Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GCC High no available content locations: #57

Open
mgovolt opened this issue May 20, 2021 · 1 comment
Open

GCC High no available content locations: #57

mgovolt opened this issue May 20, 2021 · 1 comment

Comments

@mgovolt
Copy link

mgovolt commented May 20, 2021

I get o365beat[17747]: 2021-05-20T01:17:13.009Z#011DEBUG#011[api]#011beater/o365beat.go:336#011got these available content locations: []
When attempting to connect to GCC High using these values:
login_url: 'https://login.microsoftonline.us'
resource_url: 'https://manage.office365.us'

That is what was in the instructions. Is there something else to do for GCC High? Do content locations have different names?

@mgovolt
Copy link
Author

mgovolt commented May 21, 2021

Actually, let me amend this. I am getting audit.Exchange events. However this is a new GCC High environment and the only real activity is in Azure AD, but it is not seeing any Audit.AzureActiveDirectory events. Content Types are set at:
content_types:
- Audit.AzureActiveDirectory
- Audit.Exchange
- Audit.SharePoint
- Audit.General
Can someone verify GCC High still has a content type of Audit.AzureActiveDirectory?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant