A collection of custom dashboards to give you a holistic view of your Microsoft 365 environment. These dashboards can help you answer the following questions and more:

  • What files are users sharing internally and externally and with who? Are there users uploading or downloading an unusually large amount of data?
  • Who invited or added a guest user? Were they invited through a shared file or added directly through Active Directory?
  • Where in the world are users logging in from? Are there suspicious user agents attempting to login?
  • Which users receive the most suspicious mail? Where is this mail coming from?
  • What users does Azure AD consider to be risky and why?

The download includes a couple of Elastic Kibana dashboard as well as runtime field code to improve the data that comes from OOTB Elastic modules. To show the data you need to run the Azure and Office 365 module or Elastic Agent integration.

What is Microsoft Office 365?

Microsoft 365 is the productivity cloud. The complete solution includes  office applications, intelligent cloud services and advanced security. Microsoft Office 365 environments usually containing a lot of important company information. Its very important to observe and protect the usage and the information there.


Originally found at

Can also downloaded from Github directly.

Tested versions 7.14, 7.15
ECS compliant Yes
Category , , , , ,
Tags , ,

You must log in to submit a review.

Related downloads

A collection of rules based on the Sigma rules for Windows (process creation folder) based on Winlogbeat data .

Kibana Dashboard example to visualize osquery performance

Cloudflare dashboards and ingest pipelines to visualize cloudflare logs

Kibana dashboard example visualizing the results of the Elastic SIEM detection engine

Kibana canvas example showing an office screen with weather, news and stock information

A Kibana dashboard that visualizes the result of the crawler from Elastic Enterprise Search

These downloads could be also interesting for you

Vega example to show GitHub commits per author per hour of day.

Kibana Canvas example infographic to show coffee consumption on a wallboard

Logstash Pipeline to load Meraki logs via Syslog into Elasticsearch

This watch is getting data from the Elasticsearch shards API directly and checking for large shards.

A scatterplot visualization made with Vega Lite for Kibana

Kibana dashboard example visualizing the results of the Elastic SIEM detection engine