Office365 2fa mfa logs

German Di 0 Reputation points
2024-03-15T12:43:33.1+00:00

Hi team,

I have a siem wazuh working with the integration of office365. I can see the logs on wazuh events related to O365, but not all.. I want to see on wazuh the losgs related to MFA of users but I cant. I only can see those events on office 365 web interface. Not sure why. Can you help me to see on wazuh the event related to MFA? I thinks that those events dont arrive to wazuh. I mean that are event onl for web interface of azure, that is correct?

I used this guide to integrate O365 successfully on wazuh Monitor Office 365 with Wazuh | Wazuh , But I cant see MFA events on wazuh.

Below the log that I can see on web interface of O365. On Wazuh no logs related to multifactor.

Image

Image

What could I be needing to configure for the mfa events to arrive? Thanks

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
3,855 questions
Office Management
Office Management
Office: A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.Management: The act or process of organizing, handling, directing or controlling something.
2,011 questions