Exchange Admin Center Audit Logs

Question

Hello Team,

Greeting!!

We would like to monitor and intergrade Exchange Admin Center Audit logs such as connectors and transport settings modification with SIEM tool, so please advise on how we could implement syslog in a self-hosted exchange environment. We are awaiting your response.

Regards,

Amichand Jat

Answer 1

Hello @Amichand Jat (NAV Fund Services)

To monitor and integrate Exchange Admin Center (EAC) audit logs, such as modifications to connectors and transport settings, with a SIEM tool, you'll need to set up syslog in your self-hosted Exchange environment.

You can follow this - https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-exchange-admin-audit-logs-by-event-logs
https://learn.microsoft.com/en-us/exchange/policy-and-compliance/admin-audit-logging/admin-audit-logging?view=exchserver-2019

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Answer 2

Hello @Amichand Jat (NAV Fund Services)

To monitor and integrate Exchange Admin Center (EAC) audit logs, such as modifications to connectors and transport settings, with a SIEM tool, you'll need to set up syslog in your self-hosted Exchange environment.

You can follow this - https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-exchange-admin-audit-logs-by-event-logs https://learn.microsoft.com/en-us/exchange/policy-and-compliance/admin-audit-logging/admin-audit-logging?view=exchserver-2019

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.