-mail Get-HoldCompliancePolicy Get-eDiscoveryCaseAdmin Get-ComplianceSearch | Format-Table Get-ComplianceSearch -Identity "Test Search" | Format-Table Name, CreatedTime, Items, Size Get-ComplianceSearch -Identity "Specific Job" | Format-Table Name, CreatedTime, Items, Size New-ComplianceSearchAction -SearchName "Specific Job" -Purge -PurgeType SoftDelete Get-ComplianceSearchAction | Format-Table SearchName, JobStartTime, JobProgress, Status