Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

In the Azure portal, navigate to Azure Active Directory > App registrations.

Select the application that you created.

Navigate to  Certificates & secrets.

In the Client secrets area, click New client secret.

Provide a relevant description for the key and select Never for the expiration.

Click Add.

The Client secrets section displays the client secret value in the Value column.

Copy the value for client secret.

In the Azure portal, navigate to Azure Active Directory > App registrations.

Select the application that you created.

Navigate to the Certificates & secrets section.

If you don't already have the certificate and private key files, create them.

Generate the X.509 asymmetric key by running the following command in the terminal:

openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 3650 -out certificate.pem

Two files are created in the directory where you ran the command:

In the Certificates area, click Upload certificate.

Select a file and browse to the folder where the certificate file is saved and upload the certificate.pem file. Then click Add.

In the Azure portal, navigate to Azure Active Directory > App registrations.

Select the application that you created.

Navigate to API permissions > Add a permission > Microsoft Graph > Application Permissions.

Click Select an API to select an API to which you want to grant permissions.

The Select Permission section lists all the required permissions.

Select the check box for the required permission. For example, select read all users full profiles.

Repeat the steps for each of the required permissions.

Click Add Permissions.

For the Exabeam cloud connector version 2.4.254 and later, for Graph Security Alerts endpoint, add the application permission for SecurityEvents.Read.All by selecting its check box.

Grant the application permissions for the new Microsoft Graph API endpoints. If you are unable to add these permissions, add the application permission for DirectoryReadAll in Azure Active Directory Graph API.

To save the permissions you added, Grant admin consent.

A verification message displays that the admin consent is granted for the requested permissions.

On the Azure portal, navigate to App registrations > All Applications.

In the All Applications tab that lists all the applications, click your application.

Click API Permissions for the application you selected, then click Add a permission to view the Request API permissions window.

In Request API permissions, on the APIs my organization uses tab, search for Office 365 and click Office 365 Exchange Online in the search result list.

Click Application permissions and select ReportingWebService.Read.All.

Application permissions enable the client app to authenticate itself without user interaction or consent. For example, the apps used by background services or daemon apps.

Click Add Permissions.

Click Grant admin consent for to provide consent for the permissions given to your application.

In the confirmation box, click Yes.

Reporting Web Service permissions are granted for your app.

Ensure Message Trace is collected by Microsoft.

If there was no data in the Message Trace search results, or some results were missing (for example excluding some users), refer to the Microsoft guide to enable Microsoft to collect the message trace events.

Choose the Exchange Admin Reports data for which you want to collect.

Because some of the Exchange Admin Reports require different permissions, it is important to understand the configuration requirements to allow the collection of the data you need. Refer to the Exchange Online permissions for the permissions required for each report type.

For example, if you want to collect only Message Trace events, then the View-Only Organization Management role is sufficient.

If you want to collect all other Exchange Reports, except the DLP, then you’d also need to assign the View-Only Recipients role.

And for DLP, assign the Compliance Management role.

Assign the minimum set of required permissions to the user.

To assign the above roles to the user, log into the old Exchange Admin Portal (https://outlook.office365.com/ecp).

1. Go to Permissions on the left panel and then to the Admin Roles tab.

2. Select the required role and click the pencil icon at the top.

3. Under the Members section click + and search for the username of the user to whom you want to the role.

4. Select it and click Add at the bottom, and then click OK.

5. Save your changes.

It can take anywhere between 3 to 12 hours for Microsoft to apply the new permissions to the user.

Validate that the user can read the events using the Microsoft API.

Enable the Exchange Admin Report endpoints.

By default, the Exchange Admin Report endpoints, all prefixed by exchange-admin-report- are stopped.

1. After the credentials are set, enable the endpoints for which the account enables collection. To do that, click on STATUS on the Office365 connector row, and find the rows of the respective endpoints.

2. Click START on each of the endpoints.

   It takes 2-5 minutes until the first sync attempts complete. Exabeam automatically updates the row status when complete.

   If you overserve any errors in collection for one or more of the Exchange Admin Reports endpoints, the connector will show a status of ERROR. To troubleshoot:

   1. Click STATUS to see which endpoints are failing and then click a row of an endpoint that is failing.

      This opens the synchronization details on the right panel which identify up to 3 of the last synchronization attempts, each with the result status and an error if applicable. Common errors are a 401 status code which indicates that a permission is missing.

   2. If it has been more than 12 hours since the permissions were granted to the user, and you’re still getting this error, try to run the command listed in Step 3.

   3. If the error shows there as well, re-validate the all the permissions listed in Create an Account with Permissions to Collect Events were completed successfully.

   4. If still the issue persists, please open a ticket with Microsoft to troubleshoot.

3. Click DONE to return to the accounts list.

In case of an error in collection for one or more of the Exchange Admin Reports endpoints, the connector will show a status of ERROR.