<!--
  Wazuh 5.0 Microsoft 365 collection, agent-side.

  From Wazuh 5.0 the Office 365 module can only be configured on the agent.
  The module is supported on Windows, Linux and macOS. Enable it on ONE agent
  to avoid collecting duplicate events.

  Options and allowed values are from:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/office365-module.html

  Requires an Azure app registration with Office 365 Management APIs
  application permissions ActivityFeed.Read and, for DLP, ActivityFeed.ReadDlp.
  Administrator consent is required.
-->
<ossec_config>

  <office365>
    <enabled>yes</enabled>
    <!-- Default 10m. -->
    <interval>1m</interval>
    <!-- Maximum size allowed for the Office365 API response. Default 1M. -->
    <curl_max_size>1M</curl_max_size>
    <!-- yes = collect only events generated after the agent starts. -->
    <only_future_events>yes</only_future_events>

    <api_auth>
      <tenant_id>YOUR_TENANT_ID</tenant_id>
      <client_id>YOUR_CLIENT_ID</client_id>
      <!-- client_secret_path is an alternative to client_secret and points at
           a file holding the secret. The two options are incompatible.
           Prefer the path form when this block is distributed through a
           group's shared agent.conf. -->
      <client_secret>YOUR_CLIENT_SECRET</client_secret>
      <!-- commercial | gcc | gcc-high -->
      <api_type>commercial</api_type>
    </api_auth>

    <!-- Repeat api_auth to serve more than one tenant from this agent.
    <api_auth>
      <tenant_id>YOUR_TENANT_ID_2</tenant_id>
      <client_id>YOUR_CLIENT_ID_2</client_id>
      <client_secret>YOUR_CLIENT_SECRET_2</client_secret>
      <api_type>commercial</api_type>
    </api_auth>
    -->

    <!-- Audit.AzureActiveDirectory | Audit.Exchange | Audit.SharePoint
         | Audit.General | DLP.All -->
    <subscriptions>
      <subscription>Audit.AzureActiveDirectory</subscription>
      <subscription>Audit.General</subscription>
    </subscriptions>
  </office365>

</ossec_config>
