Page Comparison

...

Data source	Message Reports
Description	Reports for every email sent and received through the Exchange Online organization
API endpoint	`https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace`
Collector service name	office365_exchange_message_service
Devo data table	cloud.office365.messagetracing

Vendor setup

In order to configure the integration between Devo and Office 365 Exchange Message Tracing, you need to create an Office 365 user that will be used to authenticate API requests.

...

Rw ui tabs macro

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, get in touch with us and we will guide you through the configuration.

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the Office 365 Exchange Message Tracing collector:

Code Block

<any_directory>
└── devo-collectors/
    └── devo-collector-office365tracing/
          ├── certs/
          │ ├── chain.crt
          │ ├── <your_domain>.key
          │ └── <your_domain>.crt
          └── config/
              └── config-office365tracing.yaml

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in devo-collectors-office365tracing/certs/. Learn more about security credentials in Devo here.

Editing the config.yaml file

Code Block

globals:
  debug: true
  id: <collector_id>
  name: <collector_name>
  persistence:
    type: filesystem
    config:
      directory_name: state
  multiprocessing: <multiprocessing_mode>

outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>
      cert: <cert_filename>
      key: <key_filename>
inputs:
  office365_exchange_message:
    id: <input_id>
    enabled: <input_status>
    requests_per_second: <request_per_seconds>
    credentials:
      username: <creds_username>
      password: <creds_password>
    services:
      office365_exchange_message_service:
        request_period_in_seconds: <period_in_seconds>
        reset_persistence_auth: <reset_persistence_auth>
        override_time_delay_in_hours: <delay_in_hours>

Replace these placeholders with the required values:

Parameter	Data type	Type	Value range	Details
`cert_filename`	`str`	Mandatory	Minimum length: 4 Maximum length: 20	Use this param to identify the `file.cert` downloaded from your Devo domain.
`chain_filename`	`str`	Mandatory	Minimum length: 4 Maximum length: 20	Use this param to identify the certificate file downloaded from your Devo domain. Usually, this file's name is `chain.crt`
`collector_id`	`int`	Mandatory	Minimum length: 1 Maximum length: 5	Use this param to give a unique ID to this collector.
`collector_name`	`str`	Mandatory	Minimum length: 1 Maximum length: 10	Use this param to give a valid name to this collector.
`creds_password`	`str`	Mandatory	Any	Password to authenticate to the service.
`creds_username`	`str`	Mandatory	Email format: `username@domain.com`	Username to authenticate to the service.
`delay_in_hours`	`int`	Optional	Minimum value: 1 Maximum value: 48	Because it can take up to 24 hours for an event to be available through the API, this collector requests data with a 25-hour delay. This parameter allows you to customize this delay. A value less than 25 hours could cause the loss of events in large infrastructures. This parameter can be left blank, removed, or commented.
`devo_address`	`str`	Mandatory	`collector-us.devo.io` `collector-eu.devo.io`	Use this param to identify the Devo Cloud where the events will be sent.
`input_id`	`int`	Mandatory	Minimum length: 1 Maximum length: 5	Use this param to give a unique ID to this input service.
`input_status`	`bool`	Mandatory	`false / true`	If the value is true, the input definition will be executed. If the value is false, the service will be ignored.
`key_filename`	`str`	Mandatory	Minimum length: 4 Maximum length: 20	Use this param to identify the `file.key` downloaded from your Devo domain.
`period_in_seconds`	`int`	Optional	Minimum length: 1	By default, this service will run every 60 seconds. This parameter allows you to customize this behavior. This parameter can be left blank, removed, or commented.
`requests_per_second`	`int`	Optional	Minimum value: 1	Customize the maximum number of API requests per second. If not used, the default setting will be used: 100000 requests/sec This parameter can be left blank, removed, or commented.
`reset_persistence_auth`	`int`	Optional	Date format: `YYYY-MM-DD`	This parameter allows you to clear the persistence of the collector and restart the download pipeline. Updating this value will produce the loss of all persisted data and current pipelines. This parameter can be left blank, removed, or commented.

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-office365tracing-docker-image-1.2.1.tgz	`aaeb75e21944c2072abd6e82db0ec85f75f278a51a0280526f7775b03e2d3f91`

Code Block
gunzip -c collector-office365tracing-docker-image-<version>.tgz \| docker load

Info
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace "`<version>`" with a proper value.

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/office365tracing/

Code Block

docker run \
--name collector-office365tracing\
--volume $PWD/certs:/devo-collector/certs \
--volume $PWD/config:/devo-collector/config \
--volume $PWD/state:/devo-collector/state \
--env CONFIG_FILE=config-office365tracing.yaml \
--rm -it docker.devo.internal/collector/office365tracing:<version>

Note
Replace `<version>` with a proper value.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/office365tracing/ directory.

Code Block

version: '3'
services:
  collector-office365tracing:
    image: docker.devo.com/collector/office365tracing:${IMAGE_VERSION:-latest}
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config-office365tracing.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/office365tracing/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<version>` with a proper value.

...

Version	Old Version 1	New Version 2
Changes made by	Juan Tomás Alonso Nieto (Deactivated)	Former user
Saved on	May 23, 2022	Jun 07, 2022

Versions Compared

Key

Vendor setup

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose