Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing the secret Office 365 detailed activity logs and forensics tool

lmgsecurity.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#21

Post by jonstewart »

ExploitsforFun wrote: post #7

I looked at the API calls on the CrowdStrike blog post and I have been using parts of these API's for calls in PowerShell for at least the past year for tracking down issues we have had in Office 365. I can understand how frustrating it can be if your competitors seem to have "secret knowledge". However that knowledge may have been gotten by calling up the very helpful people at MS support, laying out the problem and…

...which is fine if MS hands out the Powershell script to all who ask.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#22

Post by lixtra »

derefr wrote: post #16
pweissbrod wrote: post #8

Earlier quoted context omitted.

I couldn't agree more. Why is the API not public? Is it because some sort of top secret corporate conspiracy? Or is it that management just decided to avoid the burden of publishing and maintaining an immature or lesser used API? After reading your comment that whole article seemed a little sensationalist

> just decided to avoid the burden of publishing and maintaining an immature or lesser used API "Burden" is an understatement. Any API Microsoft documents becomes part of their ongoing commitment to eternal backward-compatibility. (Heck, even some things they never document at all still end up forced into that commitment, like the internal registry hives in Windows 95.) So Microsoft do everything they can to only doc…

They could just flag it “volatile”, “unstable” or something. It’s very unlikely that Microsoft did not properly document the api internally and as you see it’s leaking out anyway.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#24

Post by oblib »

stevenjohns wrote: post #13
julianj wrote: post #6

This makes me wonder how many other APIs rely solely on obscurity to protect major features.

I don't know if this is to protect so much as it's an undocumented and immature API so they never made it public and kept it for internal use only.

Even if that is true not letting forensics specialists know that those logs existed when critical security events took place is very much a problem. But it gets downright shady when only a handful of companies have them while others are told they do not exist.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#28

Post by johnchristopher »

lstodd wrote: post #14

Could anyone ever honestly believe this data was not logged by Microsoft?? I'm at a loss for words, really.

I am at a loss for words that you honestly believe some people didn't think or assume it was logged.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#29

Post by praseodym »

derefr wrote: post #16
pweissbrod wrote: post #8

Earlier quoted context omitted.

I couldn't agree more. Why is the API not public? Is it because some sort of top secret corporate conspiracy? Or is it that management just decided to avoid the burden of publishing and maintaining an immature or lesser used API? After reading your comment that whole article seemed a little sensationalist

> just decided to avoid the burden of publishing and maintaining an immature or lesser used API "Burden" is an understatement. Any API Microsoft documents becomes part of their ongoing commitment to eternal backward-compatibility. (Heck, even some things they never document at all still end up forced into that commitment, like the internal registry hives in Windows 95.) So Microsoft do everything they can to only doc…

While that may be true for the Win32 APIs, it is certainly not true for their cloud-based products. They’ve had some very poor APIs for Windows Live Mail (predecessor of Office 365 for education) which were also quickly deprecated and replaced.
Post reply on HN